Setting up the cluster in the OpenShift console

You can install the IBM Business Automation Insights operators with the IBM catalogs in the Red Hat OpenShift console. By configuring a namespace-scoped Cloud Pak foundational services for your IBM Business Automation Insights deployment, you can install multiple IBM Business Automation Insights instances in the same cluster each with their own foundational services.

Attention: Deployment using the OpenShift Console is not supported on the CNCF platforms Rancher, Tanzu, and GKE.

About this task

IBM provides operators to OpenShift in the form of a catalog. A catalog is added to an OpenShift cluster by using a CatalogSource resource. After you apply a CatalogSource resource, the IBM catalog appears in the OCP OperatorHub under All items > Business Automation.

Procedure

Log in to your OCP or ROKS cluster as a cluster administrator.
To allow a non-administrator user to create the Cloud Pak operators, you must create an OperatorGroup.
1. As a cluster administrator, grant administrator ClusterRoleBinding with administrator ClusterRole to the non-administrator user:
```
oc create clusterrolebinding <binding-name> --clusterrole=admin --user=<username>
```
  Where <username> is the non-administrator user and <binding-name> is the ClusterRoleBinding name.
2. Create a ClusterRoleBinding with "aggregate-olm-view" ClusterRole for the user:
```
oc create clusterrolebinding user-aggregate-olm-view --clusterrole=aggregate-olm-view --user=<username>
```
3. The cluster administrator then creates an OperatorGroup in the namespace where the non-administrator user is going to deploy the operators.
  The following operator-group.yaml file assigns spec.targetNamespaces to match the target namespace.
```
apiVersion: operators.coreos.com/v1alpha2
kind: OperatorGroup
metadata:
  name: my-user-operatorgroup  
  namespace: bai-project
spec:  
  targetNamespaces:  
  - bai-project
```
  Where bai-project is the namespace that you created for the BAI deployment.
4. Apply the OperatorGroup by running the following command:
```
oc create -n bai-project -f operator-group.yaml
```
Create two new projects in the OCP console. One project for the Certificate Manager catalog (ibm-cert-manager) and one project the License Manager catalog (ibm-licensing).

Add the CatalogSource resources to Operator Hub for the versions that you want to install. Each interim fix has a specific version and unique digest, which are needed for the new catalog sources.

To import the YAML into your cluster in the OCP Admin console:

Click the plus icon at the top of the console. The Import YAML editor opens.
You can import the entire catalog source YAML into the editor from the corresponding catalog_source.yaml file, and click Create. You can also paste the individual CatalogSource resource definitions one-by-one into the editor.

Note: You can find the CatalogSource YAML in the catalog_source.yaml file, which is located in the CASE package in the ../cert-kubernetes-bai/descriptors/op-olm directory.
For more information about downloading cert-kubernetes-bai, see Preparing a client to connect to the cluster.

The following example of the catalog sources does not show the real digests for 26.0.0 and its corresponding dependencies. The example does show the names and the number and version of the catalog sources that you need to create for each new installation that you want to use. Replace XXXXXXXXXXXX with the digest for each catalog source and replace the <namespace> placeholder with openshift-marketplace for the global catalog namespace (GCN) or your target BAI namespace (bai-project) for a private catalog.

For the Certificate Manager and License Manager catalogs change the namespace to a global catalog openshift-marketplace or leave the defaults for separate private catalogs.

# BAI Catalog 26.0.0 
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-bai-operator-catalog
  namespace: <namespace>
spec:
  displayName: ibm-bai-operator
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-bai-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM Cloud Foundational Services 4.18.1
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cs-install-catalog-v4-19-0
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM CS Install Operators
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-cs-install-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Business Teams Service Catalog 3.35.10
 apiVersion: operators.coreos.com/v1alpha1
 kind: CatalogSource
 metadata:
  annotations:
    bedrock_catalogsource_priority: '1'
  name: bts-operator
  namespace: <namespace>
 spec:
  displayName: BTS Operator
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-bts-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM CS Flink Operator Catalog 1.20.2 (2.0.19)
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-opencontent-flink
  namespace: <namespace>
spec:
  displayName: IBM CS Opencontent Flink Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-opencontent-flink-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM CS Opensearch Operator Catalog 1.4.3
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cs-opensearch-catalog
  namespace: <namespace>
spec:
  displayName: IBM CS Opencontent Opensearch Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/opencontent-elasticsearch-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Certificate Manager 4.2.22
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cert-manager-catalog
  namespace: <namespace>
spec:
  displayName: ibm-cert-manager-4.2.4
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-cert-manager-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM Licensing Catalog 4.2.23
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-licensing-catalog
  namespace: <namespace>
spec:
  displayName: ibm-licensing-4.2.4
  publisher: IBM
  image: icr.io/cpopen/ibm-licensing-catalog@sha256:XXXXXXXXXXXX
  sourceType: grpc
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM CS IM Operator Catalog 4.17.1
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-iam-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM IAM Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-iam-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Zen Operator Catalog 6.4.7
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-zen-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM Zen Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Events Operator Catalog 5.2.1
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-events-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM Events Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-events-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Usage Metering Catalog 1.0.6
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-usage-metering-catalog
  namespace: openshift-marketplace
spec:
  displayName: ibm-usage-metering-1.0.6
  publisher: IBM   
  image: icr.io/cpopen/ibm-usage-metering-operator-catalog@sha256:XXXXXXXXXXXX   
  sourceType: grpc
  grpcPodConfig:
    securityContextConfig: restricted

