MSSP only Slow MSSP config push and configuration export
Exporting the configuration in a SOAR MSSP environment by pushing the configuration can take more than 60 seconds.
Symptoms
When you do a configuration push to export the configuration to standard accounts, the configuration push can take more than 60 seconds and cause repeated REST requests.
Resolving the problem
To correct this problem, complete the following steps to force a pull of any updated SOAR
application images:
- Air gap only For air gap clusters only, mirror the new
images onto the local registry and update the
LOCAL_REGISTRY
variable with the location of the registry to which you want to mirror the images, as follows:LOCAL_REGISTRY=replace_with_your_registry SOAR_IMAGE_LIST=("isc-cases-jvm-dump-manager" "isc-cases-co3postgres-orchestrator" "isc-cases-activemq" "isc-cases-activemq-logging-sidecar" "isc-cases-application" "isc-cases-email" "isc-cases-event-adapter" "isc-cases-event-handler" "isc-cases-logging-sidecar" "isc-cases-resutil" "isc-cases-scripting" "isc-cases-ui" "isc-cases-breach-content-controller") for image in "${SOAR_IMAGE_LIST[@]}" do oc image mirror cp.icr.io/cp/cp4s/$image:1.10.17.0-amd64 $LOCAL_REGISTRY/cp/cp4s/$image:1.10.17.0-amd64 done
- Check the value of the
imagePullPolicy
for thecp4sthreatmanagements
CR, as follows:oc get cp4sthreatmanagements.isc.ibm.com/threatmgmt -o jsonpath='{.spec.extendedDeploymentConfiguration.imagePullPolicy}'
- Depending on the value of the
imagePullPolicy
, complete one of the following:- If the
imagePullPolicy
is set toAlways
, use the following command to restart thecases
application pods to pull the new images:oc delete pod -l app.kubernetes.io/component=cases-soar
- If the
imagePullPolicy
is set toIfNotPresent
orNever
complete the following:- Set the
imagePullPolicy
toAlways
to pull the new image:oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "Always"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt
- Delete the
cases
application pods to trigger an image pull:oc delete pod -l app.kubernetes.io/component=cases-soar
- After the images are pulled, use the following command to set
imagePullPolicy
back to the original value for the cluster:oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "XXXXXX"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt
- Set the
- If the