OpenShift

Upgrade Prisma Cloud running in your OpenShift cluster.

Upgrading Console

  1. Download the latest Twistlock release to the host where you manage your cluster with
    oc
    .
  2. If you customized
    twistlock.cfg
    , port those changes forward to
    twistlock.cfg
    in the latest release. Otherwise, proceed to the next step.
  3. (Optional) If you’re storing Twistlock images in the cluster’s internal registry, pull the latest images from Twistlock’s cloud registry and push them there. >>>>>>> master:upgrade/upgrade_openshift.adoc Otherwise, proceed to the next step.
    1. Pull the latest Prisma Cloud images using URL auth.
      $ sudo docker pull registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/defender:defender_<VERSION> $ sudo docker pull registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/console:console_<VERSION>
    2. Retag the images so that they can be pushed to your
      $ sudo docker tag \ registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/defender:defender_<VERSION> \ docker-registry.default.svc:5000/twistlock/private:defender_<VERSION> $ sudo docker tag \ registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/console:console_<VERSION> \ docker-registry.default.svc:5000/twistlock/private:console_<VERSION>
    3. Push the Prisma Cloud images to your cluster’s internal registry.
      $ sudo docker push docker-registry.default.svc:5000/twistlock/private:defender_<VERSION> $ sudo docker push docker-registry.default.svc:5000/twistlock/private:console_<VERSION>
  4. Generate new YAML configuration file for the latest version of Twistlock. Pass the same options to
    twistcli
    as you did in the original install. The following example command generates a YAML configuration file for the default basic install.
    $ <PLATFORM>/twistcli console export openshift \ --persistent-volume-labels "app-volume=twistlock-console" \ --service-type "ClusterIP"
    If you want to pull the image from the internal registry:
    $ <PLATFORM>/twistcli console export openshift \ --persistent-volume-labels "app-volume=twistlock-console" \ --image-name "docker-registry.default.svc:5000/twistlock/private:console_<VERSION>" \ --service-type "ClusterIP"
    For other command variations, see the OpenShift install guide.
  5. Update the Twistlock objects.
    $ oc apply -f twistlock_console.yaml
    You can now upgrade your Defender DaemonSet.

Upgrade Defender DaemonSets with twistcli

Delete the Defender DaemonSet, then rerun the original install procedure.
Prerequisites:
You know all the parameters passed to
twistcli
when you initially deployed the Defender DaemonSet. You’ll need them to recreate a working configuration file for your environment.
  1. Delete the Defender DaemonSet.
    $ oc -n twistlock delete ds twistlock-defender-ds $ oc -n twistlock delete sa twistlock-service $ oc -n twistlock delete secret twistlock-secrets
  2. Determine the Console service’s external IP address.
    $ oc get service -o wide -n twistlock
  3. Generate a
    defender.yaml
    file. Pass the same options to
    twistcli
    as you did in the original install. The following example command generates a YAML configuration file for the default install.
    The following command connects to Console’s API (specified in
    --address
    ) as user <ADMIN> (specified in
    --user
    ), and retrieves a Defender DaemonSet YAML config file according to the configuration options passed to
    twistcli
    . In this command, there is just a single mandatory configuration option. The
    --cluster_address
    option specifies the address Defender uses to connect to Console, and the value is encoded in the DaemonSet YAML file.
    $ <PLATFORM>/twistcli defender export openshift \ --address https://yourconsole.example.com:8083 \ --user <ADMIN_USER> \ --cluster-address twistlock-console \ --selinux-enabled
    • <PLATFORM> can be linux or osx.
    • <ADMIN_USER> is the name of an admin user.
  4. Deploy the Defender DaemonSet.
    $ oc create -f defender.yaml
  5. In Prisma Cloud, go to
    Manage > Defenders > Manage > DaemonSets
    to see a list of deployed Defenders.

Upgrade Defender DaemonSets from Console

Upgrade the DaemonSet Defenders directly from the Console UI.
If you can’t access your cluster with oc, then you can upgrade Defender DaemonSets directly from the Console UI.
Prerequisites:
You’ve created a kubeconfig credential for your cluster so that Prisma Cloud can access it to upgrade the Defender DaemonSet.
  1. Log into Prisma Cloud Console.
  2. Go to
    Manage > Defenders > Manage
    .
  3. Click
    DaemonSets
    .
  4. For each cluster in the table, click
    Actions > Upgrade
    .
    The table shows a count of deployed Defenders and their new version number.

Recommended For You