RapidFort GCP Deployment

Deploy the RapidFort platform in GCP.


RapidFort runs on Kubernetes and can be deployed via the RapidFort Helm Chart. It's important that GCP is properly configured with the correct permissions, network requirements, and underlying tooling before deploying RapidFort via the Helm Chart.
This is described in more detail below, but the main steps before deploying RapidFort are:
  1. 1.
    Create a GCP Service Account with the correct permissions to a GCP Cloud Storage bucket
  2. 2.
    Create a GCP Compute Engine VM that can be accessed over HTTPS and SSH
  3. 3.
    Install the required tooling on the GCP Compute Engine VM
RapidFort GCP Architecture


Compute Requirements

  1. 1.
    Minimum Requirements of machine type n2-standard-8
    • 8 vCPU
    • 16 GB Memory
    • 2 TB Storage
  2. 2.
    Operating System Options
    • RapidFort has validated the following operating systems:
      • Ubuntu 20.04.3 (focal)
      • Debian 11 (bullseye)
    • Please contact RapidFort Support before using a different operating system

Storage Permission Requirements

  • Google Cloud Service Account with Read-Write-Delete Permissions for the Storage Bucket
    • storage.buckets.get
    • storage.multipartUploads.abort
    • storage.multipartUploads.create
    • storage.multipartUploads.listParts
    • storage.objects.create
    • storage.objects.delete
    • storage.objects.get
    • storage.objects.list

Network Requirements


  1. 1.
    Networking and Security Policies allow HTTPS ingress to the RapidFort platform VM over port 443 from
    • end-user desktop browsers
    • environments in which container images are deployed and tested
      • IMPORTANT: RapidFort CLI must be able to reach the RapidFort platform as containers are instrumented and hardened
  2. 2.
    Networking and Security Policies allow SSH access to the RapidFort administrator.


The RapidFort VM must have HTTPS egress to the RapidFort Vulnerability Database and so must the Kubernetes pods deployed within the RapidFort deployment.

Private DNS Consideration

It may be Company Policy to block public DNS (e.g. and have a private GCP DNS instance instead. This should be determined ahead of time so the RapidFort deployment is configured accordingly.
- Check if the public DNS accessible
- Check /etc/resolv.conf for DNS
sudo cat /etc/resolv.conf

GCP Setup

Cloud Storage Creation

Step 1 : Create a Google Cloud Storage Bucket for RapidFort use

- Create a Google Cloud storage bucket: e.g. "rapidfort-poc-gs"
- Multi-region: or select the region where the RapidFort VM will be deployed
- Storage class: Standard
- Enforce public access prevention on this bucket
- Access control: uniform
- Protection tools: none
- Go with default no public access (pop-up on create)

Step 2: Create an IAM Role for RapidFort

Create IAM role: e.g. "rapidfort-poc-role"
- Permissions for "Storage Object Creator and Storage Object Viewer"
- Select the following permissions:
- Note that some permissions are not in "Storage Object Creator" or "Storage Object Viewer" but can
be added via the individual look-up i.e. storage.objects.delete and storage.buckets.get

Step 3: Create a Service Account for RapidFort

Create a service account: e.g. "rapidfort-poc-sa"
Grant access by selecting the role created during the previous step

Step 4: Update the Storage Bucket Principal and Role

- Bind the IAM role to the bucket created earlier
- Click Bucket overflow menu (⋮) for selected bucket & select Edit access
- Add Principal "rapidfort-poc-sa" (SA account created above)
- Select Role "rapidfort-poc-role" and save (Role created above)

Step 5: Generate a Private Key for the Service Account

- Generate private-key for service account "rapidfort-poc-sa"
- IAM -> Service Account -> select "rapidfort-poc-sa" SA -> Keys -> Add keys
- Use default JSON format
- This JSON file will be needed later

