IBM Developer

Tutorial

Set up NFS storage for QRadar Suite deployment

Integrate Red Hat OpenShift with NFS storage to optimize your security platform

By Anuj Shrivastava, Tamilselvam Ramalingam

On this page

If you're looking for a powerful, flexible security platform, Red Hat OpenShift Container Platform (OCP) provides a robust Kubernetes environment for deploying various workloads, including IBM Security QRadar Suite. In this tutorial, you'll learn how to integrate a Red Hat OpenShift cluster with Network File System (NFS) storage specifically tailored for deploying Qradar Suite.

The following diagram shows the data flow for Red Hat OpenShift nodes and the NFS storage server: NFS-OCP

Notes:

  • Demo: If you would rather watch a demonstration of the steps involved in integrating a Red Hat OpenShift cluster with NFS storage, see the demo video following the tutorial steps.
  • Product name: Naming of IBM Security offerings has evolved. IBM Security QRadar Suite contains components that are packaged as part of the IBM Cloud Pak for Security. QRadar Suite also offers a Unified Analyst Experience (UAX), a common, integrated user interface that empowers analysts to work more quickly and efficiently throughout investigation and response processes across multiple tools and data sources. As you complete this tutorial, you might see references to "CP4S" or "UAX". For full naming details, see IBM Security QRadar Suite, Getting started with IBM Cloud Pak for Security, and the QRadar Suite two-pager.

Prerequisites

Before completing the tutorial, ensure you have:

  • Access to a Red Hat OpenShift Container Platform cluster
  • Appropriate permissions to create PersistentVolume and PersistentVolumeClaim objects
  • An NFS server accessible from the Red Hat OpenShift cluster
  • Red Hat Enterprise Linux (RHEL) or compatible version

Estimated time

This tutorial should take you 30 minutes to complete. (Note: Installing QRadar Suite can take up to 1.5 hours.)

Steps

To integrate a Red Hat OpenShift cluster with NFS storage to deploy QRadar Suite, complete the following steps.

Step 1: Configure the NFS server

  1. To set up the NFS server, run the following commands:
    yum install -y nfs-utils
systemctl enable rpcbind
systemctl enable nfs-server
systemctl start rpcbind
systemctl start nfs-server
mkdir /var/nfsshare
chmod -R 755 /var/nfsshare

  2. To configure the NFS exports, edit the /etc/exports file to allow access to required directories from OpenShift nodes:

    vi /etc/exports
exportfs -a

    Example:

     # vi /etc/exports
 # exportfs -a

 /data 10.17.21.88(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
 /data 10.17.21.89(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
 /data 10.17.21.90(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
 /data 10.17.21.11(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
 /data 10.17.21.12(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
 /data 10.17.21.13(rw,sync,no_wdelay,no_root_squash,insecure,no_subtree_check)
  3. Create a namespace on the OCP cluster:
     # namespace.yaml
 apiVersion: v1
 kind: Namespace
 metadata:
   name: nfs-for-cp4s

Step 2: Configure the deployment

  1. To configure the deployment, you will need to patch its container variables with the connection information for your NFS Server, similar to the following example:

     apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: nfs-client-provisioner
   labels:
     app: nfs-client-provisioner
   namespace: nfs-for-cp4s
 spec:
   replicas: 1
   strategy:
     type: Recreate
   selector:
     matchLabels:
       app: nfs-client-provisioner
   template:
     metadata:
       labels:
         app: nfs-client-provisioner
     spec:
       serviceAccountName: nfs-client-provisioner
       containers:
         - name: nfs-client-provisioner
           image: registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.2
           volumeMounts:
             - name: nfs-client-root
               mountPath: /persistentvolumes
           env:
             - name: PROVISIONER_NAME
               value: k8s-sigs.io/nfs-subdir-external-provisioner
             - name: NFS_SERVER
               value: 10.10.10.54
             - name: NFS_PATH
               value: /ifs/kubernetes
       volumes:
         - name: nfs-client-root
           nfs:
             server: 10.10.10.54
             path: /ifs/kubernetes
  2. If your cluster has RBAC enabled, or if you are running Red Hat OpenShift, you must authorize the provisioner. If you are in a namespace/project other than "default", edit the deploy.yaml file or rbac.yaml file, similar to the following example:
     apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: nfs-client-provisioner
   # replace with namespace where provisioner is deployed
   namespace: nfs-for-cp4s
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: nfs-client-provisioner-runner
 rules:
   - apiGroups: [""]
     resources: ["nodes"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["persistentvolumes"]
     verbs: ["get", "list", "watch", "create", "delete"]
   - apiGroups: [""]
     resources: ["persistentvolumeclaims"]
     verbs: ["get", "list", "watch", "update"]
   - apiGroups: ["storage.k8s.io"]
     resources: ["storageclasses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources: ["events"]
     verbs: ["create", "update", "patch"]
 ---
 kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: run-nfs-client-provisioner
 subjects:
   - kind: ServiceAccount
     name: nfs-client-provisioner
     # replace with namespace where provisioner is deployed
     namespace: nfs-for-cp4s
 roleRef:
   kind: ClusterRole
   name: nfs-client-provisioner-runner
   apiGroup: rbac.authorization.k8s.io
 ---
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: leader-locking-nfs-client-provisioner
   # replace with namespace where provisioner is deployed
   namespace: nfs-for-cp4s
 rules:
   - apiGroups: [""]
     resources: ["endpoints"]
     verbs: ["get", "list", "watch", "create", "update", "patch"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: leader-locking-nfs-client-provisioner
   # replace with namespace where provisioner is deployed
   namespace: nfs-for-cp4s
 subjects:
   - kind: ServiceAccount
     name: nfs-client-provisioner
     # replace with namespace where provisioner is deployed
     namespace: nfs-for-cp4s
 roleRef:
   kind: Role
   name: leader-locking-nfs-client-provisioner
   apiGroup: rbac.authorization.k8s.io
  3. Update the storage class:
     apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
   name: nfs-client
 provisioner: k8s-sigs.io/nfs-subdir-external-provisioner # or choose another name, must match deployment's env PROVISIONER_NAME'
 parameters:
   archiveOnDelete: "false"
  4. For each of the three YAML files that you have updated, run this playbook one by one:
     $ oc apply -f rbac.yaml
 $ oc apply -f deployment.yaml
 $ oc apply -f scc.yaml

Step 3: Assign the security context constraint

After you've updated the three .yaml files, you need to check the deployment status for each under the NFS namespace. If you see a failure message that reads forbidden: unable to validate against any “security context constraint”, there is an issue with the permissions required for the NFS provisioner pod to access the host filesystem. To resolve this, you will assign the appropriate security context constraint (SCC) to the service account running the NFS provisioner pod.

  1. Create a role:
     $ oc create role use-scc-hostmount-anyuid –verb=use –-resource=scc –-resource-name=hostmount-anyuid -n nfs-for-cp4s
 $ oc get role -n nfs-for-cp4s
  2. Bind the role to the service account user:
     $ oc adm policy add-role-to-user use-scc-hostmount-anyuid -z nfs-client-provisioner –role-namespace nfs-for-cp4s -n nfs-for-cp4s
  3. Scale the deployment to apply the changes:
     $ oc scale --replicas=1 deployment <nfs-provisioner-deployment-name> -n nfs-for-cp4s

Step 4: Create a test PVC and map it to a Pod

  1. Ensure the NFS volume is accessible by creating a test PVC and mapping it to a pod:
     apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: test-pvc
 spec:
   accessModes:
     - ReadWriteMany
   storageClassName: nfs-client #must be same
   resources:
     requests:
       storage: 1Gi
 $ oc apply -f test-pvc.yaml
  2. Verify that the PVC is bound:
     $ oc get pvc
    Ensure that the status is Bound.

Step 5: Set up your system for QRadar Suite deployment

You're now ready to set up your Linux VM or other system with cli-tools, which are required to deploy QRadar Suite.

There are multiple installation methods to deploy QRAdar Suite. This tutorial uses Container Application Software for Enterprises (CASE). See Installing QRadar Suite Software by using CASE for detatils.

Important: Installation takes approximately 1.5 hours. When installation is complete, the latest version of IBM Cloud Pak foundational services and QRadar Suite Software 1.10.20 are installed. The storage class in your values.conf file must be nfs-client.

Verify the QRadar Suite Software installation by running the following command:

oc ibm-pak launch -t 1 \
$CASE_NAME \
--version $CASE_VERSION \
--inventory ibmSecurityOperatorSetup \
--namespace $CP4S_NAMESPACE \
--action validate

The following message is displayed when installation is complete:

[INFO] IBM Cloud Pak for Security deployment is complete.

Demo video

This video demonstrates the steps to set up an NFS server and integrate it with OpenShift Container Platform for deploying QRadar Suite, similar to those you completed in the tutorial.

Summary and next steps

In this tutorial, you've learned how to set up NFS on Red Hat OCP as a prerequisite for deploying IBM Security QRadar Suite. You have implemented IBM's recommendations to ensure a seamless and efficient deployment, tailored to provide field administrators with a clear standard operating procedure.

Now that you know how to integrate OCP with NFS storage to deploy QRadar Suite, you can continue to explore IBM Security and Red Hat resources, products, and capabilities: