Planning for installation

To plan for your Guardium® Insights deployment, review and complete all of the necessary tasks on the planning checklist.

Required knowledge

Architecture for IBM Guardium Insights
Guardium Insights is composed of integrated microservices that run on a multi-node Red Hat® OpenShift® cluster, which manages resources elastically and runs with minimal downtime.
Installation roles and personas
Some planning and installation tasks can be completed only by a Red Hat OpenShift cluster administrator, while other tasks can be completed by a project administrator. Learn which role is set to complete each task, based on the installation method that you prefer.
Storage considerations
To install IBM® Guardium Insights, you must have a supported file storage system on your Red Hat OpenShift cluster.
System requirements and prerequisites
Before you can install IBM Guardium Insights, ensure that you have the required hardware, software, and storage. System requirements for IBM Security Guardium Insights are described in this topic.
Operator and operand versions
To obtain fixes, security updates, and new functionality, you must install the latest refresh of the IBM Guardium Insights software. This software includes the control plane, shared cluster components, and services.
Hardware cluster performance expectations
A cluster is a set of machines, called nodes that run containerized applications that are managed by Kubernetes. This topic outlines typical performance characteristics for clusters of different sizes.
Hardware cluster requirements
A cluster is a set of machines, called nodes that run containerized applications that are managed by Kubernetes. A cluster has at least one master node and at least one worker node (each worker node must run on a separate physical server). One or more worker nodes host the pods that are the components of the application. One or more master nodes manage the worker nodes and the pods in the cluster.
Port requirements
Guardium Insights requires that your system have some ports available for communication. This topic lists these connections and the default port numbers that are assigned to them.
Domain name and TLS certificates
You must provide a TLS certificate for the platform Fully Qualified Domain Name (FQDN). The TLS certificate can be a certificate for a specific domain (for example, my.test.com - or it can be a wildcard certificate (for example, *.test.com).
Migration considerations
When upgrading to a new version of Guardium Insights, consider the migration information that is outlined in this topic.
Enabling passive encryption
You can enable passive encryption by providing keys and encrypting data using the EncryptionConfig file and the kube-apiserver command. You can do this before or after installing Guardium Insights.