Install the IBM Certificate Manager and IBM License Service operators.
- Option 1: Install IBM Certificate Manager and IBM License Service operators from the OperatorHub in the OCP console.
  1. In the All Items field, enter IBM Cert Manager. The IBM Cert Manager catalog is displayed.
  2. Click the IBM Cert Manager tile. The IBM Cert Manager window is displayed.
  3. Click Install. The Install Operator page is displayed.
  4. Set the Update Channel to v4.2.
  5. Set the Installation Mode to All namespaces on the cluster (default).
  6. Set the Update approval to Automatic.
  7. Click Install.
  8. In the All Items field, enter IBM Licensing. The IBM Licensing catalog is displayed.
  9. Click the IBM Licensing tile. The IBM Licensing window is displayed.
  10. Click Install. The Install Operator page is displayed.
  11. Set the Update Channel to v4.2.
  12. Set the Installation Mode to All namespaces on the cluster (default).
  13. Set the Update approval to Automatic.
  14. Click Install.
- Option 2: Install the IBM Certificate Manager and IBM License Service operators by running a script.
  1. Go to your downloaded cert-kubernetes-bai folder.
```
cd cert-kubernetes-bai/scripts/cpfs/installer_scripts/cp3pt0-deployment
```
  2. Log in to the target cluster from a client.
```
oc login https://<CLUSTERIP>:<port> -u <ADMINISTRATOR>
```
  3. Run the following command if you changed the private catalog for the GCN:
```
./setup_singleton.sh --enable-licensing \ 
-cmNs ibm-cert-manager -licensingNs ibm-licensing -c v4.2 \
--license-accept
```
    Run the following command if you used the default for a private catalog:
```
./setup_singleton.sh --enable-licensing \
--enable-private-catalog \
-cmNs ibm-cert-manager -licensingNs ibm-licensing -c v4.2 \
--license-accept
```

Create IBM Licensing Service Secret

Convert the token to the Base64 format. You can do this by using the following Bash command.
```
export TOKEN="<token>"
 printf %s "$TOKEN" | base64 | tr -d '\n'
```
Open the ibm-licensing namespace.
Go to Workloads > Secrets.

Edit the following YAML example to be in line with your environment.

 kind: Secret
 apiVersion: v1
 metadata:
   name: <name>
 data:
   token: <IBM entitlement key>
 type: Opaque

Where:
name is the name of your choice.
token is the IBM entitlement key in the Base64 format from previous command

Apply the yaml.

Either an admin user or a non-admin user can now login to the OpenShift console, click Operators to open the OperatorHub, and then enter bai in the Filter by keyword box under All items.
Click the IBM Business Automation Insights (BAI) (ibm-bai-insights-engine-operator) catalog item, and click Install.
1. In the Create Operator Subscription wizard, select the channel (v23.2 for 24.1).
  If you set any subscriptions to manual, then you must approve any pending operator updates. It is not recommended to set subscriptions to manual because it can make the installation error prone when some of the dependency operators are not approved. By default, all subscriptions are set to automatic.
  Tip: Subscriptions for the Cloud Pak foundational services operators are created when they are "needed". Some subscriptions are created during the installation of the operators. If other subscriptions are needed, they are created during the installation of the BAI deployment. Business Teams Service, for example, is installed only "if it is needed". To check for subscriptions that are waiting for approval, get the install plans by running the following command.
```
oc get installPlan
```
2. The default mode is All namespaces on the cluster, but choose A specific namespace on the cluster under Installation Mode and select a namespace from the Installed Namespace menu to install in a single or the operator's own namespace.
  Attention: All namespaces is not recommended by IBM for new installations. If you do want to install in the All namespaces mode, create the "ibm-common-services" namespace for Cloud Pak foundational services and then make sure that the ibm-cp4ba-common-config ConfigMap is created with below values.
```
kind: ConfigMap
apiVersion: v1
metadata:
  name: ibm-cp4ba-common-config
  namespace: <namespace>
data:
  operators_namespace: "openshift-operators"
  services_namespace: "ibm-common-services"
```
  Select the <NAMESPACE> that you created and prepared for the operator (bai-project). For more information, see Preparing a namespace for the operator.
  
