Installing operators

Install operators for API Connect, DataPower, and common services so that you can deploy API Connect subsystems across multiple namespaces on OpenShift. If deploying subsystems in different environments then the corresponding operator will need to be installed in each environment, for example the DataPower operator in your Gateway environment, and the API Connect operator in your Portal environment.

1. Obtain an entitlement key for the Entitled Registry:
   1. Log in to the IBM Container Library.
   2. In the Container software library, select Get entitlement key.
   3. After the Access your container software heading, click Copy key.
   4. Copy the key to a safe location.
2. Create a global pull secret:
   1. Open the OpenShift web console, click Workloads > Secrets.
   2. Select the project openshift-config.
   3. Select pull-secret from the secret list.
   4. Select Actions > Edit Secret > Add Credentials.
   5. Set Registry Server Address to cp.icr.io.
   6. Set Username to cp.
   7. Set Password to the entitlement key generated in Step 1.
   8. Click Save.
3. Add the IBM Operator Catalog source:
   1. In the OpenShift web console, and click + (in the page banner) to open the Import YAML dialog box.
   2. Paste the following resource definition into the dialog box:

      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        name: ibm-operator-catalog
        namespace: openshift-marketplace
      spec:
        displayName: "IBM Operator Catalog" 
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-operator-catalog
        updateStrategy:
          registryPoll:
            interval: 45m

   3. Click Create.
4. Create the apiconnect subscription.
   1. Create the apiconnect subscription with the appropriate channel by creating a file called apic-sub.yaml and pasting in the following contents:

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: ibm-apiconnect
        namespace: openshift-operators
      spec:
        channel: v3.8
        name: ibm-apiconnect
        source: ibm-operator-catalog
        sourceNamespace: openshift-marketplace

   2. Apply the subscription with the following command:

      oc apply -f apic-sub.yaml

   3. Select Operators > Installed Operators, and ensure that Project: All Projects is selected.

      If any operators such as ibm-apiconnect or ibm-cert-manager-operator show the status of "Upgrade available", approve the upgrade by completing the following steps:

      1. Click Upgrade available.
      2. Click Preview InstallPlan.
      3. Click Approve.
      4. Wait for the IBM API Connect and IBM DataPower Gateway operators to install.

      The IBM DataPower Gateway operator is a prerequisite to API Connect and must not be removed.

5. (10.0.5.3 and later) Create the ibm-common-services-operator subscription, if it does not already exist.

   This step only applies when you install version 10.0.5.3 or later. If you are installing an older version of API Connect, skip this step.

   1. Create a file called common-services-sub.yaml and paste in the following contents:

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
        name: ibm-common-service-operator
        namespace: openshift-operators
      spec:
        channel: <channel>
        name: ibm-common-service-operator
        source: ibm-operator-catalog
        sourceNamespace: openshift-marketplace

      Where <channel> is one of the following values:

      • v3.23 if you are using IBM Cloud Pak foundational services for CD (continuous delivery)
      • v3 if you are using IBM Cloud Pak foundational services for LTSR (long term service release)
   2. Apply the subscription with the following command:

      oc apply -f common-services-sub.yaml

   3. Select Operators > Installed Operators, and ensure that Project: All Projects is selected.

      If any operators such as ibm-apiconnect or ibm-cert-manager-operator show the status of "Upgrade available", approve the upgrade by completing the following steps:

      1. Click Upgrade available.
      2. Click Preview InstallPlan.
      3. Click Approve.
      4. Check the ibm-common-services namespace and ensure that all operators with a status of "Upgrade available" are approved.
      5. Wait for the IBM Cloud Pak foundational services, IBM NamespaceScope, and Operand Deployment Lifecycle Manager operators to install.
6. Create the namespaces for your API Connect subsystems either by selecting Project > Create Project in the UI, or with the command:

   oc create ns <APIC-namespace>

   Note: The following namespaces cannot be used to install API Connect subsystems because Red Hat OpenShift Container Platform (OCP) restricts the use of default namespaces for installing non-cluster services:

   • default
   • kube-system
   • kube-public
   • openshift-node
   • openshift-infra
   • openshift
7. (10.0.5.3 and later) Install cert manager:

   This step only applies when you install version 10.0.5.3 or later. If you are installing an older version of API Connect, skip this step.

   1. Create a file called cert-manager-operand-request.yaml and paste in the following content:

      apiVersion: operator.ibm.com/v1alpha1
      kind: OperandRequest
      metadata:
        name: ibm-apiconnect-cert-manager
        namespace: <namespace>
      spec:
        requests:
        - operands:
          - name: ibm-cert-manager-operator
          registry: common-service
          registryNamespace: ibm-common-services

   2. Create the operandRequest for cert-manager by running the following command:

      oc apply -f cert-manager-operand-request.yaml

   3. Select Operators > Installed Operators, and ensure that Project: All Projects is selected.

      Wait for the ibm-cert-manager-operator to display and if it shows the status of "Upgrade available", approve the upgrade by completing the following steps:

      1. Click Upgrade available.
      2. Click Preview InstallPlan.
      3. Click Approve.
      4. Wait for the IBM Cert Manager operator to install.