System requirements
Table of Contents
Expand all | Collapse all
-
- Activate Next-Generation Trust Security
-
-
- Configure AWS connection
- Configure Azure Key Vault connection
-
- Workload Identity Federation authentication
- Workload Identity Federation - Azure Identity Provider authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Workload Identity Federation authentication
- Next-Gen Trust Security Generated Key authentication
- User permissions
- Supported OIDC claims
-
-
-
-
- Create an F5 BIG-IP LTM machine
- Create a Microsoft Azure Private Key Vault machine
- Create a Microsoft IIS machine
- Create a Microsoft Windows (PowerShell) machine
- Create a Microsoft SQL Server machine
- Create a Common KeyStore machine
- Create a Citrix ADC machine
- Create an Imperva WAF machine
- Create a VMware NSX Advanced Load Balancer (AVI) machine
- Create an A10 Thunder ADC machine
- Create a Cloudflare machine
- Create Kemp Virtual LoadMaster machine
- Create a Palo Alto Panorama machine
-
- Provision to an F5 BIG-IP LTM
- Provision to a Microsoft Azure Private Key Vault
- Provision to Microsoft IIS
- Provision to Microsoft Windows (PowerShell)
- Provision to Microsoft SQL Server
- Provision to a Common KeyStore
- Provision to a Citrix ADC
- Provision to an Imperva WAF
- Provision to VMware NSX Advanced Load Balancer (AVI)
- Provision to an A10 Thunder ADC
- Provision to Cloudflare
- Provision to a Kemp Virtual LoadMaster
- Provision to Palo Alto Panorama
-
-
- 47-Day Validity Readiness TLS Certificates dashboard
- About the Certificate Inventory
- Managing certificate lifecycle settings
- Reissuing certificates in Next-Gen Trust Security
- Downloading certificates, certificate chains, and keystores
- Retiring, recovering, and deleting certificates
- Finding certificates in the certificate inventory
- Importing certificates from a CA using EJBCA
- Notification Center overview
- Domain-based validation for external emails
- Managing user accounts
- Troubleshooting
System requirements
Make sure that the target computer where you plan to install VSatellite meets the minimum requirements detailed below.
Operating systems
VSatellite is expected to work on most modern Linux systems (x86_64). However, review the following.
Supported
Supported means fully tested by QA during the development life cycle. If issues or defects do arise, they'll be resolved by CyberArk.
Supported operating systems include the following:
- Ubuntu LTS 18.04 or later (x86_64)
- Red Hat Enterprise Linux (RHEL) 7.9, 8.x and 9.x (x86_64)
- Oracle Linux 8.x and 9.x (x86_64)
- Rocky Linux 8.x and 9.x (x86_64)
Tip (RHEL, Oracle, and Rocky Linux installations):
For RHEL, Oracle Linux, and Rocky Linux installations, review these special considerations.
Ensure that your selected operating system is updated with the latest patches. At a minimum, it must be able to retrieve updates from the operating system's standard software repository (for example, using apt-get or yum).
System resources
You can install VSatellites on either virtual computers (most common) or on physical hardware. In either case, VSatellite requires at least the following resources to function normally:
- 4 GB RAM
- 2 CPUs
- 10 GB of free disk space
Important (Disk space requirements for VSatellite installation): Carefully consider the necessary disk space requirements for installing VSatellite, including considerations for both default and custom installations.
Default installation
VSatellite uses specialized technology (Kubernetes K3s) and requires specific disk space allocations across various folders to ensure optimal performance:
- Total required disk space: 10 GB of free disk space.
- Distribution of disk space:
- /var/lib/rancher: ~85% of required space
- /var/lib/kubelet: ~5% of required space
- /usr/local/bin: ~5% of required space
- /var/log/containers: ~3% of required space
- /etc/rancher: ~2% of required space
Note: If you have mounted any of the above folders to a different location, ensure that the new location has enough space based on these percentages. For instance, mounting /var/lib/rancher on a separate disk at /mnt/mydisk/rancher means this location needs to accommodate approximately 85% of the required VSatellite disk space.
Using the --install-dir option
The --install-dir option simplifies the installation process by consolidating all VSatellite artifacts into a single directory, altering the disk space allocation:
- Installation directory structure:
- INSTALL_DIR/vsatellite/logs for logs
- INSTALL_DIR/vsatellite/bin for binary files, including kubectl
- INSTALL_DIR/vsatellite/data for Kubernetes k3s data
- Disk space check: When using --install-dir, the disk space check is performed against the specified directory instead of the default locations. Ensure the specified INSTALL_DIR has at least 10 GB of free disk space available to accommodate all components of the VSatellite installation.
- Additional considerations:
- A soft link from /etc/rancher/k3s to INSTALL_DIR/vsatellite/data will be created.
- A .vsatellite file in the user's home directory will be generated, containing paths to the install and log directories.
- To execute kubectl commands, users may need to manually add INSTALL_DIR/vsatellite/bin to their PATH.
The entire 10GB disk space requirement applies to the directory specified by --install-dir, as this option consolidates the installation into a single location. Adjust your disk space planning accordingly.
Root privileges
You need permission to run commands with root privileges. The following options are available.
Use sudo
If the sudo command is available on your target Linux machine, you can use it to install VSatellite.Alternative privilege elevation utilities, such as dzdo, are not supported and may result in installation failure.
Use a root shell
If you are already logged in as the root user, you do not need the sudo command.In this case, omit sudo wherever it appears in vsatctl commands in the documentation.
Why are root privileges required?
The vsatctl install command installs k3s in /usr/local/bin, which is owned by the root user.
If you are installing VSatellite on RHEL, Oracle, or Rocky Linux, the vsatctl install command installs the k3s-selinux RPM package. Installing RPM packages requires root privileges.
Other vsatctl subcommands connect to the VSatellite cluster and require access to credentials stored in /etc/rancher/k3s/k3s.yaml. This file is accessible only to the root user.