Content Comparison

You can install Synergy and Focus DSPM in an air-gapped environment that is not directly connected to the Internet.

...

Note
Make sure you have `/usr/local/bin` configured in your PATH: `export PATH=$PATH:/usr/local/bin`). All the commands must be executed as `root` user.

Info
The commands have been tested on Ubuntu Server 20.04 LTS, SUSE Linux Enterprise Server 15 SP4 and RHEL 8.6.

Note

For RHEL, K3s needs the following package to be installed: k3s-selinux (repo rancher-k3s-common-stable) and its dependencies container-selinux (repo rhel-8-appstream-rhui-rpms) and policycoreutils-python-utils (repo rhel-8-baseos-rhui-rpms).
Also, firewalld nm-cloud-setup.service and nm-cloud-setup.timer must be disabled and the server restarted before the installation, click here for more information.On systems without access to online repositories, the corresponding *.rpm package for each of the above dependencies should be copied to the server first and installed locally.

Other SUSE, CentOS, RedHat prerequisites: Prerequisites for k3s on RHEL/CentOS/Oracle Linux

Ubuntu prerequisites: Prerequisites for k3s on Ubuntu Linux

The steps below you guide you through the air-gap installation of K3s, a lightweight Kubernetes distribution created by Rancher Labs:

Extract the downloaded file:

Code Block
tar -xf gv-platform-$VERSION.tar # (replace$VERSION according to downloaded file)

Prepare K3s for air-gap installation:

Code Block

breakoutMode	wide
language	bash

...

sudo su -
mkdir -p /var/lib/rancher/k3s/agent/images/

...

gunzip -c assets/k3s-airgap-images-amd64.tar.gz > /var/lib/rancher/k3s/agent/images/airgap-images.tar

...

cp assets/k3s /usr/local/bin && chmod +x /usr/local/bin/k3s

...


tar -xzf assets/helm-v3.8.2-linux-amd64.tar.gz

...

cp linux-amd64/helm /usr/local/bin

...

Before installation, it’s recommended to run automatic checks (as root; PRODUCT_NAME is either “synergy” (endpoint agent) or “dspm“ (dspm without endpoint agent) or “ultimate“ (dspm + endpoint agent). If unsure use “ultimate“):
Code Block

...

language	bash

...

cat scripts/k3s.sh |

...

PRODUCT_NAME=ultimate ONLY_PRECHECK=true bash -

Install K3s:

Code Block

language	bash

cat scripts/k3s.sh | INSTALL_K3S_SKIP_DOWNLOAD=true K3S_KUBECONFIG_MODE="644" \ 
SKIP_NETWORK_CHECKS=true sh -s - server --node-name=local-01

...

Wait for the 30s and check if K3s is running with the command: kubectl get pods -A and systemctl status k3s.service

Import Docker images

The steps below will manually deploy the necessary images to the cluster.

Import Docker images locally:

Code Block

language	bash

$ mkdir /tmp/import
$ for f in images/*.gz; do IMG=$(basename "${f}" .gz); gunzip -c "${f}" > /tmp/import/"${IMG}"; done
$ for f in /tmp/import/*.tar; do ctr -n=k8s.io images import "${f}"; done

Install Helm charts

The following steps guide you through the installation of the dependencies required by Focus and Synergy.

Info
Replace `$VERSION` with the version that is present in the bundle that has been downloaded. To check all the charts that have been download run `ls charts`.

Install Getvisibility Essentials and set the daily UTC backup hour (0-23) for performing backups.

...

Info

Few more arguments that can be used to customize the execution of the k3s script:
SKIP_PRECHECK=true to skip the execution of the precheck script while installing k3s service

SKIP_SYSTEM_CHECKS=true to skip the system hardware checking during precheck

SKIP_NETWORK_CHECKS=true to skip the system network connectivity checking during precheck

Example:

cat scripts/k3s.sh | INSTALL_K3S_SKIP_DOWNLOAD=true SKIP_PRECHECK=true K3S_KUBECONFIG_MODE="644" sh -s - server --node-name=local-01

Wait for the 30s and check if K3s is running with the command: kubectl get pods -A and systemctl status k3s.service

Import Docker images

The steps below will manually deploy the necessary images to the cluster.

Import Docker images locally:

Code Block

breakoutMode	wide
language	bash

mkdir /tmp/import
for f in images/*.gz; do IMG=$(basename "${f}" .gz); gunzip -c "${f}" > /tmp/import/"${IMG}"; done
for f in /tmp/import/*.tar; do ctr -n=k8s.io images import "${f}"; done

Install Helm charts

The following steps guide you through the installation of the dependencies required by DSPM and Synergy (Endpoint Agent).

