Installing a CP4BA Workflow Process Service Runtime production deployment

Workflow Process Service is a small-footprint business automation environment for testing and running workflow processes that coordinate manual tasks and services. You can install Workflow Process Service Runtime or Workflow Process Service Authoring on Red Hat® OpenShift® Container Platform. The steps include the process to prepare, deploy, and configure Workflow Process Service.

To install Workflow Process Service Authoring, you have two options:
To install Workflow Process Service Runtime on Kubernetes, complete the following steps. The steps include the process to prepare, deploy, and configure a Workflow Process Service Runtime server.

If you run into issues while installing Workflow Process Service Runtime, see Troubleshooting Workflow Process Service.

If you are upgrading, see Upgrading Workflow Process Service Runtime deployments.

Preparing for a Workflow Process Service Runtime deployment

Workflow Process Service Runtime requires an IBM Cloud Pak for Business Automation installation, and integrates with components in Cloud Pak for Business Automation.

  1. Make sure that you have the resources you need for your deployment. See Planning for Workflow Process Service.
  2. Plan and prepare your deployment on your cluster by completing the steps in Preparing for a production deployment.

Deploying required Workflow Process Service Runtime components

To install Workflow Process Service Runtime, you must use the Cloud Pak for Business Automation operator to configure Resource Registry and root Certificate Authority (CA).

If you already installed one of the Cloud Pak for Business Automation deployment patterns (following the steps in Creating a production deployment), validate your deployment to make sure it includes the following configurations.

  1. If your cluster does not support dynamic provisioning, create your persistent volume (PV) manually for your IBM Resource Registry component by completing the steps in Optional: Implementing storage.

