Creating secrets to protect sensitive Db2 SSL configuration data

If you plan to use SSL for your Db2® database, create a secret manually to protect the certificate data for the database.

Before you begin

If you plan to use SSL for your Db2 database, create a secret manually to protect the certificate data for the database.

Procedure

Obtain the certificate file, tls.crt, from your database server.
Prepare your database_ssl_secret_name:
Using your values, run the following command:
```
kubectl create secret generic <db2 ssl secret name> --from-file=tls.crt="<crt file in local>" -n "{{ namespace }}"
```
The secret that you create, <db2 ssl secret name>, is the value for the parameter database_ssl_secret_name.
Note: In the <crt file in local> file, you can add multiple certificates like in the following example:
```
-----BEGIN CERTIFICATE-----
MIIGXTCCBU****
Kwa==
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIGX****
Kws==
-----END CERTIFICATE-----
```

What to do next

Use the name of your secret to create the configuration for an SSL database connection when you complete your CP4BA customer resource (CR) YAML file.

The following values specify the SSL database configuration and provide the name of the SSL secret that you created.

dc_ssl_enabled: true
database_ssl_secret_name: "<db ssl secret name>"

The data source in your CR for your IBM FileNet® Content Manager deployment looks like the following example.

datasource_configuration:
    dc_ssl_enabled: true
    dc_gcd_datasource:
      dc_database_type: "db2"
      ...
      database_ssl_secret_name: "ibm-db2-ssl-cert-secret"
    dc_os_datasources:
    - dc_database_type: "db2"
       ...
      database_ssl_secret_name: "ibm-db2-ssl-cert-secret"

If you have a db2HADR database type, then your CR looks like the following example.

datasource_configuration:
    dc_ssl_enabled: true
    dc_gcd_datasource:
      dc_database_type: "db2HADR"
      database_servername: "<Db2 Primary server>"
      database_port: "<Db2 Primary server port>"
      database_ssl_secret_name: "ibm-db2-ssl-cert-secret"
      ...
      dc_hadr_standby_servername: "<Db2 Standby server>"
      dc_hadr_standby_port: "<Db2 Standby server port>"
    dc_os_datasources:
    - dc_database_type: "db2HADR"
       ...
      database_servername: "<Db2 Primary server>"
      database_port: "<Db2 Primary server port>"
      database_ssl_secret_name: "ibm-db2-ssl-cert-secret"
      ...
      dc_hadr_standby_servername: "<Db2 Standby server>"
      dc_hadr_standby_port: "<Db2 Standby server port>"

Remember: Add the database username and password to the ibm-fncm-secret.