Open topic with navigation

# Understanding Labels and Pods

During installation, you apply labels, which are associated with the deployed capabilities, to the worker nodes in the Kubernetes cluster. The labels indicate to Kubernetes the various types of workloads that can run on a specific host system. Based on the labels, Kubernetes then assigns pods to the nodes to provide functions, tasks, and services. Each pod belongs to a specific namespace in the OMT Management portal. On occasion, you might need to restart pods or reconfigure the environment by moving labels to different nodes, thus reassigning the workload of the pods.

When using the OMT Management Portal, the label format is `<label name>:yes`. However, when using the kubectl command line the label format is `<label name>=yes`.

- Adding Labels to Worker Nodes
  - fusion:yes
  - intelligence:yes
  - intelligence-datanode:yes
  - intelligence-namenode:yes
  - intelligence-spark:yes
  - kafka:yes
  - th-platform:yes
  - th-processing:yes
  - zk:yes
- Understanding the Pods that Do Not Have Labels
- Understanding Pods that Run Master Nodes

## Adding Labels to Worker Nodes

Depending on the capabilities that you deploy, you must to assign certain a set of labels to the Worker Nodes. Each of the following sections defines the pods and their associated capabilities that get installed per assigned label.

To avoid issues caused by conflicting label assignments, review the following considerations.

- Labeling for the Intelligence capability
  - The HDFS NameNode, which corresponds with the `intelligence-namenode:yes` label, should run on one worker node only. The worker node must match the hostname or IP address that you provided in the HDFS NameNode field in the OMT Management Portal > Configure/Deploy page > Intelligence.
  - Assign the label for Spark2, `intelligence-spark:yes`, to the same worker nodes where you placed the `intelligence-datanode:yes` label.
- For Transformation Hub's Kafka and ZooKeeper, make sure that the number of the nodes you have labeled corresponds to the number of worker nodes in the Kafka cluster and the number of worker nodes running Zookeeper in the Kafka cluster properties from the pre-deployment configuration page. The default number is 3 for a Multiple Worker deployment.
- Although ESM Command Center, Recon, Intelligence, and SOAR all require Fusion, you do not need to assign the label for Fusion to more than one worker node.

## fusion:yes

The Fusion capability includes many of the core services needed for your deployed products, including the Dashboard and user management; all deployed capabilities require Fusion. Add the `fusion:yes` label to the Worker Nodes where you want to run the associated pods. For high availability, add this label to multiple worker nodes.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
esm-acc-web-app | Manages the user interface for ESM Command Center. The interface connects to an ESM Manager server running outside the Kubernetes cluster. | arcsight-installer | ESM Command Center
esm-web-app | Manages how ESM Command Center links to main navigation of the Platform user interface. | arcsight-installer | ESM Command Center
esm-widgets | Manages the dashboards and widgets that are designed to incorporate data from ESM. The widgets connect to an ESM Manager server running outside of the Kubernetes cluster. For example, when you start this pod, it installs the provided How is my SOC running? dashboard. | arcsight-installer | ESM Command Center
fusion-arcmc-web-app | Manages the user interface for ArcSight Management Center. A `fusion-arcmc-web-app:yes` label can optionally be applied to one or more worker nodes to control where this pod runs. Otherwise, it falls back to running on a node where the `fusion:yes` label is applied. | arcsight-installer | Fusion
fusion-common-doc-web-app | Provides the context-sensitive user guides for Fusion (the Platform), Recon, and Reporting. | arcsight-installer | Fusion
fusion-metadata-web-app | Manages the REST API for the metadata of the Dashboard feature. | arcsight-installer | Fusion
fusion-dashboard-web-app | Manages the framework, including the user interface, for the Dashboard feature. | arcsight-installer | Fusion
fusion-db-monitoring-web-app | Manages the REST API for the database monitoring function. | arcsight-installer | Fusion
fusion-db-search-engine | Provides APIS to access data in the ArcSight Database. NOTE: This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Fusion
fusion-metadata-rethinkdb | Manages the RethinkDB database, which stores information about a user's preferences and configurations. | arcsight-installer | Fusion
fusion-single-sign-on | Manages the SSO service that enables users to log in to any of the deployed capabilities and the consoles for ArcSight Intelligence, SOAR, and ESM Command Center. | arcsight-installer | Fusion
fusion-ui-services | Manages the framework, including the user interface, for the primary navigation functions in the user interface. | arcsight-installer | Fusion
fusion-user-management | Manages the framework, including the user interface, for the user management function. | arcsight-installer | Fusion
interset-widgets | Manages the widgets that are designed to incorporate data from ArcSight Intelligence. The widgets connect to an Intelligence server running outside of the Kubernetes cluster. | arcsight-installer | Intelligence
layered-analytics-widgets | Manages and installs the widgets that can incorporate data from multiple capabilities. For example, the provided Entity Priority widget connects to ESM Command Center and Intelligence servers outside the Kubernetes cluster to display entity data. | arcsight-installer | Layered Analytics
recon-analytics | Manages the backend of Outlier Analytics; the user interface for Outlier Analytics is managed by the fusion-search-web-app pod. | arcsight-installer | Recon
fusion-search-web-app | Manages lookup lists, Data Quality Dashboard and Outlier UI capabilities. Also hosts the APIs used for search. | arcsight-installer | Fusion
fusion-reporting-web-app | Manages the REST API and user interface for the Reporting feature. NOTE: This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Fusion
fusion-search-and-storage-web-app | Manages the Search and Storage Groups and capabilities | arcsight-installer | Fusion
fusion-db-adm-schema-mgmt | Manages installation, upgrade, and maintenance of the <tenant>_secops_adm schema and data | arcsight-installer | Fusion
fusion-arcsight-configuration-service | A secure, shared configuration repository for ArcSight capabilities | arcsight-installer | Fusion
soar-message-broker | Manages SOAR events | arcsight-installer | SOAR
soar-web-app | Manages SOAR backend services | arcsight-installer | SOAR
soar-db-init | Manages the SOAR DB schema lifecycle | arcsight-installer | SOAR
soar-jms-migration | Manages SOAR JMS migration | arcsight-installer | SOAR
soar-widgets | Manages SOAR widget deployment | arcsight-installer | SOAR
soar-frontend | Manages SOAR user interface services | arcsight-installer | SOAR
soar-gateway | Manages SOAR user requests | arcsight-installer | SOAR
th-enrichment-processor-group | Manages the instances that process events coming from the selected source topic (by default, th-arcsight-avro) by executing enrichment tasks , which include generating a Global ID. Events are then routed to the topic mf-event-avro-enriched. The default is 2 instances running Out-of-the-box. | arcsight-installer | Transformation Hub

