Your suggested change has been received. Thank you.

close
Thales Logo

All

  • All
  • CipherTrust Manager
  • CipherTrust Application Data Protection (CADP)
  • CipherTrust Application Key Management (CAKM)
  • CipherTrust Batch Data Transformation (BDT)
  • CipherTrust Cloud Key Management (CCKM)
  • CipherTrust Data Discovery and Classification (DDC)
  • CipherTrust Data Protection Gateway (DPG)
  • CipherTrust Database Protection (CDP)
  • CipherTrust Intelligent Protection (CIP)
  • CipherTrust Integrations
  • CipherTrust Migrations
  • CipherTrust RESTful Data Protection (CRDP)
  • CipherTrust Transparent Encryption (CTE)
  • CipherTrust Transparent Encryption Userspace (CTE-U)
  • CipherTrust Secrets Management (CSM)
  • CipherTrust Vaulted Tokenization (CT-V)
  • CipherTrust Vaultless Tokenization (CT-VL)
  • CTE-Linux
  • CTE-Windows
  • CTE-AIX
  • CTE-K8s
  • CTE-U
  • Crypto Command Center
  • Data Protection on Demand
  • Luna Cloud HSM
  • Luna Network HSM
  • Luna PCIe HSM
  • Luna USB HSM
  • OneWelcome Identity Platform
  • ProtectApp LUKS
  • ProtectServer 2 HSM
  • ProtectServer 3 HSM
  • SafeNet Trusted Access (STA)
  • SafeNet MobilePASS+
  • SafeNet MobilePASS+ for Android
  • SafeNet MobilePASS+ for Chrome
  • SafeNet MobilePASS+ for macOS
  • SafeNet MobilePASS+ for iOS
  • SafeNet MobilePASS+ for WatchOS
  • SafeNet MobilePASS+ for Windows
  • SafeNet Synchronization Agent
  • SafeNet Logging Agent
  • SafeNet Agent for FreeRADIUS
  • SafeNet Agent for NPS
  • SafeNet Agent for Windows Logon
  • SafeNet Authentication Service Private Cloud Edition (SAS PCE)
  • SafeNet Remote Logging Agent
  • SafeNet Keycloak Agent
  • SafeNet IDPrime Virtual (IDPV)
  • SafeNet FIDO Key Manager
  • SafeNet FIDO Key Manager for Android
  • SafeNet FIDO Key Manager for iOS
  • SafeNet FIDO Key Manager for Windows
back

Installing Crypto Command Center

Installing CCC using Kubernetes

search
printsuggest an edit

Installing CCC using Kubernetes

The steps involved in installing CCC using Kubernetes are as follows:

1Log on to both the Linux machines that you intend to use for CCC installation.

note

Note

There should be full network connectivity between these machines. During installation, you will be using one of the machines as the Master node and the other one as the Worker node. Depending on your requirements, you can have more than one Master node and Worker node.

2Set up Kubernetes Cluster on the Master node as well as the Worker node, using the steps explained here. Kubernetes enables you to install CCC and all its dependencies in a cluster of containers that run on virtualized host OS.

3Set up and initialize a Luna HSM partition. This partition will be used to create a CCC root of trust (ROT). You'll be required to provide the partition-related details while modifying the configuration settings in a later step.

note

Note

In case you want to use an HA ROT, you need to set up and initialize two partitions that have the same domain. You'll be required to provide the details related to these partitions while modifying the configuration settings in a later step.

4Download and extract the CCC package on the Master node as well as the Worker node.

5Extract the Crypto Command Center package inside your home directory.

6Create a directory named ccc-certs on all the Worker nodes: 

mkdir -p /home/ccc/ccc-certs

7Copy the CCC license file and paste it inside the ccc-certs directory under the CCC package.

note

Note

You have the option to upload the license file later, after logging in to CCC. You can do so by accessing the Administration tab from the menu bar at the top, followed by selecting the Licenses option from the navigation pane on the left, and then clicking the Upload button.

note

Note

If you are using a CA-signed certificate:
a. Create a PKCS#12 or JKS certificate.
b. Copy the certificate and paste it inside the ccc-certs directory.
c. Provide the following CA-signed certificate related details while updating the environment file in a later step:
- CA_CERTIFICATE
- CA_CERTIFICATE_FILE_NAME
- CA_CERTIFICATE_PASSWORD
- CA_CERTIFICATE_ALIAS

8Optional Step: To configure a CA-signed certificate for Luna Network HSM in the ccc_config.env file, begin by copying the CA-signed certificate into the ccc-certs folder. Next, open the ccc_config.env file and set the flag to enable the use of the CA-signed certificate by adding the line HSM_IP1_CA_CERT_ENABLE=Y. You will also need to specify the name of the certificate file, ensuring it matches the name of the file in the ccc-certs folder, for example, HSM_IP1_CA_CERT_NAME=rootca_12.pem. For environments with High Availability setups, repeat this process for the second HSM by adding the IP address and CA-signed certificate configuration. Set HSM_IP2_CA_CERT_ENABLE=Y and specify the certificate name with HSM_IP2_CA_CERT_NAME=<certificate_name>, ensuring the certificate name matches the file name in the ccc-certs folder.

