ROXbox Add-on

ROXbox installs upstream StackRox on an existing SNObox OpenShift or OKD cluster. SNObox owns cluster lifecycle and state; this add-on layers StackRox resources on top through the same inventory model.

The intended workflow starts from the SNObox repository root:

tools/boxctl install roxbox
tools/boxctl run roxbox --limit <host>

boxctl install clones the public add-on repository into SNObox's ignored local add-on area and copies the inventory overlay:

snobox/
└── addons/
    └── roxbox/
        ├── repo/       # git clone of git@github.com:o1e/roxbox_addon.git
        └── inventory/  # local overlay copied from the add-on template

The add-on is EE-first. It is expected to run through the same ansible-navigator / Ansible Execution Environment workflow used by SNObox, so OpenShift, Kubernetes, Helm and libvirt-related tooling live in the EE instead of being installed ad hoc on the controller.

What It Installs

ROXbox intentionally does not install the Red Hat ACS OperatorHub subscription. It uses the upstream community stackrox-operator Helm chart from the StackRox Helm repository.

The add-on owns:

• upstream StackRox operator Helm release
• StackRox operator namespace
• stackrox namespace
• StackRox Central admin secret
• StackRox Central custom resource
• optional StackRox SecuredCluster custom resource
• optional declarative OpenShift OAuth configuration
• optional StackRox Compliance report schedule

SNObox owns:

• VM lifecycle
• OpenShift / OKD installation
• OpenShift users, certificates, OperatorHub policy and LVMS setup
• generated kubeconfig and state directories

Prerequisites

• A completed SNObox OCP or OKD cluster
• The SNObox Ansible Execution Environment
• Access to the SNObox kubeconfig at {{ sno_workdirs.ocp }}/auth/kubeconfig
• A default or explicitly configured storage class for StackRox Central DB

Inventory Contract

The playbook targets the existing SNObox inventory group:

hosts: snobox

It consumes these SNObox variables:

• sno_box
• sno_dns
• sno_workdirs
• sno_tls
• sno_lvms

StackRox-specific configuration is provided through the add-on inventory overlay. The add-on keeps the internal role and variable prefix roxbox_.

inventory/
├── inventory.yml
└── group_vars/
    └── snobox/
        ├── roxbox.yml
        ├── roxbox_central.yml
        └── roxbox_secured_cluster.yml

Base defaults are in inventory/group_vars/snobox/roxbox.yml:

roxbox_defaults:
  admin_password: ChangeMe
  operator:
    namespace: stackrox-operator-system
    chart: stackrox/stackrox-operator
    chart_version: ""
  oauth:
    enabled: true
  compliance_reports:
    enabled: true
    profiles:
      - ocp4-bsi
      - ocp4-bsi-node
      - ocp4-cis
      - ocp4-cis-node
    schedule:
      interval_type: DAILY
      hour: 6
      minute: 0

Host overrides use roxbox_overrides in the SNObox checkout:

addons/roxbox/inventory/host_vars/<host>/roxbox.yml

Start from the example overlay when a host needs overrides:

mkdir -p addons/roxbox/inventory/host_vars/<host>
cp addons/roxbox/repo/inventory/host_vars/snobox1_example/roxbox.yml \
  addons/roxbox/inventory/host_vars/<host>/roxbox.yml

Example:

roxbox_overrides:
  central_db_storage_class: lvms-vg-lvms
  stackrox:
    kube_cli: oc

Enable the Compliance report schedule after StackRox has synced the requested profiles. The add-on installs the OpenShift Compliance Operator automatically when compliance reports are enabled:

roxbox_overrides:
  compliance_reports:
    enabled: true

Pin the upstream operator chart by setting chart_version:

roxbox_overrides:
  operator:
    chart_version: 74.11.0

StackRox 4.10 is intentionally not supported by this add-on. Leave chart_version empty to consume the latest upstream community chart.

Central and SecuredCluster resource overrides follow the same pattern:

roxbox_central_overrides:
  spec:
    scannerV4:
      indexer:
        scaling:
          maxReplicas: 2

roxbox_secured_cluster_overrides:
  spec:
    sensor:
      resources:
        requests:
          memory: 200Mi

Direct Ansible Run

boxctl is preferred. The equivalent direct command from the SNObox repository root is:

ANSIBLE_ROLES_PATH="addons/roxbox/repo/roles:${ANSIBLE_ROLES_PATH:-roles}" \
ansible-navigator run addons/roxbox/repo/playbooks/site.yml \
  -i inventory/inventory.yml \
  -i addons/roxbox/inventory \
  --limit <host>

Cleanup

For cleanup from the SNObox repository root:

addons/roxbox/repo/tools/delete-stackrox.sh

The script auto-discovers ./state/*/ocp/auth/kubeconfig when exactly one SNObox kubeconfig exists. Override explicitly when needed:

KUBECONFIG=./state/<cluster>/ocp/auth/kubeconfig \
  addons/roxbox/repo/tools/delete-stackrox.sh

Tags

• roxbox
• roxbox_validate
• roxbox_operator
• roxbox_cert
• roxbox_central
• roxbox_secured
• roxbox_oauth
• roxbox_compliance_operator
• roxbox_compliance_reports

Validation

Run checks through the configured Ansible Execution Environment:

make lint

For local development outside snobox/addons/roxbox/repo, point make at the SNObox checkout:

make lint SNOBOX_ROOT=/path/to/snobox