Storage requirements

Suggested storage providers

For Linux® on x86 hardware, the following storage providers are validated across all the capabilities of QRadar Suite Software:

• IBM Cloud® Block Storage and IBM Cloud File Storage
• IBM Storage Fusion 2.4.0 or later
• IBM® Storage Suite for IBM Cloud Paks. This suite of offerings includes the following validated storage options:
  • IBM Storage Scale Container Native CSI 2.6 or later
  • Red Hat Ceph® Storage
  • Red Hat OpenShift Data Foundation (ODF) 4.2 or later with the block or file storage type
• Portworx Storage, version 2.5.5 or later
• Red Hat OpenShift Data Foundation (ODF) 4.2 or later with the block or file storage type

For more information about these options, see the IBM Storage Suite for IBM Cloud Paks documentation.

Network File Storage (NFS)

You must set up dynamic storage provisioning on your NFS server. NFS does not support dynamic storage provisioning by default, and Red Hat OpenShift does not include a provisioner plug-in to create an NFS storage class.

For more information about setting up your Red Hat OpenShift Container Platform clusters with persistent storage by using NFS, see Kubernetes NFS Subdir External Provisioner.

Validated storage options

For each of the cloud environment providers that are supported by QRadar Suite Software, the validated storage options are detailed in the following tables.

1:1 mapping exists between deployment replicas and the underlying Persistent Volume Claims (PVCs). For example, a CouchDB deployment that has three replicas has three underlying PVCs.

For more information about Kubernetes persistent volumes, see Persistent Volumes.

Data encryption

You can encrypt your disks yourself if they are not encrypted by default. If you use Linux Unified Key Setup-on-disk-format (LUKS) for this purpose, enable LUKS and format the disks with the XFS file system before you install QRadar Suite Software.

For data encryption at rest on Portworx, AWS, and IBM Cloud File Storage, the following options are suggested.

AWS

When you install Red Hat OpenShift in AWS, the gp2 storage class is created by default. By default this storage class uses the encryption key set within the EBS encryption for the entire AWS Account. Contact your AWS administrator to determine which KMS key was used to encrypt the Red Hat OpenShift nodes, and obtain the full ARN of the key. To use a different encryption key, create a new custom storage class for use with QRadar Suite Software to ensure that the chosen encryption key is used when the persistent volumes are encrypted. For more information, see the AWS Elastic Block Store (EBS) object definition section of Post-installation storage configuration .

IBM Cloud File Storage

For more information, see Setting up encryption for Block Storage for VPC.

Portworx enterprise

For more information, see IBM Cloud in the Portworx documentation.

Other options, such as NFS, are not supported.

Retrieving the default block storage class in your environment

You must set only one default storage class in the Red Hat OpenShift environment.

• Confirm the default storage class by typing the following command.

  oc get storageclass | grep default

• If you have more than one default storage class set, unset one of the storage classes by typing the following command.

  oc patch storageclass <storage_class> -p '{"metadata": {"annotations": {"storageclass.kubernetes.io/is-default-class": "false"}}}'

When you update the values.conf file to install QRadar Suite Software, set the default storage class as the value for the storageClass parameter.

IBM Cloud environment storage

In an IBM Cloud environment, the minimal PVC size that is enforced is 20 GB for the standard ibmc-block-gold storage class. For more information, see IBM Cloud documentation.

In IBM Cloud environments, QRadar Suite Software requires one or more persistent volumes of suitable size, as shown in the following table.

Unmanaged Red Hat OpenShift environment storage

In a Red Hat OpenShift Container Platform environment where you do not have a managed cluster from a cloud provider, QRadar Suite Software requires one or more persistent volumes of suitable size, as shown in the following table.