9Optional Step: If you prefer to use a signed and verified image of CCC for enhanced security and reliability, follow the procedure described on the page Using a Signed and Verified CCC Container Image. Once you have completed the procedure, return to this page to continue with the CCC installation, following steps 11 through 21.

note

Note

This step is optional and provides an additional layer of security for your CCC installation. If you choose not to follow this procedure, you can continue with the CCC installation as outlined in steps 9 through 21.

10Optional Step: Configure the scheduler

11Check your container runtime environment on the Worker node by executing the following command:

crictl config --get image-endpoint

12Navigate to the Crypto Command Center package on your Worker node and select one of the following methods to import the CCC image, based on the output of the previous step:


Method 1 (for containered): If the output you received was unix:///run/containerd/containerd.sock, it indicates that your Worker node is using containerd as the container runtime. In this case, you can import the CCC images by using the following command: 

ctr -n=k8s.io images import ccc-4.3.0.tar

Method 2 (for CRI-O): If the output you received was unix:///var/run/crio/crio.sock, it indicates that your Worker node is using CRI-O as the container runtime. To import the images in this case, you'll first need to install Podman on your Worker node and then execute the following command:

podman load -i ccc-4.3.0.tar

After successfully importing the images using Method 2, open the CCC package on your Master node and access the kubernetes directory. Within the kubernetes directory, open the deployment.yaml file, navigate to the section that defines containers, and update the image value from ccc:4.3.0 to localhost/ccc:4.3.0. This action ensures that your Kubernetes deployment uses the desired image.

13Run the following command on the Worker node to list all the images: 

crictl images

14Go the the ccc directory in the Master node and open the kubernetes directory.

15Create secrets by running the following command: 

kubectl create secret generic ccc-password \
--from-literal=CCC_TRUSTSTORE_PASSWORD='password' \
--from-literal=CCC_KEYSTORE_PASSWORD='password' \
--from-literal=CCC_CREDENTIALSTORE_PASSWORD='password' \
--from-literal=HSM_PASSWORD1='password' \
--from-literal=CRYPTO_OFFICER_PASSWORD='password' \
--from-literal=HSM_PASSWORD2='password' \
--from-literal=CCC_ADMIN_PASSWORD='password' \
--from-literal=CA_CERTIFICATE_PASSWORD='password' \
--from-literal=CCC_DB_PASSWORD='password'
note

Note

Ensure that all passwords comply with the specified password policy rules.

16Update the CCC image name in the deployment.yaml file located in the kubernetes directory by replacing the current image name with docker.io/thalesdiscpl/ccc:4.3.0 using the vi editor.

17Modify the configuration settings on the Master node as per your requirements: 

vi config-map.yaml
note

Note

When updating a key's value, remember to separate the key and value with a colon (:) and include a space. For example, use key: value instead of key:value.

note

Note

If you want to use an external database, you need to provide the required details while modifying the configuration settings.

note

Note

If you want to use an HA ROT, you need to follow the cloning protocol and ensure that:
(i) ROT_HA_ENABLE is set to Y
(ii) IP address for the second device is specified under HSM_IP2
(iii) Password for the second device is specified under HSM_PASSWORD2
(iv) Both the partitions have the same PARTITION_LABEL
(v) Both the partitions have the same CRYPTO_OFFICER_PASSWORD
(vi) Both the partitions have the same domain
(vi) Partition on the second device is specified under PARTITION_NAME2
(vii) REMEMBER_CREDENTIAL is set to Y

note

Note

Ensure that you've specified the name of the CCC license file under CCC_LICENSE_FILE_NAME.

note

Note

If you have mapped HSM_IP1 or HSM_IP2 with the hostname/DNS, then in the deployment.yaml file, please update the hostAliases section with the corresponding hostname/DNS, making sure to use lowercase letters for the hostname:
hostAliases:
- ip: "IP address of HSM1"
hostnames:
- "hostname/DNS of HSM1"
- ip: "IP address of HSM2"
hostnames:
- "hostname/DNS of HSM2"

18Edit the deployment.yaml file on the Master node if you are using LDAPS:

vi deployment.yaml
note

Note

If you use LDAPS, refer to the steps for configuring LDAPS for CCC on the Installing CCC page.

19Launch CCC:

sh start-ccc-server.sh

20Check whether CCC installation is successful by verifying the output of the following command: 

sudo kubectl get all -o wide

21Launch CCC on the master node using one of the following URLs, based on whether the machine is identified by its IP address or hostname:


22Log on to CCC as an admin user. If you are logging in for the first time, use the following credentials:


  • Username: admin

  • Password: PASSWORD

23Change the password. You can now start exploring various functions and features of CCC.


note

Note

If the Administrator requires that you use two-factor authentication, you are prompted to configure a one-time password (OTP). Using a two-factor authentication application on a mobile device, scan the displayed QR code or manually type in the displayed secret key, excluding spaces. Add your account. A 6-digit OTP code is generated. Enter this code in the login page, excluding spaces. You are prompted to change the password in case you are a local user.

note

Note

If the CCC Administrator edits the credentials of a user that has two-factor authentication enabled, the user needs to re-enroll in the two-factor authentication process.

note

Note

The clock for your two-factor authentication application must be synchronized within 2 seconds of the clock for CCC. Otherwise the OTP code will be rejected due to a validation error.

note

Note

If you want to use HA configuration, you need to use an external database.

note

Note

If you want to use HA configuration, run the following command to specify the number of replicas:
kubectl scale --replicas=2 deployment ccc-deployment

On this page