Online installation of Infrastructure Automation

1. Install and configure Red Hat OpenShift Container Platform

For more information about the supported OpenShift versions, see Supported Red Hat OpenShift Container Platform versions.

1. Install OpenShift by using the instructions in Installing Red Hat OpenShift Container Platform .

2. Install the OpenShift (oc) command-line interface (CLI) on your cluster's boot node by using the instructions in Getting started with the OpenShift CLI , and then run oc login.

3. Optionally configure a custom certificate for Infrastructure Automation to use. You can use either of the following methods:

   • Configure a custom certificate for the Red Hat OpenShift cluster. Follow the instructions in the Red Hat OpenShift documentation Replacing the default ingress certificate. Then, deploy the signing CA certificate into the cluster by following the instructions in the Red Hat OpenShift documentation Replacing the CA Bundle certificate.
   • If you would like to use a custom certificate for Infrastructure Automation only, then after installation is complete follow the instructions in Using a custom certificate.

2. Configure storage

You must configure your own storage for use with Infrastructure Automation. For more information, see Storage considerations.

3. Create a custom project (namespace)

Create a project (namespace) called cp4waiops for your Infrastructure Automation deployment, by running the following command:

oc create namespace cp4waiops

Infrastructure Automation does not support deploying into different namespaces within a cluster. It has to be the same namespace.

4. Create the catalog source

You must add the Infrastructure Automation catalog source to your OpenShift cluster.

1. Log in to your OpenShift cluster's console.

2. Add the IBM Operators CatalogSource.

   The ibm-operator-catalog CatalogSource object can be configured to automatically poll for a newer version, and to retrieve it if one is available. This triggers an automatic update of your Infrastructure Automation deployment. Polling for updates is enabled by configuring the polling attribute, spec.updateStrategy.registryPoll.

   Note: ibm-operator-catalog also contains the catalogs for other CloudPaks. If you have multiple CloudPaks installed on your cluster then an automatic update will be configured for all of them.

   Click the plus icon in the upper right corner to open the Import YAML dialog box, paste in one of the following codeblocks, and then click Create.

   If you do not want to enable automatic updates, use this YAML:

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: ibm-operator-catalog
     namespace: openshift-marketplace
   spec:
     displayName: ibm-operator-catalog
     publisher: IBM Content
     sourceType: grpc
     image: icr.io/cpopen/ibm-operator-catalog:latest
   

   If you want to enable automatic updates, use this YAML:

   apiVersion: operators.coreos.com/v1alpha1
   kind: CatalogSource
   metadata:
     name: ibm-operator-catalog
     namespace: openshift-marketplace
   spec:
     displayName: ibm-operator-catalog
     publisher: IBM Content
     sourceType: grpc
     image: icr.io/cpopen/ibm-operator-catalog:latest
     updateStrategy:
       registryPoll:
         interval: 45m
   

3. Go to Administration > Cluster Settings. Under Global Configuration > OperatorHub > Sources, verify that the ibm-operator-catalog CatalogSource object is present.

5. Create the entitlement key pull secret

1. Log in to MyIBM Container Software Library with the IBMid and password details that are associated with the entitled software.

2. In the Entitlement keys section, select Copy key to copy your entitlement key to the clipboard.

3. From the OpenShift CLI, run the following command:

   oc create secret docker-registry ibm-entitlement-key \
       --docker-username=cp\
       --docker-password=<entitlement-key> \
       --docker-server=cp.icr.io \
       --namespace=cp4waiops
   

   Where <entitlement-key> is the entitlement key that you copied in the previous step.

6. Install the Infrastructure Automation operator

Note: Both the operators iaf-core-operators and iaf-operators need to be pre-installed to prevent Cloud Pak for Watson AIOps from crashing. Install the Infrastructure Automation operator for a Power cluster.

For more information about operators, see Adding Operators to a cluster in the Red Hat OpenShift documentation.

1. Log in to your OpenShift cluster's console.

2. Click Operators > OperatorHub. The OperatorHub page is displayed.

3. In the All Items field, enter IBM Infrastructure Automation. The Infrastructure Automation operator is displayed.

4. Click the IBM Infrastructure Automation tile. The IBM Infrastructure Automation window is displayed.

5. Click Install. The Install Operator page is displayed.

6. Enter the following values:

   • Set the Namespace to be the project (namespace) in which to install the Operator, such as cp4waiops.
   • Set Update Channel to v4.1
   • Set Approval Strategy to Automatic.

7. Click Install and wait for the IBM Infrastructure Automation operator to install.

8. Verify that the IBM Infrastructure Automation is successfully installed.

Navigate to Operators > Installed Operators, and select your project from the Projects dropdown. IBM Infrastructure Automation and its dependent operators in the project are listed with a status of Succeeded.

After a few minutes, verify that the Infrastructure Automation operator is installed in the cp4waiops project (namespace) with the following command:

oc get pods -n cp4waiops | grep ibm-infrastructure-automation-operator-controller-manager

7. Install Infrastructure Automation

You can either create Infrastructure Automation custom resource with the default set of values that are provided by default or customize these value before you create Infrastructure Automation custom resource.