    If your cluster has dynamic storage provisioning that is enabled, create the following .yaml file, and fill in the values of sc_slow_file_storage_classname, sc_medium_file_storage_classname, and sc_fast_file_storage_classname. 
    apiVersion: icp4a.ibm.com/v1
kind: ICP4ACluster
metadata:
   name: icp4adeploy
   labels:
     app.kubernetes.io/instance: ibm-dba
     app.kubernetes.io/managed-by: ibm-dba
     app.kubernetes.io/name: ibm-dba
     release: 25.0.0
spec:
   appVersion: 25.0.0
   ibm_license: "accept"
   shared_configuration:
     ## Use this parameter to specify the license for the IBM Cloud Pak for Business Automation deployment for the rest of the Cloud Pak for Business Automation components.
     ## This value could differ from the rest of the licenses.
     sc_deployment_license: production
     sc_deployment_type: production
     ## The user script will populate these three (3) parameters based on your input for "production" deployment.
     ## If you manually deploying without using the user script, then you need to provide the different storage classes for the slow, medium, and fast storage parameters below.
     ## If you only have 1 storage class defined, then you can use that storage class for all 3 parameters.
     ## sc_block_storage_classname is for Zen, Zen requires/recommends block storage (RWO) for metastoreDB
     storage_configuration:
       sc_slow_file_storage_classname: "<Required>"
       sc_medium_file_storage_classname: "<Required>"
       sc_fast_file_storage_classname: "<Required>"
       sc_block_storage_classname: "<Required>"
     sc_deployment_platform: OCP
   ## this field is required to deploy Resource Registry (RR)
   resource_registry_configuration:
     replica_size: 1
  2. If you want to configure one or more LDAP configurations, use the ldap_configuration parameter in the icp4acluster CR. For more information about LDAP configuration, see LDAP configuration. You can also configure LDAP in post-deployment by using the Common UI console.
  3. If you made changes, wait a few minutes, then run the command oc get icp4acluster -o yaml to make sure that the root certificate authority and Resource Registry are ready. Make sure that .status.components.prereq.rootCAStatus is Ready and .status.components.prereq.rootCASecretName is filled with the correct secret name. Make sure that .status.endpoints["Resource Registry"] appears in the endpoints list. For example: 
    status:
    components:
      ...
      prereq:
        conditions: []
        rootCASecretName: icp4adeploy-root-ca
        rootCAStatus: Ready
      resource-registry:
        rrAdminSecret: icp4adeploy-rr-admin-secret
        rrCluster: Ready
        rrService: Ready
      ...
    endpoints:
    - name: Resource Registry
      scope: Internal
      type: gRPC
      uri: icp4adeploy-dba-rr-client:2379
  4. Make sure that Zen and Resource Registry pods are listed in the oc get pod command result. For example: 
    NAME                                                             READY   STATUS      RESTARTS        AGE
01b20e7d07a23fdc5fc5daffd3d3a01b67ae9f2f3f0177c5aa7e99a1b176x5l   0/1     Completed   0               9d
10f7349b6d490b712d6e54b22c31ce892381d204f7418a1f46442a58f92fdqh   0/1     Completed   0               9d
1f49b1adb4ec963b0360c79237f45ab7c9b2ceb6d9085d888f6da0e1d1vf7rw   0/1     Completed   0               9d
233900532d458faae6f637b54f920859c860cd3677394fd06d4753b0976f9ls   0/1     Completed   0               9d
26ec29312051b5bdbc8d356c36508f9f8d45e448388e0cf4e2d53e310dpnknr   0/1     Completed   0               9d
32ce47ba45b048f042cf1d5f5cf678cc3436a2a76a1023a88e3da63e49r96xc   0/1     Completed   0               9d
54832581e5a562f16b2b34bcbd55fc3c76189c80c4a7ec41a1be9f8279ctpmn   0/1     Completed   0               9d
6a45818f06cf7d9e6b04574bf439f0e95d448300f396c9795a8dff3fa9ltlhf   0/1     Completed   0               9d
7982bb49dbfe94248a8328ff9dfbbe84e5bc527764c17e3f0704e5eecczvwh6   0/1     Completed   0               9d
7cef7438bdb68f037d72351e5494ea2749af976ca9c33bcb0b1df94bc96smk8   0/1     Completed   0               9d
878dafdf528656ab8f8f43d0be4e116b94bec9201ff582575a0a4e3ba8lbrhs   0/1     Completed   0               9d
90bb458296ae89a3200173317fb6a219ac899cd35a9f1a0d3a65bfbf2a9gs4m   0/1     Completed   0               9d
96bf47f180216abbeeb3a0b4757ef6abda50d874c9f439419140e056efvssct   0/1     Completed   0               9d
b047dc22fdfaaf0528c2f92c4fd2ea6b9684a5e2a1a10ce3f588d262abc4knf   0/1     Completed   0               9d
b19be3f0da08098d4149646967f05fe753260ae9bc60796f76ba54239c97ncm   0/1     Completed   0               9d
c904e2eec7c1d7c8156b1dc44edd36345b27eaae25fde1124e4780d885qqnj5   0/1     Completed   0               9d
cloud-native-postgresql-catalog-8mz7g                             1/1     Running     0               9d
common-service-db-1                                               1/1     Running     0               9d
common-service-db-2                                               1/1     Running     3 (2d1h ago)    9d
common-web-ui-54dfd5bc4c-4fkxh                                    1/1     Running     0               9d
create-postgres-license-config-jfprc                              0/1     Completed   0               9d
create-secrets-job-9rv2h                                          0/1     Completed   0               9d
d293451c834b2457665945595765021331ebfb61f8c78373b0d7e4646446jss   0/1     Completed   0               9d
d4e56d959a1c411da8e52fce1f0a81058dcf63dd96eaf13cc3bf9053bfjxb9x   0/1     Completed   0               9d
e640ffca4b8e31cbca32d081786200a9f56f7649d051bde8939531d299tr6nc   0/1     Completed   0               9d
fa3692f7e51b2788a1825b587f34716dc555317af6908c80a40faff9a4mpsmn   0/1     Completed   0               9d
flink-kubernetes-operator-769bb559cb-dfz9l                        2/2     Running     0               9d
iaf-system-entity-operator-6979d5ffb-lnxt2                        2/2     Running     0               9d
iaf-system-kafka-0                                                1/1     Running     0               9d
iaf-system-zookeeper-0                                            1/1     Running     0               9d
iam-config-job-66cnh                                              0/1     Completed   0               9d
ibm-ads-operator-865d866457-kct7v                                 1/1     Running     2 (22h ago)     9d
ibm-bts-cnpg-a1-cp4ba-bts-1                                       1/1     Running     1 (2d15h ago)   9d
ibm-bts-cnpg-a1-cp4ba-bts-2                                       1/1     Running     1 (2d1h ago)    9d
ibm-bts-cp4ba-bts-316-deployment-7d58bdccb6-xdbf8                 1/1     Running     0               9d
ibm-bts-cp4ba-bts-316-deployment-7d58bdccb6-xqlqg                 1/1     Running     1 (7d22h ago)   9d
ibm-bts-operator-catalog-v3-35-78rbs                              1/1     Running     0               9d
ibm-bts-operator-controller-manager-55cfbc78c7-7h276              1/1     Running     2 (22h ago)     9d
ibm-common-service-operator-7b85f4f7c5-c975s                      1/1     Running     0               9d
ibm-commonui-operator-684c8b9986-qqgw4                            1/1     Running     0               9d
ibm-content-operator-68774b947-kmhcs                              1/1     Running     0               9d
ibm-cp4a-operator-5d686d5cc6-dh9qf                                1/1     Running     0               9d
ibm-cp4a-operator-catalog-74t84                                   1/1     Running     0               9d
