Storage requirements

To install IBM Cloud Pak® for Security, you must configure a suitable storage class in the cluster. The configuration must be supported by one or more persistent volumes of suitable size.

The integration capabilities that are provided in IBM Cloud Pak® for Security use persistent storage to provide reliable and resilient storage of state data. The cluster administrator must provide appropriate storage classes that meet the requirements of the OpenShift environment.

Persistence is enabled by default in IBM Cloud Pak for Security, so persistent volumes are required; you must have physical volumes available, backed up by a suitable file system.

By definition, block storage implies RWO (ReadWriteOnce) access mode and does not support RWX (ReadWriteMany) or ROX (ReadOnlyMany). Block storage provides the best performance for storage, but it forces RWO access mode in the node.

IBM Cloud Pak for Security does not support Network File System (NFS). Red Hat® OpenShift® Container Platform and IBM Cloud Pak® foundational services do not have a nfs-dynamic provisioner.

IBM Cloud Pak foundational services requires block or file storage.

Note: IBM Cloud Pak for Security is validated only with dynamic provisioning.

Recommended storage providers

For Linux on x86 hardware, the following recommended storage providers have been validated across all the capabilities of IBM Cloud Pak for Security:

• IBM Cloud Block Storage and IBM Cloud File Storage
• IBM Storage Suite for IBM Cloud Paks. This suite of offerings includes the following validated storage options:
  • Red Hat OpenShift Container Storage (RHOCS) 4.2+, Block
  • File storage from IBM Spectrum Scale
  • Red Hat® Ceph® Storage
• Portworx Storage 2.5.5+
• Red Hat OpenShift Container Storage (RHOCS) 4.2+, Block

For more information, see IBM Storage Suite for IBM Cloud Paks documentation .

Important:

• If you are using VMWare vSphere and RHOCS, CPU and RAM requirements must be incremented in line with the resource requirements in the IBM Storage Suite for IBM Cloud Paks documentation .

• The IBM Storage Suite components are not supported by the IBM Cloud Pak for Security support team. You must ensure that you have an appropriate support arrangement for these components. So, if an issue is identified with the storage, you can engage directly with the storage provider for support.

• To provide protection for data at rest, use volume encryption for your chosen storage.

Validated storage options

For each of the cloud environment providers that are supported by Cloud Pak for Security, the storage options that are validated for Cloud Pak for Security are detailed in Table 1.

Table 1. Validated block storage options

Table 2. Validated file storage options

Note: On IBM Cloud (ROKS), you can use the gid storage classes: ibmc-file-bronze-gid, ibmc-file-silver-gid, and ibmc-file-gold-gid. For more information about gold, silver, and bronze storage, see Storage class reference.

*If your disks are not encrypted by default by your cloud provider, you can ensure that your data within Cloud Pak for Security is stored securely by encrypting your disks. If you use Linux® Unified Key Setup-on-disk-format (LUKS) for this purpose, before you install Cloud Pak for Security, enable LUKS and format the disks with the XFS file system.

1:1 mapping exists between deployment replicas and the underlying Persistent Volume Claims (PVCs). For example, a CouchDB deployment that has three replicas has three underlying PVCs.

For more information about Kubernetes persistent volumes, see Persistent Volumes .

Retrieving default block storage class in your environment

Run the following command to confirm the default storage class:

 oc get storageclass | grep default

You must set only one default storage class in the Red Hat OpenShift environment. If you have more than one default storage class set, to unset one of the storage classes, run the following command:

 oc patch storageclass <storage-class-name> -p '{"metadata": {"annotations": {"storageclass.kubernetes.io/is-default-class": "false"}}}'

When you update the values.conf file to install Cloud Pak for Security, set the default storage class as the value for the storageClass parameter.

IBM Cloud environment storage sizing

In an IBM Cloud environment, the minimal PVC size that is enforced is 20 GB for the standard storage class ibmc-block-gold. For more information, see IBM Cloud documentation .

In IBM Cloud environments, IBM Cloud Pak for Security requires one or more persistent volumes of suitable size as shown in Table 2.

Table 2. Recommended storage sizing for IBM Cloud

*For the Backup and Restore pod, instead of using the defaults specified in the table, you can provision your own storage. For more information, see Creating the backup and restore PVC.

Unmanaged Red Hat OpenShift environment storage sizing

In a Red Hat OpenShift Container Platform environment where you do not have a managed cluster from a cloud provider, Cloud Pak for Security requires one or more persistent volumes of suitable size as shown in Table 3.

Table 3. Recommended storage sizing for unmanaged Red Hat OpenShift environments

*For the backup and Restore pod, instead of using the defaults specified in the table, you can provision your own storage. For more information, see Creating the backup and restore PVC.