This is Step 1 of the DSPM DRA Setup |
|---|
Requirements
| Info |
|---|
We use Kubernetes, an open-source container orchestration system to manage our applications. At the moment the only Kubernetes distribution supported is K3s (click here for the official documentation) by Suse Linux for both on-premise and cloud deployments. |
The minimum requirements for the Kubernetes cluster is a single node (1 virtual machine) with the following specs:
...
DSPM | |
|---|---|
CPU | 20 cores |
⚠️ The CPU must support the instructions SSE4.1, SSE4.2, AVX, AVX2, FMA. Only x86_64 architecture is supported. Minimum CPU speed is 2.2 GHz | |
Memory | 80GB |
Storage | 700GB Min available inodes for ext4: 39M |
Storage details |
|
...
minimum 20 GB allocated at /var
| |
Operating System | Ubuntu 20.04 LTS Server is recommended, other supported operating systems include:
|
...
Only Server edition versions are supported. No Desktop Environment installed. No other linux distributions are supported.
| ||
Firewall |
| |
K3s version support | 1. |
...
24, 1.26 | |
Other requirements |
For hardened systems, see: Deploying Product in CIS hardened OS or K3s When deploying using RHEL / CentOS / Suse:
|
...
When deploying using Ubuntu:
|
Network settings
Your network should be configured to allow the following public URLs to be accessible over port 443 (HTTPS) and HTTPS traffic is bypassed (NOT intercepted):
| Code Block |
|---|
https://assets.master.k3s.getvisibility.com (Custom K3s installation files)
https://images.master.k3s.getvisibility.com (Private Docker registry)
https://charts.master.k3s.getvisibility.com (Private Helm registry)
https://prod-eu-west-1-starport-layer-bucket.s3.eu-west-1.amazonaws.com (Docker registry AWS CDN)
https://rpm.rancher.io (Rancher RPM repo for configuring SELinux packages on RHEL or CentOS)
https://api.master.k3s.getvisibility.com (Private API server)
https://rancher.master.k3s.getvisibility.com (Rancher management server)
https://rancher.$RESELLER_NAME.k3s.getvisibility.com (Rancher management server, where $RESELLER_NAME is Getvisibility for direct customers)
For Forcepoint these are:
https://rancher.forcepointus.k3s.getvisibility.com/
https://rancher.forcepointapac.k3s.getvisibility.com/
https://rancher.forcepointemea.k3s.getvisibility.com/ |
Installation
...
If using proxy, please run this before using curl:
| Code Block |
|---|
export http_proxy="$PROXY_IP"
export https_proxy="$PROXY_IP" |
Before installation please use the following command to see if product requirements are met.
| Code Block |
|---|
curl -sfL https://assets.master.k3s.getvisibility.com/k3s/k3s.sh | PRODUCT_NAME=ultimate ONLY_PRECHECK=true bash - |
Run k3s installer using the following command as root user:
...
| Note |
|---|
You need to be logged as a root user to perform installation. |
| Tip | |||||
|---|---|---|---|---|---|
Here is the syntax for the k3s.sh installer to perform full prerequisites check and start the installation:
|
| Info |
|---|
...
We provide a number of optional switches to use with k3s.sh installer, check below what functionality they offer. |
Argument | Description |
|---|---|
SKIP_PRECHECK=true | to skip |
...
all built in checks | |
SKIP_SYSTEM_CHECKS=true | to skip |
...
hardware |
...
checks | |
SKIP_NETWORK_CHECKS=true | to skip |
...
connectivity checks | |
ONLY_PRECHECK=true | will run precheck only and stop after that |
...
Run the kubectl registration command:
| Note |
|---|
For Forcepoint customers, Forcepoint’s SE generates the DSPM license key, which is shared with the customer via email. For all other partner customers, Getvisibility will provide the kubectl registration command. |
Run the kubectl registration command:
| Code Block |
|---|
The command below is just an example, it will not work during deployment!
kubectl apply -f https://....k3s.getvisibility.com/v3/import/dxslsxcf84....yaml |
| Warning |
|---|
For security reasons the registration command can be used only a single time, the command becomes invalid after the first use. In case you need to run it again you must contact the support team for a new registration command. |
Monitor the progress of the installation: watch -c "kubectl get deployments -A"
The K3s deployment is complete when elements of all the deployments (coredns, local-path-provisioner, metrics-server, traefik and cattle-cluster-agent) show at least "1" as "AVAILABLE"
In case of errors you can inspect the logs of a pod using
kubectl logs, e.g.kubectl logs cattle-cluster-agent-d96d648d8-wjvl9 -n cattle-system
Now, go to the Step 2, which is available via this link – DSPM DRA - Rancher Configuration |
|---|