Create an OpenShift project for Prisma Cloud

Login to the OpenShift cluster and create the twistlock project:

$ oc new-project twistlock

(Optional) Push the Prisma Cloud images to a private registry

Determine the endpoint for your OpenShift internal registry. Use either the internal registry’s service name or cluster IP.

$ oc get svc -n default
NAME               TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)       AGE
docker-registry    ClusterIP   172.30.163.181   <none>        5000/TCP      88d

Pull the images from the Prisma Cloud cloud registry using your access token. The major, minor, and patch numerals in the <VERSION> string are separated with an underscore. For exampe, 18.11.128 would be 18_11_128.

  $ docker pull \
    registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/defender:defender_<VERSION>

  $ docker pull \
    registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/console:console_<VERSION>

Tag the images for the OpenShift internal registry.

$ docker tag \
  registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/defender:defender_<VERSION> \
  172.30.163.181:5000/twistlock/private:defender_<VERSION>

$ docker tag \
  registry-auth.twistlock.com/tw_<ACCESS_TOKEN>/twistlock/console:console_<VERSION> \
  172.30.163.181:5000/twistlock/private:console_<VERSION>

Push the images to the twistlock project’s imageStream.

$ docker push 172.30.163.181:5000/twistlock/private:defender_<VERSION>
$ docker push 172.30.163.181:5000/twistlock/private:console_<VERSION>

Install Console

Generate a deployment YAML file for Console. A number of command variations are provided. Use them as a basis for constructing your own working command.
Prisma Cloud Console + dynamically provisioned PersistentVolume + image pulled from the OpenShift internal registry.
$ <PLATFORM>/twistcli console export openshift \
  --storage-class "<STORAGE-CLASS-NAME>" \
  --image-name "172.30.163.181:5000/twistlock/private:console_<VERSION>" \
  --service-type "ClusterIP"
Prisma Cloud Console + manually provisioned PersistentVolume + image pulled from the OpenShift internal registry.
Using the NFS backed PersistentVolume described in Appendix: NFS PersistentVolume example, pass the label to the --persistent-volume-labels flag to specify the PersistentVolume to which the PersistentVolumeClaim will bind.
$ <PLATFORM>/twistcli console export openshift \
  --persistent-volume-labels "app-volume=twistlock-console" \
  --image-name "172.30.163.181:5000/twistlock/private:console_<VERSION>" \
  --service-type "ClusterIP"
Prisma Cloud Console + manually provisioned PersistentVolume + image pulled from the Prisma Cloud cloud registry.
If you omit the --image-name flag, the Prisma Cloud cloud registry is used by default, and you are prompted for your access token.
$ <PLATFORM>/twistcli console export openshift \
  --persistent-volume-labels "app-volume=twistlock-console" \
  --service-type "ClusterIP"
Deploy Console.
$ oc create -f ./twistlock_console.yaml
You can safely ignore the error that says the twistlock project already exists.

Create an external route to Console

From the OpenShift web interface, go to the twistlock project.
Go to
Application > Routes
.
Select
Create Route
.
Enter a name for the route, such as
twistlock-console
.
Hostname = URL used to access the Console, e.g. twistlock-console.apps.ose.example.com
Path =
/
Service =
twistlock-console
Target Port = 8083 → 8083
Select the
Security > Secure Route
radio button.
TLS Termination = Passthrough (if using 8083)
If you plan to issue a custom certificate for the Prisma Cloud Console that is trusted and will allow the TLS establishment with the Prisma Cloud Console, then Select Passthrough TLS for TCP port 8083.
Insecure Traffic =
Redirect
Click
Create
.

Configure Console

In a web browser, navigate to the external route you configured for Console, e.g. https://twistlock-console.apps.ose.example.com.

Create your first admin account.

Enter your license key.

Add a SubjectAlternativeName to Console’s certificate to allow Defenders to establish a secure connection with Console.

Use either Console’s service name, twistlock-console or twistlock-console.twistlock.svc, or Console’s cluster IP.

$ oc get svc -n twistlock
NAME                TYPE           CLUSTER-IP     EXTERNAL-IP                 PORT(S)
twistlock-console   LoadBalancer   172.30.41.62   172.29.61.32,172.29.61.32   8084:3184...

Go to

Manage > Defenders > Names

.

Click

Add SAN

and enter Console’s service name.

Click

Add SAN

and enter Console’s cluster IP.

