Before you begin, you must download the latest custom BlueCat Gateway image that contains the Cloud Discovery & Visibility (CDV) workflow.
Prerequisites:
You must have at least 2 CPUs and 8GB of RAM allocated to the host machine that will be running the BlueCat Gateway instance.
You must have Docker installed on the host machine that will be running the BlueCat Gateway instance. For more information, refer to the 'Requirements' section of the BlueCat Gateway Installation Guide.
You must have an Address Manager server configured with the BlueCatGateway UDF and a BlueCat Gateway user. For more information, refer to the 'Configuring BlueCat Gateway' section of the BlueCat Gateway Installation Guide.
You must have purchased the Cloud Discovery & Visibility Adaptive Application from BlueCat.
You must have a Quay account that has been granted read access to the Cloud Discovery & Visibility private repository.
For more information on setting up your Quay account, refer to the information that was provided when you purchased the Cloud Discovery & Visibility Adaptive Application from BlueCat.
You must have a Docker CLI password.
You can create one by clicking Generate Encrypted Password under Docker CLI Password on the Account Settings page in Quay.
Defining the workspace and log directories
When you first install the Cloud Discovery & Visibility Adaptive Application, BlueCat recommends setting up your workspace and logs directory right away:
Define a workspace:
A workspace is the logical location for workflows and associated data, including configurations, libraries, requirements, permissions, and customizations. A workspace can be a Docker volume (recommended), or a volume on your local machine. For more details, see the Workspace section in the BlueCat Gateway Administration Guide.
Define a logs directory:
A logs directory can be a Docker volume (recommended), or a volume on your local machine
Why map to Docker volumes? Volumes are completely managed by Docker, so you typically do not need to set permissions manually when using Docker volumes. This is also the recommended practice for Docker containers.
If you prefer to mount data and log volumes to your local machine, you must
manually set rwx (read, write, execute) permissions to those
directories before running the container.
chmod -R o=rwx <mapped volume>If you do not map data or log volumes to your local machine during installation, the Cloud Discovery & Visibility Adaptive Application will write all the data to the container by default. If you then stop or restart the container, all this data will be lost.
You can name the workspace and logs directory to anything.
The Cloud Discovery & Visibility Adaptive Application saves configuration and workflow data to the workspace, and all execution and session logs to the mapped logs directory. If you do not map a workspace or a logs directory, all the configuration and logging data is written to the container by default.
Minimum Docker permissions
The following are the minimum Docker privileges required for CDV to work:
CHOWN |
Can make arbitrary changes to file UIDs and GIDs. |
DAC_OVERRIDE |
DAC is short for "Discretionary Access Control". Can bypass kernel permission checks on file, write, and execute operations. |
FOWNER |
Can bypass permission checks that normally require file system UIDs to match the file UID (except for operations covered by DAC_OVERRIDE and DAC_READ_SEARCH). |
SETUID |
Can arbitrarily manipulate process GIDs, such as writing a group ID mapping in a namespace. |
SETGID |
Can arbitrarily manipulate process UIDs, such as writing a user ID mapping in a namespace. |
If you want to restrict CDV's privileges to the bare minimum, you can use the
cap-drop and cap-add attributes when
installing the image. First remove all privileges with cap-drop,
then add the minimum priviliges with cap-add:
docker run -d \
...
--cap-drop ALL \
--cap-add CHOWN \
--cap-add DAC_OVERRIDE \
--cap-add FOWNER \
--cap-add SETUID \
--cap-add SETGID \
...
quay.io/bluecat/cloud_discovery_visibility:23.3.2 Installing the CDV docker image
From the host machine, run the following command:
docker login quay.ioAt the prompt, enter your Quay user name and password obtained when generating the encrypted password.
Download the Cloud Discovery & Visibility Adaptive Application from Quay using the following command:
docker pull quay.io/bluecat/cloud_discovery_visibility:23.3.2Start the custom Gateway image using the following command:
docker run -d \ -p 80:8000 \ -p 443:44300 \ -v <path_to_mapped_log_directory>:/logs/ \ -v <path_to_mapped_data_directory>:/data/ \ -e BAM_IP=<your_bam_ip_address> \ --name <gateway_container_name> \ quay.io/bluecat/cloud_discovery_visibility:23.3.2If you are configuring the image with a proxy, start the custom Gateway image using the following command:
If you are using Cloud Discovery & Visibility with custom certificates, you must store the certificate files locally within adocker run -d \ -p 80:8000 \ -p 443:44300 \ -v <path_to_mapped_log_directory>:/logs/ \ -v <path_to_mapped_data_directory>:/data/ \ -e BAM_IP=<your_bam_ip_address> \ --env HTTP_PROXY=<your_proxy_address> \ --env HTTPS_PROXY=<your_proxy_address> \ --name <gateway_container_name> \ quay.io/bluecat/cloud_discovery_visibility:23.3.2<local_directory>/certificates/serverfolder and map that location to the/bluecat_gateway/certificates/serverdirectory of the container to ensure that the certificates persist with the Cloud Discovery & Visibility container. You can define custom certificates to be used with the container using the following command:docker run -d \ -p 80:8000 \ -p 443:44300 \ -v <path_to_mapped_log_directory>:/logs/ \ -v <path_to_mapped_data_directory>:/data/ \ -v <local_directory>/certificates/server:/bluecat_gateway/certificates/server/ \ -e BAM_IP=<your_bam_ip_address> \ --name <gateway_container_name> \ quay.io/bluecat/cloud_discovery_visibility:23.3.2Attention:Your proxy configuration must allow access to the following sites as applicable:
AWS
.amazonaws.com
GCP
.googleapis.comwww.gstatic.com
Azure
.microsoftonline.com.azure.com.microsoft.com.servicebus.windows.net