Info

Replace $VERSION with the version that is present in the bundle that has been downloaded.
To check all the charts that have been downloaded run ls charts.

Replace IPADDRESS/DNS/FQDN with IP Adress or FQDN or DNS name for Keycloak in formats like below https://192.168.10.1 or https://gv.domain.local or https://gv.getvisibility.com
In case you want to enable kibana on airgap cluster add below setting to the Helm command
--set eck-operator.kibanaEnabled=true

Install Getvisibility Essentials and set the daily UTC backup hour (0-23) for performing backups.

Code Block

helm upgrade --install gv-essentials charts/gv-essentials-$VERSION.tgz --wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--set backup.hour=1 \
--set eck-operator.enabled=true \
--set updateclusterid.enabled=false \
--set keycloak.url=https://(IPADDRESS|DNS|FQDN)

Install Monitoring CRD:

Code Block
helm upgrade --install rancher-monitoring-crd charts/rancher-monitoring-crd-$VERSION.tgz \ --wait \ --kubeconfig /etc/rancher/k3s/k3s.yaml \ --namespace=cattle-monitoring-system \ --create-namespace

Install Monitoring:

Code Block

helm upgrade --install gvrancher-essentialsmonitoring charts/gvrancher-essentialsmonitoring-$VERSION.tgz \
--wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--namespace=cattle-monitoring-system \
--set backupk3sServer.hourenabled=1true \
--set eck-operatork3sControllerManager.enabled=true

Install Monitoring CRD:

Code Block

$ helm upgrade --install rancher-monitoring-crd charts/rancher-monitoring-crd-$VERSION.tgz --wait \
--set k3sScheduler.enabled=true \
--set k3sProxy.enabled=true \
--kubeconfig /etc/rancher/k3s/k3s.yaml \
--namespace=cattle-monitoring-system \
--create-namespace

Install Monitoring:

Code Block
$ set prometheus.retention=5 \

Info
To expose Grafana via an ingress on the path `/grafana` (allowing access through `https://IPADDRESS_or_DNSNAME/grafana`), add the following flag to the monitoring installation command:

Code Block
--set global.grafana_ingress.enabled=true

Check all pods are Running with the command: kubectl get pods -A

Install DSPM/Synergy (Endpoint Agent) Helm Chart

Replace the following variables:

$VERSION with the version that is present in the bundle that has been downloaded
$RESELLER with the reseller code (either getvisibility or forcepoint)
$PRODUCT with the product being installed (synergy, dspm, enterprise or ultimate)

Code Block
helm upgrade --install

...

gv-

...

platform charts/

...

gv-

...

platform-$VERSION.tgz --wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--

...

set-string clusterLabels.environment=prod \
--set-string

...

clusterLabels.

...

cluster_reseller=

...

$RESELLER \
--set

...

-string clusterLabels.cluster_name=mycluster \
--set-string

...

clusterLabels.

...

product=

...

Check all pods are Running with the command: kubectl get pods -A

Install Focus/Synergy Helm Chart

Replace the following variables:

$VERSION with the version that is present in the bundle that has been downloaded
$RESELLER with the reseller code (either getvisibility or forcepoint)
$PRODUCT with the product being installed (synergy or focus or enterprise)

Code Block

helm upgrade --install gv-platform charts/gv-platform-$VERSION.tgz --wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--set-string clusterLabels.environment=prod \
--set-string clusterLabels.cluster_reseller=$RESELLER \
--set-string clusterLabels.cluster_name=mycluster \
--set-string clusterLabels.product=$PRODUCT$PRODUCT

Info

In case if you experience 404 error for accessing to Keycloak or UI and use 1.26 (default) version of K3s ensure that traefik patch is applied

Code Block

kubectl patch clusterrole traefik-kube-system -n kube-system --type='json' -p='[{"op": "add", "path": "/rules/-1/apiGroups/-", "value": "traefik.io"}]'
kubectl apply -f assets/traefik-patch.yaml
kubectl rollout restart deployment traefik -n kube-system

Install custom artifact bundles

...

The following port must be publicly exposed in order to allow users to access Synergy (Endpoint Agent) or Focus DSPM product:

Protocol	Port	Description
TCP	443	FocusDSPM/Synergy (Endpoint Agent) backend

The user must not access the K3s nodes directly, instead, there should be a load balancer sitting between the end user and all the K3s nodes (master and worker nodes):

...

The following steps guide you through the installation of the dependencies required by Focus DSPM and Synergy (Endpoint Agent).

