MSSP only Slow MSSP config push and configuration export

Exporting the configuration in a SOAR MSSP environment by pushing the configuration can take more than 60 seconds.

Symptoms

When you do a configuration push to export the configuration to standard accounts, the configuration push can take more than 60 seconds and cause repeated REST requests.

Resolving the problem

To correct this problem, complete the following steps to force a pull of any updated SOAR application images:
  1. Air gap only For air gap clusters only, mirror the new images onto the local registry and update the LOCAL_REGISTRY variable with the location of the registry to which you want to mirror the images, as follows:
    LOCAL_REGISTRY=replace_with_your_registry
    SOAR_IMAGE_LIST=("isc-cases-jvm-dump-manager" "isc-cases-co3postgres-orchestrator" "isc-cases-activemq" "isc-cases-activemq-logging-sidecar" "isc-cases-application" "isc-cases-email" "isc-cases-event-adapter" "isc-cases-event-handler" "isc-cases-logging-sidecar" "isc-cases-resutil" "isc-cases-scripting" "isc-cases-ui" "isc-cases-breach-content-controller")
    for image in "${SOAR_IMAGE_LIST[@]}"
    do
        oc image mirror cp.icr.io/cp/cp4s/$image:1.10.17.0-amd64 $LOCAL_REGISTRY/cp/cp4s/$image:1.10.17.0-amd64
    done
  2. Check the value of the imagePullPolicy for the cp4sthreatmanagements CR, as follows:
    oc get cp4sthreatmanagements.isc.ibm.com/threatmgmt -o jsonpath='{.spec.extendedDeploymentConfiguration.imagePullPolicy}'
  3. Depending on the value of the imagePullPolicy, complete one of the following:
    • If the imagePullPolicy is set to Always, use the following command to restart the cases application pods to pull the new images:
      oc delete pod -l app.kubernetes.io/component=cases-soar
    • If the imagePullPolicy is set to IfNotPresent or Never complete the following:
      1. Set the imagePullPolicy to Always to pull the new image:
        oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "Always"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt
      2. Delete the cases application pods to trigger an image pull:
        oc delete pod -l app.kubernetes.io/component=cases-soar
      3. After the images are pulled, use the following command to set imagePullPolicy back to the original value for the cluster:
        oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "XXXXXX"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt