Runecast Analyzer

This chart deploys Runecast Analyzer with nginx frontend proxy and PostgreSQL backend. For more information about Runecast Analyzer please visit the Runecast website.

• Requirements
• Installation and upgrade
  • OS analysis
• Values
  • Examples
  • List of values
• Usage

Requirements

• Kubernetes cluster
• Helm 3 (Helm 2.2.0+ should work but is not validated)
• 2.6 CPU requests / 6.5 CPU limits
• 7.4 GB RAM requests / 14 GB RAM limits
• 61 GB persistent storage

Installation and upgrade

To install Runecast Analyzer with the default settings, follow these steps:

1. Add Runecast Helm repository to Helm repository list:

   helm repo add runecast https://helm.runecast.com/charts

2. Install Runecast Analyzer

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer

OS analysis

OS analysis in Runecast Analyzer requires additional components to be installed. If we installed them by default, it would mean a waste of resources for those, that won’t use this feature.

Therefore, in K8s deployment, additional steps are needed besides the standard OS analysis configuration process. To deploy the application:

1. Prepare a hostname (FQDN or IP address) that will be used by the OS agents to reach the OS analysis service. The hostname should lead to the OS analysis service, which can be exposed on the nodes as a NodePort or as a LoadBalancer if external loadbalancer is used.

2. Deploy the application using a Helm chart with value global.osanalysis.enabled set to true and hostname specified in global.osanalysis.hostname.

3. To configure the OS analysis, continue in the application. Use the hostname from the previous step in the Runecast Address field.

Please see the Examples below for more information.

Values

To modify the deployment, please use values.yaml file with the required changes or set the individual values directly on the command line. The list of values can be found in the section List of values or displayed by running the following command:

helm show values runecast/runecast-analyzer

Examples

To find more information about changing deployment values, please see the Values Files section of the Helm User Guide.

Using ingress with SSL termination

The following example shows how to deploy the application and expose it via Nginx ingress with SSL termination.

1. Create the secret runecast-analyzer-ingress-tls from the key and the certificate:

   kubectl create secret tls runecast-analyzer-ingress-tls --key </path/to/key_file> --cert </path/to/cert_file>

   To create a self-signed certificate for testing, you can use the following command:

   openssl req -x509 -nodes -newkey rsa:4096 -days 365 -keyout </path/to/key_file> -out </path/to/cert_file> -subj "/CN=localhost"

2. Create the my-values.yaml file with the following content:

   nginx:
     ingress:
       enabled: true
       hosts:
         - host: rca.local.domain
           paths:
             - / 
       tls:
         - secretName: runecast-analyzer-ingress-tls
           hosts:
             - rca.local.domain

3. Install the application providing the custom my-values.yaml file:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer -f my-values.yaml

Running without persistent data

By default, the application is installed with Persistent Volumes. If you would like to test the application without persisting data, you can simply disable the persistence storage by setting the respective values:

helm upgrade --install runecast-analyzer runecast/runecast-analyzer --set persistence.enabled=false --set postgresql.persistence.enabled=false --set imagescanning.persistence.enabled=false

Exposing the application via LoadBalancer service on secure port with custom certificate

1. Create the secret runecast-analyzer-certificate from the key and the certificate:

   kubectl create secret tls runecast-analyzer-certificate --key </path/to/key_file> --cert </path/to/cert_file>

2. Install the application providing the custom values on the command line:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer --set nginx.service.type="LoadBalancer" --set nginx.service.tls.enabled=true --set nginx.service.tls.existingSecretName="runecast-analyzer-certificate"

Installing with OS analysis enabled

1. Prepare a hostname that will point to the OS analysis service. The service can be exposed via NodePort on the nodes or via LoadBalancer if external loadbalancer is used. The default is service of type NodePort with the port set to 31443. To change it, please see the fleet.service values.

2. Deploy the application with OS analysis enabled:

   helm upgrade --install runecast-analyzer runecast/runecast-analyzer --set global.osanalysis.enabled=true --set global.osanalysis.hostname="example.cluster.k8s"

List of values

Global values and Runecast

Database backend (PostgreSQL)

Reverse proxy frontend (nginx)

OS analysis

Image Scanning

Usage

To find out how to configure and use the product, including the required permissions for scanning a Kubernetes cluster, please follow the official documentation available at https://docs.runecast.com/.