Compute Engine VM Creation

Create a a GCP Compute VM instance according to the following specifications:
  1. 1.
    n2-standard-8 (8 vCPU 32 GB Memory)
  2. 2.
    2 TB Storage (2048 GB for boot disk size)
  3. 3.
    Ubuntu 20.04.3 or Debian 11
    • Please contact RapidFort Support before using a different operating system
  4. 4.
    VPC consideration
    • For convenience the region and zone could match the VPC where container images are deployed and tested
    • If that is not possible, there must be a route to the RapidFort platform from all environments in which container images are deployed and tested
  5. 5.
    Added public SSH keys of the RapidFort Administrator
  6. 6.
    API and identity management → Added Service Account from above.
  7. 7.
    Allow HTTPS traffic
    • Make sure HTTPS & SSH are allowed from any customer-specific Network Tags

VM Configuration

Here the required packages are installed in order to set-up Microk8s

Step 1: Install Docker

curl -fsSL | sh -

Step 2: Install snap

Please verify if snap is installed on the RapidFort VM. If snap is already installed, then proceed to Step 3.
sudo apt install snapd -y
sudo snap install core
export PATH=$PATH:/snap/bin

Step 3: Install kubectl

sudo snap install kubectl --classic

Step 4: Install Helm

sudo snap install helm --classic

Step 5: Install Microk8s

sudo snap install microk8s --classic
sudo usermod -a -G microk8s $USER
mkdir -p ~/.kube
sudo chown -f -R $USER ~/.kube
newgrp microk8s

Step 6: Start Microk8s

microk8s start
microk8s status --wait-ready
microk8s kubectl get nodes # check node status.
microk8s enable dns hostpath-storage ingress
microk8s kubectl config view --raw >| ~/.kube/config

Step 7: Update Microk8s with DNS server address

This is required if public DNS is blocked. It reconfigures the core DNS in MicroK8s to use the private DNS instead of the default If not done, RapidFort CLI is likely to fail.
resolvectl status # get DNS server
microk8s disable dns
microk8s enable dns:<COMPANY_DNS_IP>
IMPORTANT: It should be possible to curl from both the VM host and the RapidFort runner pod:

RapidFort Helm Installation

Step 1: Create a data directory for RapidFort

sudo mkdir -p /opt/rapidfort/data
sudo chmod 777 -R /opt/rapidfort/

Step 2: Generate base64 encoding of the GCP Service Account key file.

cat <JSON_KEY_FILE> | base64

Step 3: Encode RapidFort user data

Create the file /opt/rapidfort/.user_data and populate as follows:
# this ip can be private ip or public ip considering it is reachable where the stub image will be deployed.
RF_APP_HOST=<ip addr>
# Admin account id
RF_APP_ADMIN=<RapidFort Super Admin Email>
RF_APP_ADMIN_PASSWD=<RapidFort Super Admin Password.>
# GCP Bucket created for RapidFort
RF_S3_BUCKET=<Google Cloud Storage Bucket name>
# Output from step 2
This will be sourced in step 5.

Step 4: Download the RapidFort Helm Chart

mkdir -p /opt/rapidfort
pushd /opt/rapidfort
curl -L${RF_HELM_CHART_VERSION}.tar.gz --output rapidfort.tar.gz
tar -xvf rapidfort.tar.gz && rm -rf rapidfort.tar.gz
pushd rapidfort-1.1.21-ib/chart
echo -e "export RF_HELM_DIR=`pwd`\n" > /opt/rapidfort/.rf_env

Step 5: Install RapidFort via the Helm Chart

source /opt/rapidfort/.rf_env
source /opt/rapidfort/.user_data
pushd ${RF_HELM_DIR} > /dev/null
helm_values="--set secret.rf_app_admin=${RF_APP_ADMIN} \
--set secret.rf_app_admin_passwd=${RF_APP_ADMIN_PASSWD} \
--set secret.s3_bucket=${RF_S3_BUCKET} \
--set secret.storage_type=${RF_STORAGE_TYPE} \
--set secret.rf_app_host=${RF_APP_HOST} \
--set global.container_engine=docker \
--set secret.gs_cred=${RF_GS_CREDS} \
--set global.ingressClassName=nginx
helm upgrade --install rapidfort ./ ${helm_values}

Step 6: Check all Pods are up and running

$ kubectl get pods

Next Steps

  • Sign-in to the RapidFort platform (VM IP address with the admin email and password above)
    • Update admin password via Profile Settings
  • Generate RapidFort License
  • Ensure rfstub & rfharden work from target container environment