Note
Perform the following steps in the master1 Node

...

Install Getvisibility Essentials and set the daily UTC backup hour (0-23) for performing backups.
If you are installing Focus or Enterprise append --set eck-operator.enabled=true to the command in order to enable ElasticSearchfor performing backups.

Code Block

$ helm upgrade --install gv-essentials charts/gv-essentials-$VERSION.tgz --wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--set global.high_available=true \
--set eck-operator.enabled=true  \
--set minio.replicas=4 \
--set minio.mode=distributed \
--set consul.server.replicas=3 \
--set updateclusterid.enabled=false \
--set backup.hour=1
--set eck-operator.enabled=true

Install Monitoring CRD:

Code Block
$ helm upgrade --install rancher-monitoring-crd charts/rancher-monitoring-crd-$VERSION.tgz --wait \ --kubeconfig /etc/rancher/k3s/k3s.yaml \ --namespace=cattle-monitoring-system \ --create-namespace

Install Monitoring:

Code Block

$ helm upgrade --install rancher-monitoring charts/rancher-monitoring-$VERSION.tgz --wait \
---waitkubeconfig /etc/rancher/k3s/k3s.yaml \
--set global.high_available=true \
--namespace=cattle-monitoring-system \
--kubeconfig /etc/rancher/k3s/k3s.yamlset loki-stack.loki.replicas=2 \
--set global.high_available=true \
--namespace=cattle-monitoring-system \
--set loki-stack.loki.replicas=2 \
--set prometheus.prometheusSpec.replicas=2prometheus.prometheusSpec.replicas=2
--set prometheus.retention=5

Info
To expose Grafana via an ingress on the path `/grafana` (allowing access through `https://IPADDRESS_or_DNSNAME/grafana`), add the following flag to the monitoring installation command:

Code Block
--set global.grafana_ingress.enabled=true

Check all pods are Running with the command:
kubectl get pods -A

Install

...

DSPM/Synergy (Endpoint Agent) Helm Chart

Replace the following variables:

$VERSION with the version that is present in the bundle that has been downloaded
$RESELLER with the reseller code (either getvisibility or forcepoint)
$PRODUCT with the product being installed (synergy or focus dspm or enterprise ultimate)

Code Block

$ helm upgrade --install gv-platform charts/gv-platform-$VERSION.tgz --wait \
--timeout=10m0s --kubeconfig /etc/rancher/k3s/k3s.yaml \
--set high_available=true \
--set-string clusterLabels.environment=prod \
--set-string clusterLabels.cluster_reseller=$RESELLER \
--set-string clusterLabels.cluster_name=mycluster \
--set-string clusterLabels.product=$PRODUCT

...

Before upgrading each chart, you can check the settings used in the current installation with
helm get values <chartname>.
If the current values are different from the defaults, you will need to change the parameters of the
helm upgrade command for the chart in question.
For example, if the backup is currently set to run at 2 AM instead of the 1 AM default, change
--set backup.hour=1 to --set backup.hour=2.
Below is a mostly default config.

...

DSPM/Synergy/

...

Ultimate Helm Chart

To upgrade FocusDSPM/Synergy/Enterprise Ultimate you must:

Download the new bundle
Import Docker images
Install FocusDSPM/Synergy/Enterprise Ultimate Helm Chart

Info
Import Docker images only to the Master1 node In the case of HA deployment, Recreate and redeploy the `imagecache.yaml` file https://getvisibility.atlassian.net/wiki/spaces/GSKBTES/pages/148242433227540993/Air+Gap+Installation#Install-Kube-fledged: Perform the 2nd Step

GetVisibility Essentials Helm Chart

...

Info
Import Docker images only to the Master1 node In the case of HA deployment, Recreate and redeploy the `imagecache.yaml` file https://getvisibility.atlassian.net/wiki/spaces/GSKBTES/pages/148242433227540993/Air+Gap+Installation#Install-Kube-fledged: Perform the 2nd Step

Install custom artifacts

...

Version	Old Version 5	New Version Current
Changes made by	Space Sync for Confluence	Space Sync for Confluence
Saved on	Dec 14, 2023	Dec 03, 2024

Content Comparison

Versions Compared

Key

Import Docker images

Install Helm charts

Import Docker images

Install Helm charts

Install DSPM/Synergy (Endpoint Agent) Helm Chart

Install Focus/Synergy Helm Chart

Install custom artifact bundles

Install

DSPM/Synergy (Endpoint Agent) Helm Chart

...

DSPM/Synergy/

Ultimate Helm Chart

GetVisibility Essentials Helm Chart

Install custom artifacts