Provisioning an instance

Provisioning methods

You can provision the service using one of the following methods:

• Private offer: A customer support representative provisions the subscription from the SSM UI. After successful provisioning, you will receive an email with a link to the SaaS console. From there, you can create an instance.
• Marketplace: You purchase the product directly from the Azure Marketplace. After the purchase, you are redirected to the SaaS console to continue setup.

Provisioning steps

Follow these steps to provision a new Db2® SaaS instance on Azure:

1. Navigate to https://azure.console.saas.ibm.com/landing

2. Click on the SaaS subscription you have access to.

3. Click View Instances.

   

4. Click Create Instance.

   

5. Specify the Control Plane region (default:westus)—do not modify this value. Then, enter a name for the Data Plane instance, and select the location where the Data Plane will be deployed and choose Db2 under the Db2 offerings. Then, click Create.

   

6. Wait for the status to change from Provisioning to Running, then click the Open button.

7. From the admin console, click Setup.

8. Input your Azure Tenant ID and Subscription ID, then click Approve Azure Consent to grant the necessary permissions.

9. Configure the network CIDR

   CIDR configuration is a required step during dataplane creation and must be completed successfully before you can proceed with deployment.

   The CIDR value defines the network address range that is used to automatically generate subnets required for dataplane deployment. A default value is provided, which you can modify if needed. The system validates the CIDR value and ensures that subnet ranges do not overlap.

   Before you begin:

   • You must have access to the BYOC console.
   • You should be familiar with CIDR notation (for example, 10.0.0.0/16).
   Note: For more information, see CIDR and subnet allocation for your dataplane.

   During dataplane creation, the system provides a default CIDR value. You can modify this value as required. The system validates the input and generates non-overlapping subnet ranges automatically.

   To configure the CIDR:

   • Locate the VNet CIDR field in the networking section.
   • Review the default CIDR value.
   • Optional: Enter a custom CIDR value.
   • Verify that no validation errors are displayed.
   • Click Initiate to continue.
   
   Note: The Initiate button is disabled until all validation checks are successful. Resolve any errors before proceeding.

   Result: The system automatically allocates subnet ranges within the provided CIDR. Required subnets are created without overlap, and deployment proceeds.

   Validation rules:

   • The CIDR must be a valid IPv4 CIDR (for example, 10.0.0.0/16).
   • The CIDR must represent a network address.
   • The CIDR must fall within the supported size range.
   • The CIDR must not overlap with reserved ranges (for example, 172.20.0.0/15).
   • The CIDR must allow sufficient address space.
   • The CIDR size must be between /22 (minimum) and /12 (maximum). These limits ensure that the network has enough address space for required subnets while preventing overly large or inefficient allocations.

   Troubleshooting:

   • Invalid CIDR format: Ensure correct format (for example, 10.0.0.0/16).
   • CIDR overlap: Use a non-overlapping range.
   • Unsupported CIDR size: Adjust the prefix length.

10. Optional: Configure a custom TLS certificate

    If you want to use your organization's TLS certificate instead of the default platform-generated certificate, configure a custom TLS certificate during dataplane setup.

    Before you begin:

    • The TLS certificate must be uploaded to an Azure Key Vault.
    • The certificate must be stored in PEM format.
    • The Azure Key Vault must belong to the same Azure subscription where the dataplane will be deployed.
    • You must have the Azure Key Vault Resource ID and Secret Name containing the TLS certificate.
    Note: For certificate requirements, Azure Key Vault setup, certificate import instructions, and certificate management procedures, see Configuring and managing custom TLS certificates

    To configure a custom TLS certificate:

    • In the Azure cloud configuration section, enable Use custom TLS certificate.
    • Specify the Key Vault Resource ID and Secret Name.
    • Verify that the values are valid.
    • Continue with the deployment process.
    Note: After the certificate information is successfully validated, the Deploy button becomes available.

    Result: During dataplane provisioning, the customer-managed TLS certificate is automatically retrieved from Azure Key Vault and configured for the deployed services.

    

11. In the Create Least Privilege Resources for Service Management section, click Deploy to open the Azure Portal and deploy the ARM template. Click the Review + Create button in Azure. Once reviewed, click Create.

    

    

    

12. Once the deployment is complete, click the Initiate button to start the dataplane provisioning process.

    

    

13. After provisioning completes, you will have the option to create an engine and configure your database with a name and preferred options. You need to pick the plan (the number of nodes) and the Block Storage size and deploy an Engine instance in the Data Plane.

    

    

    

Once the deployment is complete, clicking on the Engine will give you access to the Endpoints.

You can access the Engine or the Console from your Azure environment using either a Private Link or VNet peering, provided there are no CIDR range conflicts.