  Important: Before you install the operators, check for existing installations of the IBM Business Automation Insights operators. If there are existing operators installed in the openshift-operators namespace, then you must continue to use the All namespaces on the cluster option. If there are existing operators that are installed in specific namespaces but not in the openshift-operators namespace, then you must continue to use the A specific namespace on the cluster option.
  The oc get csv -A command shows all the operator installations.
3. Click Install.
4. In the Installed Operators view, verify the status of the IBM Business Automation Insights installation.
Verify the IBM Business Automation Insights operators successfully installed and all the pods are running.
1. On the left panel in the OpenShift console, click Workloads > Pods, and switch to the project where you installed the operator.
2. On the left panel, click Operators > Installed Operators.
3. Make sure that all the following operators have the status "Succeeded" in your selected <NAMESPACE>.
  Note: The version number (26.0.0) shown below the installed operators corresponds to the channel for IBM Business Automation Insights 26.0.0.
  
  The OLM is now aware of the operators. A ClusterServiceVersion (CSV) for the operators appear in the target namespace, and APIs provided by the operators are available to use.
Tip: If the IBM Business Automation Insights operator is inactive for some time, you can delete the operator pod and force it to reconcile.
Deploy the IBM Usage Metering Service operator, by and
1. Go to Operator Hub > Installed Operators.
2. Search for IBM Usage Metering.
3. Install IBM Usage Metering in your target namespace. For example, bai-project.
Once the subscription is created, you must apply UMS static CR's from <cert-kubernetes-bai>/descriptors/patterns/bais-metrics
Before you apply, make sure to update <REPLACE_NAMESPACE> with BAI namespace.
Create the UMS secret with IBM Entitlement Key from MyIBM Container Software Library.
1. Convert the IBM entitlement key to the Base64 format:
```
 export TOKEN=<entitlement key>
 printf %s "$TOKEN" | base64 | tr -d '\n'
```
2. Create a secret.
  1. Go to BAI Project namespace
  2. Go to Workloads > Secrets.
  3. Expand the Create menu, and select From YAML.
  4. Paste the edited YAML example, and click Create.
```
 kind: Secret
 apiVersion: v1
 metadata:
   name: <name>
 data:
   token: <IBM entitlement key>
 type: Opaque

Where:name is the name of your choice.
token is the IBM entitlement key in the Base64 format.
```

Apply Software Central Connection CR using this from <cert-kubernetes-bai>/descriptors/patterns/bais-metrics/software-central-connection.

Modify bais_swc_connection.yaml with <REPLACE_NAMESPACE> with your <BAI Project> &
<REPLACE_SECRET_NAME> with <Secret Name from Step 9>

oc apply -f bais_swc_connection.yaml

Create ibm-cp4ba-common-config ConfigMap in bai-project namespace

kind: ConfigMap
apiVersion: v1
metadata:
  name: ibm-cp4ba-common-config
  namespace: <namespace>
data:
  operators_namespace: "<operator-namespace>"
  services_namespace: "<service-namespace>"

What to do next

You can monitor the operator logs with the following commands. Where the <NAMESPACE> is the project (bai-project) that you created and prepared for the operator. For an all namespaces installation, the namespace is always openshift-operators.

oc project <NAMESPACE>
oc logs -f deployment/ibm-bai-insights-engine-operator -c operator

Grant permissions to non-admin user to create a BAI deployment

If you want to allow a non-admin user to create a BAI deployment, then you can get the role and cluster role names of the operator to give access to a specified user. To get the names after the operator is deployed successfully, use the following command.

oc get role | grep ibm-bai-insights-engine-operator | sort -t"t" -k1r | awk 'NR==1{print $1}'

Run the following commands for each specified user that you want to give permission to create a BAI deployment.

oc project <NAMESPACE>
oc adm policy add-role-to-user edit <user_name> 
oc adm policy add-role-to-user registry-editor <user_name>
oc adm policy add-role-to-user <role_name> <user_name> 
oc adm policy add-cluster-role-to-user insightsengines.bai.ibm.com-v1-crdview <user_name>

Where <role_name> is the name of the role that you got from running the oc get command, and the <NAMESPACE> is the project (bai-project) that you created and prepared for the BAI deployment.

You can see the list of operators that are installed in your cluster on the Operators > Installed Operators page. For more information about foundational services, see IBM Cloud Pak foundational services.

To verify the foundational services installation, check whether all the pods in the namespace that is used for the BAI deployment are running. Use the following command:

oc get pods -n <namespace>

You can also use the following command to verify whether the services are successfully installed:

oc -n <namespace> get csv

Continue to prepare everything that you need for each capability that you want to install in Preparing your chosen capabilities.