Enabling generative AI through the model gateway

# Set your namespace
export NAMESPACE=<your-cp4ba-namespace>

# Get the Service ID
kubectl get secret ai-gateway-credentials -n $NAMESPACE -o jsonpath='{.data.serviceId}' | base64 -d
echo

# Set your namespace
export NAMESPACE=<your-cp4ba-namespace>

# Get the API Key
kubectl get secret ai-gateway-api-key -n $NAMESPACE -o jsonpath='{.data.apiKey}' | base64 -d
echo

• Delete the secrets and let the operator recreate them:

  # Set your namespace
  export NAMESPACE=<your-cp4ba-namespace>
  
  # Delete both secrets
  kubectl delete secret ai-gateway-credentials -n $NAMESPACE
  kubectl delete secret ai-gateway-api-key -n $NAMESPACE
  

• The operator automatically:

  • Detects the missing secrets
  • Creates a new service ID in IAM/Zen.
  • Generates a new API key.
  • Recreates the secrets.
  • Updates all CP4BA components.
• Wait for reconciliation to complete (typically 1-5 minutes).
• Verify that the new secrets are created:

  kubectl get secrets -n $NAMESPACE | grep ai-gateway

1. Retrieve the required information:

   export NAMESPACE=<your-cp4ba-namespace>
   
   # Get the Service ID
   SERVICE_ID=$(kubectl get secret ai-gateway-credentials -n $NAMESPACE -o jsonpath='{.data.serviceId}' | base64 -d)
   echo "Service ID: $SERVICE_ID"
   
   # Get the Service ID secret (client secret)
   SERVICE_SECRET=$(kubectl get secret ai-gateway-credentials -n $NAMESPACE -o jsonpath='{.data.serviceSecret}' | base64 -d)
   
   # Get the common services namespace (where IAM is running)
   COMMON_SERVICES_NS=$(kubectl get pods --all-namespaces | grep platform-identity-provider | awk '{print $1}' | head -1)
   echo "Common Services Namespace: $COMMON_SERVICES_NS"
   

2. Get the IAM access token:

   # Get IAM token for the Service ID
   IAM_TOKEN_RESPONSE=$(curl -k -X POST \
     "https://platform-identity-provider.${COMMON_SERVICES_NS}.svc:4300/v1/auth/token" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=client_credentials&scope=openid&client_id=${SERVICE_ID}&client_secret=${SERVICE_SECRET}")
   
   # Extract access token
   IAM_ACCESS_TOKEN=$(echo $IAM_TOKEN_RESPONSE | jq -r '.access_token')
   
   if [ "$IAM_ACCESS_TOKEN" == "null" ] || [ -z "$IAM_ACCESS_TOKEN" ]; then
     echo "ERROR: Failed to get IAM access token"
     echo "Response: $IAM_TOKEN_RESPONSE"
     exit 1
   fi
   
   echo "IAM Access Token obtained successfully"
   

3. Exchange the IAM token for a Zen token:

   # Exchange IAM token with Zen token
   ZEN_TOKEN_RESPONSE=$(curl -k -X GET \
     "https://ibm-nginx-svc.${NAMESPACE}.svc/v1/preauth/validateAuth" \
     -H "username: ${SERVICE_ID}" \
     -H "iam-token: ${IAM_ACCESS_TOKEN}")
   
   # Extract Zen token
   ZEN_TOKEN=$(echo $ZEN_TOKEN_RESPONSE | jq -r '.accessToken')
   
   if [ "$ZEN_TOKEN" == "null" ] || [ -z "$ZEN_TOKEN" ]; then
     echo "ERROR: Failed to get Zen token"
     echo "Response: $ZEN_TOKEN_RESPONSE"
     exit 1
   fi
   
   echo "Zen Token obtained successfully"
   

4. Generate the new API key:

   # Generate new API key
   API_KEY_RESPONSE=$(curl -k -X POST \
     "https://usermgmt-svc.${NAMESPACE}.svc:3443/v1/user/apiKey" \
     -H "Authorization: Bearer ${ZEN_TOKEN}" \
     -H "username: ${SERVICE_ID}")
   
   # Extract the new API key
   NEW_API_KEY=$(echo $API_KEY_RESPONSE | jq -r '.apiKey')
   
   if [ "$NEW_API_KEY" == "null" ] || [ -z "$NEW_API_KEY" ]; then
     echo "ERROR: Failed to generate API key"
     echo "Response: $API_KEY_RESPONSE"
     exit 1
   fi
   
   echo "New API Key generated successfully"
   echo "API Key: $NEW_API_KEY"
   

5. Update the Kubernetes secret:

   # Update the secret with the new API key
   kubectl create secret generic ai-gateway-api-key \
     --from-literal=apiKey=$NEW_API_KEY \
     --dry-run=client -o yaml | kubectl apply -n $NAMESPACE -f -
   
   # Verify the secret was updated
   echo "Verifying secret update..."
   STORED_KEY=$(kubectl get secret ai-gateway-api-key -n $NAMESPACE -o jsonpath='{.data.apiKey}' | base64 -d)
   
   if [ "$STORED_KEY" == "$NEW_API_KEY" ]; then
     echo "✓ Secret updated successfully"
   else
     echo "✗ ERROR: Secret update failed"
     exit 1
   fi
   

6. Restart the operator:

   # Restart the CP4BA operator to trigger reconciliation
   kubectl delete pod -n $NAMESPACE -l name=ibm-cp4a-operator
   
   # Wait for operator to be ready
   kubectl wait --for=condition=ready pod -n $NAMESPACE -l name=ibm-cp4a-operator --timeout=120s
   
   echo "✓ Operator restarted successfully"
   
   # The operator will automatically update all component configurations
   

1. Check the operator logs: kubectl logs -n $NAMESPACE -l name=ibm-cp4a-operator
2. Review the CP4BA pod logs for authentication errors.