ibm-cp4a-wfps-operator-56cc557d5c-5bpqg                           1/1     Running     0               9d
ibm-cs-install-catalog-v4-12-0-fx8wh                              1/1     Running     0               9d
ibm-dpe-operator-8679658b8c-hgcpq                                 1/1     Running     0               9d
ibm-events-operator-catalog-v5-1-0-m42nm                          1/1     Running     0               9d
ibm-events-operator-v5.1.2-5f64978fcb-shtvw                       1/1     Running     0               9d
ibm-fncm-operator-catalog-5k2fx                                   1/1     Running     0               9d
ibm-iam-operator-5898599478-cjvzx                                 1/1     Running     0               9d
ibm-iam-operator-catalog-4-11-0-5b778                             1/1     Running     0               9d
ibm-insights-engine-operator-7f4f96cdc8-zvlmd                     1/1     Running     0               9d
ibm-nginx-7d7cf57b64-fxnbf                                        2/2     Running     0               9d
ibm-nginx-tester-748477db7d-vxkb4                                 2/2     Running     0               9d
ibm-odm-operator-79fc7754f9-xmplh                                 1/1     Running     1 (22h ago)     9d
ibm-opencontent-flink-j65gp                                       1/1     Running     0               9d
ibm-opensearch-operator-catalog-sjlzf                             1/1     Running     0               9d
ibm-opensearch-operator-controller-manager-5f455f5966-5kc4c       1/1     Running     1 (22h ago)     9d
ibm-pfs-operator-b4fc4d7c9-5z8vf                                  1/1     Running     1 (22h ago)     9d
ibm-workflow-operator-794bcbfbd9-569qb                            1/1     Running     1 (22h ago)     9d
ibm-zen-operator-8dbb57fb4-gpkw9                                  1/1     Running     0               9d
ibm-zen-operator-catalog-6-1-0-wxlq7                              1/1     Running     0               9d
icp4a-foundation-operator-5b854f6bc5-v9s4z                        1/1     Running     0               9d
icp4adeploy-bai-bpmn-7hp7f                                        0/1     Completed   0               9d
icp4adeploy-bai-setup-nbjqn                                       0/1     Completed   0               9d
icp4adeploy-bastudio-bootstrap-978c5                              0/1     Completed   0               9d
icp4adeploy-bastudio-deployment-0                                 1/1     Running     0               9d
icp4adeploy-bastudio-ltpa-8pvv4                                   0/1     Completed   0               9d
icp4adeploy-bastudio-zen-translation-xsvtt                        0/1     Completed   0               9d
icp4adeploy-insights-engine-application-setup-qc586               0/1     Completed   0               9d
icp4adeploy-insights-engine-cockpit-64d445d9b5-k5sll              1/1     Running     0               9d
icp4adeploy-insights-engine-flink-7b48bcd9ff-5hfpn                2/2     Running     0               9d
icp4adeploy-insights-engine-flink-taskmanager-59bbf99c8b-w2bmq    1/1     Running     0               9d
icp4adeploy-insights-engine-management-6c5f66dcf5-xpqxp           2/2     Running     0               9d
meta-api-deploy-6fc85758c5-7t6v9                                  1/1     Running     0               9d
oidc-client-registration-g9mwp                                    0/1     Completed   0               9d
opensearch-all-000                                                1/1     Running     0               9d
opensearch-all-001                                                1/1     Running     0               9d
opensearch-all-002                                                1/1     Running     0               9d
opensearch-snapshot-repo-w9cjz                                    0/1     Completed   0               14m
operand-deployment-lifecycle-manager-6d87fd57-nj987               1/1     Running     0               9d
platform-auth-service-5898bdd5d6-mx7wd                            1/1     Running     0               8h
platform-identity-management-657846f669-f7fj6                     1/1     Running     0               8h
platform-identity-provider-5bd66f6d89-45vzz                       1/1     Running     0               8h
postgresql-operator-controller-manager-1-25-1-d4c6fb84d-24rlq     1/1     Running     3 (22h ago)     9d
setup-job-f7htt                                                   0/1     Completed   0               9d
usermgmt-85f796f7d5-c6glw                                         1/1     Running     0               8h
usermgmt-ensure-tables-job-t9gtq                                  0/1     Completed   0               9d
zen-audit-59c764cd7b-f4n99                                        1/1     Running     0               9d
zen-core-84fd5fd44f-qpmfj                                         2/2     Running     0               9d
zen-core-api-5c7bfb4b89-6z4vg                                     2/2     Running     1 (7d6h ago)    9d
zen-core-create-tables-job-j9qhg                                  0/1     Completed   0               9d
zen-core-pre-requisite-job-zfx7t                                  0/1     Completed   0               9d
zen-metastore-backup-cron-job-29147520-k9prh                      0/1     Completed   0               18h
zen-metastore-backup-cron-job-29148000-zg5tt                      0/1     Completed   0               10h
zen-metastore-backup-cron-job-29148480-dbk42                      0/1     Completed   0               177m
zen-metastore-edb-1                                               1/1     Running     3 (2d1h ago)    9d
zen-metastore-monthly-backup-cron-job-29148600-5j72d              0/1     Completed   0               57m
zen-metastore-weekly-backup-cron-job-29138460-xmchh               0/1     Completed   0               7d1h
zen-metastore-weekly-backup-cron-job-29148540-djvzd               0/1     Completed   0               117m
zen-minio-0                                                       1/1     Running     0               9d
zen-minio-1                                                       1/1     Running     0               9d
zen-minio-2                                                       1/1     Running     0               9d
zen-minio-create-buckets-job-khv4g                                0/1     Completed   0               9d
zen-pre-requisite-job-lpfr9                                       0/1     Completed   0               9d
zen-remote-svc-inst-status-cron-job-29148642-7h2qn                0/1     Completed   0               15m
zen-remote-svc-inst-status-cron-job-29148648-85r8w                0/1     Completed   0               9m41s
zen-remote-svc-inst-status-cron-job-29148654-pxk5m                0/1     Completed   0               3m41s
zen-route-custom-cert-refresh-cronjob-29147520-v5t57              0/1     Completed   0               18h
zen-route-custom-cert-refresh-cronjob-29148000-bkq5s              0/1     Completed   0               10h
zen-route-custom-cert-refresh-cronjob-29148480-zjpm5              0/1     Completed   0               177m
zen-svc-inst-status-cron-job-29148648-p5lwx                       0/1     Completed   0               9m41s
zen-svc-inst-status-cron-job-29148652-mn7k6                       0/1     Completed   0               5m41s
zen-svc-inst-status-cron-job-29148656-45ps5                       0/1     Completed   0               101s
zen-watcher-b8dddd56d-wm7tf                                       2/2     Running     0               9d

