Prepare a Kubernetes Cluster

To determine whether your existing Kubernetes cluster meets the requirements for use with Tenable Enclave Security, see Tenable Enclave Security System Requirements.

Before you begin

Configure a routable URL or external gateway.
Determine whether to create a new Kubernetes or use an existing cluster.

Configure a Kubernetes cluster

Create a new Kubernetes cluster. For instructions on how to create a new cluster, see the Kubernetes documentation.

-or-

Use an existing cluster. To determine whether your existing cluster meets the requirements for your Tenable Enclave Security deployment, see Tenable Enclave Security System Requirements.
Install Traefik Custom Resource Definitions (CRDs). Tenable Enclave Security version 1.9 requires Traefik CRDs on your Kubernetes cluster before you deploy the software.

Note: This step is a one-time, cluster-wide procedure. If the Traefik CRDs are already installed on your cluster, skip this section.
1. Check whether the Traefik CRDs are already installed on your cluster:
  Copy
```
kubectl get crd ingressroutes.traefik.io
```
2. If the cluster does not contain the CRDs, run the following command to install them:
  Copy
```
kubectl apply -f https://raw.githubusercontent.com/traefik/traefik/v3.6/docs/content/reference/dynamic-configuration/kubernetes-crd-definition-v1.yml
```
3. Run the following command to verify the installation:
  Copy
```
kubectl get crd | grep traefik
```
  The system lists the following CRDs if the installation is successful:
  - ingressroutes.traefik.io
  - ingressroutetcps.traefik.io
  - middlewares.traefik.io
  - serverstransports.traefik.io
  - tlsoptions.traefik.io
Define a default storage class on the cluster. For instructions on how to change the default storage class, see the Kubernetes documentation.
Install cert-manager in your Kubernetes cluster. For instructions on how to install cert-manager, see the cert-manager documentation.

Note: if you want to use your own certificates, contact your Tenable Support representative.
Install cert-manager-csi-installer in your Kubernetes cluster.

Note: Tenable Enclave Security recommends using the cert-manager CSI driver for provisioning certificates used by its services for mTLS. However, if the CSI driver cannot be installed on your cluster, you can disable the cert-manager CSI driver.
Configure the Container Security database. This database contains the data visible in the Container Security UI, including vulnerabilities, images, packages, and layers.

Tenable recommends you use a managed PostgreSQL database service (for example, RDS, AWS, or GCP). If you want to host the database yourself, see the Kubegres documentation.
PostgreSQL compatible versions
- PostgreSQL 14.x
- PostgreSQL 15.x
- PostgreSQL 16.x (preferred)
- PostgreSQL 17.x
Create a Kubernetes secret named tes-pg-secrets to identify characteristics about the database.

Note: The namespace referenced in this step is created during the Install Tenable Enclave Security procedure. If you did not create the namespace, you can create it now by running the kubectl create namespace <namespace> command, or you can return to this step after you complete the namespace creation in the installation procedure.
Copy
```
kubectl apply --namespace tenable-enclave-security -f tes-pg-secrets.yaml
```
Note: Supported SSL modes include prefer, require, and verify-ca. The default SSL mode for Tenable Enclave Security services is prefer.

The following is an example tes-pg-secrets.yaml:
Copy
```
apiVersion: v1
kind: Secret
type: Opaque
metadata:
  name: tes-pg-secrets
data:
  # All values below must be base64 encoded strings
  pg_host: # Hostname and optional port (e.g., db.example.com or db.example.com:5432)
  pg_user: # Admin username (must have CREATEDB and CREATEROLE permissions)
  pg_pass: # Password for the pg_user
  pg_ro_host: # Hostname for read-only replica (defaults to pg_host if not applicable)
  pg_ssl_mode: # Optional: SSL level. Use 'prefer' (default), 'require', or 'verify-ca'
  pg_ca_cert: # Required if pg_ssl_mode=verify-ca. The CA certificate content.
```
Note: To encode pg_ssl_mode correctly on Linux or macOS, use: echo -n "verify-ca" | base64 If you omit the -n flag, the encoded string will include a hidden "newline" character, which will cause the database driver to reject the SSL mode.