IBM Support

QRadar SOAR - IBM QRadar Suite: How do resolve InvalidImageName issue with the Opencontent Elasticsearch deployment

How To


Summary

How to resolve InvalidImageName issue with the Opencontent Elasticsearch deployment

Objective

Summary
How do resolve InvalidImageName issue with the Opencontent Elasticsearch deployment?

Objective
Support for Elasticsearch 7.9.3 is no longer supported and is replaced by 7.10.2.

All customers at who have deployed 1.10.x and if they have not pinned their version using https://www.ibm.com/docs/en/cp-security/1.10?topic=administering-approval-strategy they they will experience the following:

isc-cases--cb09-ib-6fb9-es-server-data-0  0/2     Init:InvalidImageName   0  12h
isc-cases--cb09-ib-6fb9-es-server-data-1  0/2     Init:InvalidImageName   0  12h
isc-cases--cb09-ib-6fb9-es-server-data-2  0/2     Init:InvalidImageName   0  12h

And describe of the isc-cases elastic pods shows:

Events:
  Type     Reason         Age                     From     Message
  ----     ------         ----                    ----     -------
  Warning  InspectFailed  3m48s (x3512 over 12h)  kubelet  Failed to apply default image tag "cp.icr.io/cp/opencontent-elasticsearch-7.9.3@": couldn't parse image reference "cp.icr.io/cp/opencontent-elasticsearch-7.9.3@": invalid reference format

Note: Mirror Image on Airgap Environment:
Airgap Cluster will have an additional step to mirror the new image onto the local registry:

oc image mirror cp.icr.io/cp/cp4s/isc-cases-orchestrator:1.10.17.0-amd64 <LOCAL_REGISTRY>/cp/cp4s/isc-cases-orchestrator:1.10.17.0-amd64

Once the image is mirrored, follow the steps documented below to resolve the issue.
 

Remediaion Steps
Check the value of the imagePullPolicy  for the cp4sthreatmanagements CR:

oc get cp4sthreatmanagements.isc.ibm.com/threatmgmt -o jsonpath='{.spec.extendedDeploymentConfiguration.imagePullPolicy}'

If the  imagePullPolicy set to Always,  restart of the cases-operator to pull in the 7.10.2 ElasticSearch version :

oc delete pod -lname=isc-cases-operator
 

If the  imagePullPolicy set to IfNotPresent or Never, the imagePullPolicy will need to be set to Always to pull the new image:

oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "Always"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt

Then delete the cases operator pod to trigger an image pull:

oc delete pod -lname=isc-cases-operator

Once the image is pulled, we will need to set the imagePullPolicy back to the original imagePullPolicy for the cluster (from the earlier step):

oc patch --type json --patch='[{ "op": "replace", "path": "/spec/extendedDeploymentConfiguration/imagePullPolicy", "value": "XXXXXX"}]' cp4sthreatmanagements.isc.ibm.com/threatmgmt

Document Location

Worldwide

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTDPP","label":"IBM Cloud Pak for Security"},"ARM Category":[{"code":"a8m3p000000F8yvAAC","label":"Cloud Pak for Security (CP4S)"},{"code":"a8m3p000000PCPsAAO","label":"Support"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions","Type":"MASTER"}]

Document Information

Modified date:
05 December 2023

UID

ibm17082776