Integrating with Cloud Platform Common Services

What are common services?

The common services help you manage and administer IBM software on your cluster. For example, the Cloud Platform Common Services include services such as the License Service and the Identity and Access Management Service.

A common service is installed once and is used by any applications that can integrate with the service. For example, you install IBM Cloud Pak for Data and another IBM Cloud Pak on your Red Hat OpenShift cluster. If both platforms support the License Service, you can install one instance of the License Service and both platforms will use that instance of the License Service.

Supported common services

Installing the common services

Cloud Pak for Data includes entitlement to the Cloud Platform Common Services.

Follow the appropriate documentation for installing the common services on your Red Hat OpenShift cluster:

Registering Cloud Pak for Data with the IAM Service

By default, Cloud Pak for Data is configured to use its own user management service. If you installed the IAM Service on your cluster and you want to use the IAM Service for authentication, you must register Cloud Pak for Data with the IAM Service.

Cloud Pak for Data uses a custom resource definition (CRD) for OpenID Connect (OIDC) registration as described in Automated client registration method 3 in the IAM Service documentation.

Procedure

To register Cloud Pak for Data with the IAM Service:

1. Log in to your Red Hat OpenShift cluster as a project administrator:

   oc login OpenShift_URL:port

2. Create a custom resource definition YAML file for Cloud Pak for Data. Name the file cpd-oidc-client.yaml:

   apiVersion: oidc.security.ibm.com/v1
   kind: Client
   metadata:
     name: cpd-client
     namespace: common-services-project
   spec:
     secret: cpd-oidcclient-secret
     oidcLibertyClient:
       post_logout_redirect_uris:
       - https://Cloud-Pak-for-Data-route/auth/doLogout
       redirect_uris:
       - https://Cloud-Pak-for-Data-route/auth/login/oidc/callback    
       trusted_uri_prefixes:
       - https://Cloud-Pak-for-Data-route

   Replace the following values:

   Variable	Replace with
   common-services-project	The Red Hat OpenShift project where the common services are deployed.
   Cloud-Pak-for-Data-route	The route to your Cloud Pak for Data deployment.

3. Create the custom resource definition file:

   oc create -f cpd-oidc-client.yaml

4. Confirm that Cloud Pak for Data was successfully registered with the IAM Service:

   oc get Client cpd-client -n common-services-project

   Replace the common-services-project variable with the same value you specified in the YAML file.

After you register Cloud Pak for Data with the IAM Service, you must configure Cloud Pak for Data to use the IAM Service instead of the default user management service.

Configuring Cloud Pak for Data to use the IAM Service

After you register Cloud Pak for Data with the IAM Service, you must create a file called Cloud Pak for Data oidcConfig.json and disable the Cloud Pak for Data user management service.

Before you begin

oc -n common-services-project get route cp-console -o yaml

oc extract secret/cpd-oidcclient-secret -n common-services-project --to=-

Procedure

1. If you configured the IAM Service to use authentication certificates:
   1. Extract the IAM Service certificate files by running the following command:

      oc extract secret/platform-auth-secret -n common-services-project --to=-

      Replace common-services-project with the Red Hat OpenShift project where the common services are deployed.

   2. Import the ca.crt file to Cloud Pak for Data by running the following command:

      oc cp ca.crt $(oc get pod -n Project_name -l component=usermgmt | tail -1 | cut -f1 -d\ ):/user-home/_global_/config/oidc/

      Replace Project_name with the Red Hat OpenShift project where Cloud Pak for Data is deployed.

   3. Import the tls.crt file to Cloud Pak for Data by running the following command:

      oc cp tls.crt $(oc get pod -n Project_name -l component=usermgmt | tail -1 | cut -f1 -d\ ):/user-home/_global_/config/oidc/

      Replace Project_name with the Red Hat OpenShift project where Cloud Pak for Data is deployed.

2. Create the oidcConfig.json file. Specify the appropriate values for your environment:

   {
     "issuer": "my_issuer_value",
     "authorizationUrl": "my_authorizationURL_value",
     "tokenUrl": "my_tokenUrl_value",
     "clientID": "my_clientID_value",
     "clientSecret": "my_clientSecret_value",
     "callbackUrl": "my_callbackUrl_value",
     "fieldToAuthenticate": "id",
     "addCACert": true,
     "CACertPathList":
       [
         "/user-home/_global_/config/oidc/ca.crt",
         "/user-home/_global_/config/oidc/tls.crt"
       ]
   }

   Remember: If you did not configure the IAM Service to use authentication certificates, set addCACert to false and remove the CACertPathList parameter.
3. Import the oidcConfig.json file to Cloud Pak for Data:

   oc cp oidcConfig.json $(oc get pod -n Project_name -l component=usermgmt | tail -1 | cut -f1 -d\ ):/user-home/_global_/config/oidc/

   Replace Project_name with the Red Hat OpenShift project where Cloud Pak for Data is deployed.

4. Run the following command to delete the Cloud Pak for Data usermgmt pods:

   oc delete pods -l component=usermgmt

Accessing the common services