Install Defender

$ <PLATFORM>/twistcli defender export openshift \
  --address <ADDRESS>
  --cluster-address <CLUSTER-ADDRESS>

Generate the Defender DaemonSet YAML. A number of command variations are provided. Use them as a basis for constructing your own working command.
Outside the OpenShift cluster + pull the Defender image from the Prisma Cloud cloud registry.
Use the OpenShift external route for your Prisma Cloud Console, --address https://twistlock-console.apps.ose.example.com. Designate Prisma Cloud’s cloud registry by omitting the --image-name flag.
$ <PLATFORM>/twistcli defender export openshift \
  --address https://twistlock-console.apps.ose.example.com \
  --cluster-address 172.30.41.62 \
  --selinux-enabled
Outside the OpenShift cluster + pull the Defender image from the OpenShift internal registry.
Use the --image-name flag to designate an image from the OpenShift internal registry.
$ <PLATFORM>/twistcli defender export openshift \
  --address https://twistlock-console.apps.ose.example.com \
  --cluster-address 172.30.41.62 \
  --selinux-enabled \
  --image-name 172.30.163.181:5000/twistlock/private:defender_<VERSION>
Inside the OpenShift cluster + pull the Defender image from the Prisma Cloud cloud registry.
When generating the Defender DaemonSet YAML with twistcli from a node inside the cluster, use Console’s service name (twistlock-console) or cluster IP in the --cluster-address flag. This flag specifies the endpoint for the Prisma Cloud Compute API and must include the port number.
$ <PLATFORM>/twistcli defender export openshift \
  --address https://172.30.41.62:8083 \
  --cluster-address 172.30.41.62 \
  --selinux-enabled
Inside the OpenShift cluster + pull the Defender image from the OpenShift internal registry.
Use the --image-name flag to designate an image in the OpenShift internal registry.
$ <PLATFORM>/twistcli defender export openshift \
  --address https://172.30.41.62:8083 \
  --cluster-address 172.30.41.62 \
  --selinux-enabled \
  --image-name 172.30.163.181:5000/twistlock/private:defender_<VERSION>
Deploy the Defender DaemonSet.
$ oc create -f ./defender.yaml
Confirm the Defenders were deployed.
In Prisma Cloud Console, go to
Manage > Defenders > Manage
to see a list of deployed Defenders.

In the OpenShift Web Console, go to the Prisma Cloud project’s monitoring window to see which pods are running.

Using the OpenShift CLI to see the DaemonSet pod count.
$ oc get ds -n twistlock
NAME                    DESIRED   CURRENT   READY     UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
twistlock-defender-ds   4         3         3         3            3           <none>          29m
The desired and current pod counts do not match. This is a job for the nodeSelector.

OpenShift 4

Error: unable to recognize "": no matches for kind "SecurityContextConstraints" in version "v1"

Generate a Console Helm chart.

$ <PLATFORM>/twistcli console export kubernetes \
  --service-type LoadBalancer \
  --helm

Unpack the chart into a temporary directory.

$ mkdir helm
$ tar xvzf twistlock-console-helm.tar.gz -C helm/

Open helm/twistlock-console/templates/securitycontextconstraints.yaml for editing.

Change apiVersion from v1 to security.openshift.io/v1.

{{- if .Values.openshift }}
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: twistlock-console
...

Repack the Helm chart, and install it in your OpenShift 4 cluster.

$ cd helm/
$ tar cvzf twistlock-console-helm.tar.gz twistlock-console/

Uninstall

Delete the twistlock Project

$ oc delete project twistlock

Delete the twistlock PersistentVolume

$ oc delete pv twistlock

Appendix: NFS PersistentVolume example

mkdir /opt/twistlock_console

Check selinux:

sestatus

chcon -R -t svirt_sandbox_file_t -l s0 /opt/twistlock_console

sudo chown nfsnobody /opt/twistlock_console

sudo chgrp nfsnobody /opt/twistlock_console

Check perms with:

ls -lZ /opt/twistlock_console

(drwxr-xr-x. nfsnobody nfsnobody system_u:object_r:svirt_sandbox_file_t:s0)

Create

/etc/exports.d/twistlock.exports

In the

/etc/exports.d/twistlock.exports

add in line

/opt/twistlock_console *(rw,root_squash)

Restart nfs mount

sudo exportfs -ra

Confirm with

showmount -e

Get the IP address of the Master node that will be used in the PV (eth0, openshift uses 172. for node to node communication). Make sure TCP 2049 (NFS) is allowed between nodes.

Create a PersistentVolume for Prisma Cloud Console.

The following example uses a label for the PersistentVolume and the volume and claim pre-binding features. The PersistentVolumeClaim uses the app-volume: twistlock-console label to bind to the PV. The volume and claim pre-binding claimref ensures that the PersistentVolume is not claimed by another PersistentVolumeClaim before Prisma Cloud Console is deployed.

apiVersion: v1
kind: PersistentVolume
metadata:
 name: twistlock
 labels:
  app-volume: twistlock-console
storageClassName: standard
spec:
  capacity:
   storage: 100Gi
  accessModes:
  - ReadWriteOnce
  nfs:
   path: /opt/twistlock_console
   server: 172.31.4.59
persistentVolumeReclaimPolicy: Retain
claimRef:
  name: twistlock-console
  namespace: twistlock

Appendix: Implementing SAML federation with a Prisma Cloud Console inside an OpenShift cluster

Log into Prisma Cloud Console.
Go to
Manage > Authentication > SAML
.
In
Console URL
, define the AssertionConsumerServiceURL.
In this example, enter https://twistlock-console.apps.ose.example.com