You would typically change the default value of Infrastructure Automation custom resource, if you plan to change one or more of the following for Managed services during installation of Managed services:

• Default pre-created secrets in Managed services
• DefaultManaged services proxy setting
• Default Managed services default github.com token to import templates
• Default HTTPS certificate for Managed services Management Console
• Configuring Managed services to set the SSH keys and known hosts in provider terraform pod
• Modify the default replica count of the pods in Managed services

cat << EOF | oc apply -f -
kind: IAConfig
apiVersion: aiops.ibm.com/v1alpha1
metadata:
  name: ibm-ia-installer
  namespace: cp4waiops
spec:
  imagePullSecret: ibm-entitlement-key
  infraAutoComposableComponents:
  - enabled: <Set to true to install Infrastructure Management component of Infrastructure Automation, false otherwise>
    name: ibm-management-im-install
    spec: {}
  - enabled: <Set to true to install Managed services component of Infrastructure Automation, false otherwise>
    name: ibm-management-cam-install
    spec:
      manageservice:
        <Set your custom installation parameter values>
  license:
  accept: <Set true to accept the license>
  storageClass: <Storage Class name that supports RWX>
  storageClassLargeBlock: <Select a storage class with a large block size (for example, 64k)>
EOF

cat << EOF | oc apply -f -
kind: IAConfig
apiVersion: aiops.ibm.com/v1alpha1
metadata:
  name: ibm-ia-installer
  namespace: cp4waiops
spec:
  imagePullSecret: ibm-entitlement-key
  infraAutoComposableComponents:
    - enabled: <set to true to install Infrastructure Management component of Infrastructure Automation, false otherwise>
      name: ibm-management-im-install
      spec: {}
    - enabled: <set to true to install Managed services component of Infrastructure Automation, false otherwise>
      name: ibm-management-cam-install
      spec: {}
  license:
    accept: <set true to accept the license>
  storageClass: <Storage Class name that supports RWX>
  storageClassLargeBlock: <Select a storage class with a large block size (for example, 64k)>
EOF

cat << EOF | oc apply -f -
kind: IAConfig
apiVersion: aiops.ibm.com/v1alpha1
metadata:
  name: ibm-ia-installer
  namespace: cp4waiops
spec:
  imagePullSecret: ibm-entitlement-key
  infraAutoComposableComponents:
    - enabled: <set to true to install Infrastructure Management component of Infrastructure Automation, false otherwise>
      name: ibm-management-im-install
      spec:
        iminstall:
          applicationDomain: <YOUR_IM_HTTPD_ROUTE>
          imagePullPolicy: Always
          imagePullSecret: ibm-entitlement-key
          initialAdminGroupName: <YOUR_LDAP_USER_GROUP>
          license:
            accept: true
    - enabled: <set to true to install Managed services component of Infrastructure Automation, false otherwise>
      name: ibm-management-cam-install
      spec: {}
  license:
    accept: <set true to accept the license>
  storageClass: <Storage Class name that supports RWX>
  storageClassLargeBlock: <Select a storage class with a large block size (for example, 64k)>
EOF

8. Verify the install

After a few minutes, run the following command to verify that your deployment is successful.

oc get iaconfigs.aiops.ibm.com -A

Example output:

NAME               PHASE        VERSION   STORAGECLASS   STORAGECLASSLARGEBLOCK   AGE
ibm-ia-installer   Installing   4.1.1     rook-cephfs    rook-ceph-block          8m44s

Note: The STORAGECLASSLARGEBLOCK will be blank if the environment is upgraded from a previous release.

There is no egress firewall policy defined when you install Infrastructure Automation, so outgoing traffic from workload pods to the internal and external network is unrestricted. There is a need to create an Egress network policy to make your environment more secure. Follow the steps here to create an EgressNetwork policy.

9. Check the deployed pods in the deployed namespace

oc -n cp4waiops get deploy | grep -E "cam|ibm-infra"

Example output:

cp4waiops     cam-iaas                                                    1/1     1            1           12h
cp4waiops     cam-install-operator-controller-manager                     1/1     1            1           12h
cp4waiops     cam-mongo                                                   1/1     1            1           12h
cp4waiops     cam-orchestration                                           1/1     1            1           12h
cp4waiops     cam-portal-ui                                               1/1     1            1           12h
cp4waiops     cam-provider-ansible                                        0/0     0            0           12h
cp4waiops     cam-provider-bpm                                            0/0     0            0           12h
cp4waiops     cam-provider-terraform-api                                  1/1     1            1           12h
cp4waiops     cam-provider-terraform-runtime                              0/0     0            0           12h
cp4waiops     cam-proxy                                                   1/1     1            1           12h
cp4waiops     cam-service-composer-api                                    1/1     1            1           12h
cp4waiops     cam-service-composer-ui                                     1/1     1            1           12h
cp4waiops     cam-service-library-ui                                      1/1     1            1           12h
cp4waiops     cam-service-library-ui-api                                  1/1     1            1           12h
cp4waiops     cam-tenant-api                                              1/1     1            1           12h
cp4waiops     cam-ui-basic                                                1/1     1            1           12h
cp4waiops     ibm-infra-management-install-operator                       1/1     1            1           12h

10. Log in to the Automation console

1. Find the password for the admin username by running the following command:

   oc -n ibm-common-services get secret platform-auth-idp-credentials -o jsonpath='{.data.admin_password}' | base64 -d
   

2. Find the URL to access the IBM Cloud Pak Automation console with the following command.

   oc get route -n cp4waiops cpd -o jsonpath={.spec.host}
   

   The following output is a sample output:

   cpd-cp4waiops.apps.mycluster.mydomain
   

   Based on the sample output, your console URL would be https://cpd-cp4waiops.apps.mycluster.mydomain

11. Assign user roles and permissions

When you install Infrastructure Automation and deploy Infrastructure management, you, or an administrator, must add the required Kubernetes permissions to user roles before your users can begin to access and use Infrastructure Automation tools, such as Managed services or the Service catalog. For instance, users that do not have an Administrator role are not able to use the Infrastructure management Managed services and Service Catalog or create user groups. For more information about how to add permissions to a role, see Managing roles for Infrastructure Automation.