## intelligence:yes

Add the `intelligence:yes` label to Worker Nodes where you want to run the pods that manage functions and services for the ArcSight Intelligence capability. For high availability, add this label to multiple worker nodes.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
elasticsearch-data | Manages the Elasticsearch functions that store all raw events for Intereset Analytics and provide all data that drives the user interface. | arcsight-installer | Intelligence
elasticsearc-master | Manages the Elasticsearch services. | arcsight-installer | Intelligence
h2 | Stores user identities required to authenticate and authorize users. | arcsight-installer | Intelligence
interset-analytics | Determines the individual baselines , then discovers and ranks devisions from those baselines for the Intelligence Analytics feature. This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Intelligence
interset-api | Manages the REST API that the Intelligence user interface uses to gather the Intelligence Analytics results. This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Intelligence
interset-exports | Generates the PDF reports of organization risks and the users involved in risky behaviors. | arcsight-installer | Intelligence
interset-logstash | Manages Logstash, which collects raw events from Transofrmation Hub and sends them to Elasticsearch for indexing. | arcsight-installer | Intelligence
interset-spark-config-file-server | Hosts a file server to provide configuration files for Spark3 to consume. | arcsight-installer | Intelligence
interset-ui | Manages the user interface that displays the Intelligence Analytics results and the raw data in the Intelligence dashboard | arcsight-installer | Intelligence
intelligence-arcsightconnector-api | Manages APIs related to licensing support and provides Fusion menu registration for Intelligence. | arcsight-installer | Intelligence
intelligence-tuning-api | Manages APIs that tune the Intelligence Analytics metadata that can change the Intelligence Analytics results. This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Intelligence
intelligence-tenant-control | Manages tenant configurations and secrets for Intelligence. | arcsight-installer | Intelligence
searchmanager-api | Manages APIs that provide administrative tools related to Elasticsearch and the search capability in general. | arcsight-installer | Intelligence
searchmanager-engine | Manages jobs that provide administrative tools related to Elasticsearch and the search capability in general. This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Intelligence

## intelligence-datanode:yes

Add the `intelligence-datanode:yes` label to Worker Nodes where you want to run the pods that manage HDFS services for the ArcSight Intelligence capability.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
hdfs-datanode | Manages how HDFS stores the results of Intelligence Analytics searches before transferring them to the ArcSight database. The HDFS Datanodes contain blocks of HDFS files. | arcsight-installer | Intelligence

## intelligence-namenode:yes

Add the `intelligence-namenode:yes` label to a Worker Node for the HDFS NameNode.

Place this label on one worker node only. The worker node and the hostname or IP address in the HDFS NameNode field in the Intelligence tab of the OMT Management Portal must match.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
hdfs-namenode | Manages how the HDFS NameNode stores the location of all HDFS files distributed across the cluster. | arcsight-installer | Intelligence

## intelligence-spark:yes

Add the `intelligence-spark:yes` label to Worker Nodes where you want to run the Analytics services for the ArcSight Intelligence capability. For high availability, add this label to multiple worker nodes. To reduce network traffic, add the label to the same worker nodes where you placed the `intelligence-datanode:yes` label.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
Spark2 | Launches when users run the Intelligence Analytics feature. Spark2 generates multiple pods, changing the names of the pods according to the different phases of the analytics tasks. | arcsight-installer | Intelligence

## kafka:yes

Add the `kafka:yes` label to Worker Nodes where you want to run the Kafka Broker functions and services for the Transformation Hub capability.

Ensure that you assign this label to the same quantity of nodes that you specified for the `# of Kafka broker nodes in the Kafka cluster` setting in the OMT Management Portal > Configure/Deploy > Transformation Hub > Kafka and Zookeeper Configuration. The default number is 3.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
th-kafka | Manages the Kafka Broker, to which publishers and consumers connect so they can exhange messages over Kafka. NOTE: This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Transformation Hub

## th-platform:yes

Add the `th-platform:yes` label to Worker Nodes where you want to run the Kafka Manager, schema registry, and WebServices for the Transformation Hub capability. For high availability, add this label to multiple worker nodes.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
th-kafka-manager | Provides the user interface that allows the Kafka Manager to manage the Kafka Brokers. | arcsight-installer | Transformation Hub
th-schemaregistry | Provides the scheme registry that is used for managing the schema of data in Avro format. NOTE: This pod requires communication outside of the Kubernetes cluster. | arcsight-installer | Transformation Hub
th-web-service | Manages the WebServices module of Transformation Hub. WebServices provides the API that ArcMC uses to retrieve data. NOTE: This pod requires communication outside of the Kubernetes cluster to receive client requests from and initiate connections to ArcMC. | arcsight-installer | Transformation Hub

## th-processing:yes

Add the `th-processing:yes` label to Worker Nodes where you want to run services that manage processing for the Transformation Hub capability. For high availability, add this label to multiple worker nodes.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
th-c2av-processor | Manages the instances that convert CEF messages on the topic th-cef to Avro on the topic th-arcsight-avro. The quantity of instances depends on the number of partition in the th-cef topic and load. The default is 0 instances. | arcsight-installer | Transformation Hub
th-cth | Manages up to 50 instances of connectors in Transformation Hub that distribute the load of data received from collectors by creating a consumer group that is based on the source top and destination and topic names. | arcsight-installer | Transformation Hub
th-c2av-processor-esm | Manages the instances that convert CEF messages on the topic mf-event-cef-esm-filtered to Avro on the topic mf-event-avro-emsfiltered. The quantity of instances depends on the number of partition in the th-cef topic and load. The default is 0 instances. | arcsight-installer | Transformation Hub
th-routing-processor-group | Manages the routing rules for topics. Use ArcMC to configure the rules. | arcsight-installer | Transformation Hub

## zk:yes

Add the `th-zookeeper:yes` label to Worker Nodes where you want to Kafka Zookeeper for the Transformation Hub capability.

Ensure that you assign this label to the same quantity of nodes that you specified for the `# of Zookeeper nodes in the Zookeper cluster` setting in the OMT Management Portal > Configure/Deploy > Transformation Hub > Kafka and Zookeeper Configuration. The default number is 3.

Pod | Description | Namespace | Associated Capability
--- | --- | --- | ---
th-zookeeper | Manages Kafka Zookeeper, which stores metadata about partitions and brokers. | arcsight-installer | Transformation Hub

## Understanding the Pods that Do Not Have Labels

The Platform includes several pods that are not associated with a deployed capability and thus do not require a label. The installation process automatically creates these pods.

Pod | Description | Namespace
--- | --- | ---
autopass-lm | Manages the Autopass service, which tracks license keys. | arcsight-installer
itom-pg-backup | Performs backup of the PostgreSQL database. | arcsight-installer
suite-reconf-pod-arcsight-intaller | Manages the Reconfiguration features in the OMT Management Portal. | arcsight-installer

## Understanding Pods that Run Master Nodes

The Platform includes pods that run master nodes.

Pod | Description | Namespace
--- | --- | ---
itom-postgresql-default | Manages the PostgreSQL database, which stores information for SOAR, ArcMC, OMT status, and license keys. |
idm | Manages user authentication and authorization for the OMT Management Portal. | core
nginx-ingress-controller | Provides the proxy web server that end-users need to connect to the deployed capabilities. By default, server uses HTTPS and port 443. NOTE: This pod requires communication outside of the Kubernetes cluster. | arcsight-installer