RapidFort POV GCP Deployment

Deploy the RapidFort platform in GCP.


RapidFort runs on Kubernetes and can be deployed via the RapidFort Helm Chart. It's important that GCP is properly configured with the correct permissions, network requirements, and underlying tooling before deploying RapidFort via the Helm Chart.
This is described in more detail below, but the main steps before deploying RapidFort are:
  1. 1.
    Create a GCP Compute Engine VM that can be accessed over HTTPS and SSH
  2. 2.
    Install the required tooling on the GCP Compute Engine VM


Compute Requirements

  1. 1.
    Minimum Requirements of machine type n2-standard-8
    • 8 vCPU
    • 16 GB Memory
    • 2 TB Storage
  2. 2.
    Operating System Options
    • RapidFort has validated the following operating systems:
      • Ubuntu 20.04.3 (focal)
      • Debian 11 (bullseye)
    • Please contact RapidFort Support before using a different operating system

Storage Permission Requirements

  • RapidFort POV deployment uses local storage and hence no additional storage is required for this deployment.

Network Requirements


  1. 1.
    Networking and Security Policies allow HTTPS ingress to the RapidFort platform VM over port 443 from
    • end-user desktop browsers
    • environments in which container images are deployed and tested
      • IMPORTANT: RapidFort CLI must be able to reach the RapidFort platform as containers are instrumented and hardened
  2. 2.
    Networking and Security Policies allow SSH access to the RapidFort administrator.


The RapidFort VM must have HTTPS egress to the RapidFort Vulnerability Database and so must the Kubernetes pods deployed within the RapidFort deployment.

Private DNS Consideration

It may be Company Policy to block public DNS (e.g. and have a private GCP DNS instance instead. This should be determined ahead of time so the RapidFort deployment is configured accordingly.
- Check if the public DNS accessible
- Check /etc/resolv.conf for DNS
sudo cat /etc/resolv.conf

GCP Setup

Compute Engine VM Creation

Create a GCP Compute VM instance according to the following specifications:
  1. 1.
    n2-standard-8 (8 vCPU 32 GB Memory)
  2. 2.
    2 TB Storage (2048 GB for boot disk size)
  3. 3.
    Ubuntu 20.04.3 or Debian 11
    • Please contact RapidFort Support before using a different operating system
  4. 4.
    VPC consideration
    • For convenience, the region and zone could match the VPC where container images are deployed and tested
    • If that is not possible, there must be a route to the RapidFort platform from all environments in which container images are deployed and tested
  5. 5.
    Added public SSH keys of the RapidFort Administrator
  6. 6.
    API and identity management → Added Service Account from above.
  7. 7.
    Allow HTTPS traffic
    • Make sure HTTPS & SSH are allowed from any customer-specific Network Tags

VM Configuration

Here, the required packages are installed to set-up Microk8s

Step 1: Install Docker

curl -fsSL | sh -

Step 2: Install snap

Please verify if snap is installed on the RapidFort VM. If snap is already installed, then proceed to Step 3.
sudo apt install snapd -y
sudo snap install core
export PATH=$PATH:/snap/bin

Step 3: Install kubectl

sudo snap install kubectl --classic

Step 4: Install Helm

sudo snap install helm --classic

Step 5: Install Microk8s

sudo snap install microk8s --classic
sudo usermod -a -G microk8s $USER
mkdir -p ~/.kube
sudo chown -f -R $USER ~/.kube
newgrp microk8s

Step 6: Start Microk8s

microk8s start
microk8s status --wait-ready
microk8s kubectl get nodes # check node status.
microk8s enable dns hostpath-storage ingress
microk8s kubectl config view --raw >| ~/.kube/config

Step 7: Update Microk8s with DNS server address

This is required if public DNS is blocked. It reconfigures the core DNS in MicroK8s to use the private DNS instead of the default If not done, RapidFort CLI is likely to fail.
resolvectl status # get DNS server
microk8s disable dns
microk8s enable dns:<COMPANY_DNS_IP>
IMPORTANT: It should be possible to curl from both the VM host and the RapidFort runner pod:

RapidFort Helm Installation

Step 1: Create a data directory for RapidFort

sudo mkdir -p /opt/rapidfort/data
sudo chmod 777 -R /opt/rapidfort/

Step 2: Generate base64 encoding of the GCP Service Account key file.

cat <JSON_KEY_FILE> | base64

Step 3: Encode RapidFort user data

Create the file /opt/rapidfort/.user_data and populate as follows:
# this ip can be private ip or public ip considering it is reachable where the stub image will be deployed.
RF_APP_HOST=<ip addr>
# Admin account id
RF_APP_ADMIN=<RapidFort Super Admin Email>
RF_APP_ADMIN_PASSWD=<RapidFort Super Admin Password.>
# GCP Bucket created for RapidFort
RF_S3_BUCKET=<Google Cloud Storage Bucket name>
# Output from step 2
This will be sourced in step 5.

Step 4: Download the RapidFort Helm Chart

mkdir -p /opt/rapidfort
pushd /opt/rapidfort
curl -L${RF_HELM_CHART_VERSION}.tar.gz --output rapidfort.tar.gz
tar -xvf rapidfort.tar.gz && rm -rf rapidfort.tar.gz
pushd rapidfort-1.1.21-ib/chart
echo -e "export RF_HELM_DIR=`pwd`\n" > /opt/rapidfort/.rf_env

Step 5: Install RapidFort via the Helm Chart

source /opt/rapidfort/.rf_env
source /opt/rapidfort/.user_data
pushd ${RF_HELM_DIR} > /dev/null
helm_values="--set secret.rf_app_admin=${RF_APP_ADMIN} \
--set secret.rf_app_admin_passwd=${RF_APP_ADMIN_PASSWD} \
--set secret.s3_bucket=${RF_S3_BUCKET} \
--set secret.storage_type=${RF_STORAGE_TYPE} \
--set secret.rf_app_host=${RF_APP_HOST} \
--set global.container_engine=docker \
--set secret.gs_cred=${RF_GS_CREDS} \
--set global.ingressClassName=nginx
helm upgrade --install rapidfort ./ ${helm_values}

Step 6: Check all Pods are up and running

$ kubectl get pods

Next Steps

  • Sign-in to the RapidFort platform (VM IP address with the admin email and password above)
    • Update admin password via Profile Settings
  • Generate RapidFort License
  • Ensure rfstub & rfharden work from target container environment