Deploying Workflow Process Service Runtime

After configuring IBM Cloud Pak for Business Automation components, you can deploy Workflow Process Service Runtime.
  1. If you want to use an EDB Postgres server, you can proceed directly to step 2. If you have an external PostgreSQL server, complete the following steps:
    1. Prepare your PostgreSQL database. To make sure the PostgreSQL database is configured correctly for your workload, update the following parameters in the postgresql.conf file of the database server:
      Parameter Setting Description
      shared_buffers Minimum 1024 MB PostgreSQL performance tuning recommends using 25% of the memory for the shared buffer. Updates to the Linux® kernel configuration might also be required. For more information, see the PostgreSQL tuning guides.
      work_mem Minimum 20 MB This parameter applies to each session and many user sessions can cause large memory usage. This memory is critical because it is used for sort operations. The running time can increase significantly if the value is set too low. For example, the running time might be over an hour for toolkit deployments.
      max_prepared_transactions For example, 200 This value should be at least as large as the max_connections setting.
      max_wal_size For example, 6 GB For larger workloads, the default value must be increased. To check whether an increase is required, see the PostgreSQL server log files.
      log_min_duration_statement For example, 5000 This optional parameter is for logging statements that exceed the specified running time to identify bottlenecks and potential tuning areas. This value is measured in milliseconds. For example, a value of 5000 corresponds to 5 seconds.
    2. Update the values for database.external.databaseName, database.external.dbCredentialSecret, and database.external.dbServerCertSecret. For more information about other database parameters, see Workflow Process Service parameters.
    3. Create a database in your external PostgreSQL server and create a user secret, where username corresponds to the database username, and password corresponds to the database password. If you want to enable certificate-based authentication, you do not need a password for wfps-db-secret. For example, your file might look similar to: 
      apiVersion: v1
kind: Secret
metadata:
  name: wfps-db-secret
type: Opaque
stringData:
  username: "wfpsadmin"
  password: "password"
    4. By default, SSL communication is enabled. If you want to disable SSL, change the value of database.external.enableSSL to false.
      If you want to enable SSL, create a CA certificate secret with the ca.crt key, by using the ca.crt file that is exported from your PostgreSQL server. For the secret name, enter the value of database.external.dbServerCertSecret. For example, if you are enabling SSL by itself, the command might look similar to:
      kubectl create secret generic wfps-db-cacert-secret --from-file=ca.crt=./ca_crt.pem
      Your database configuration might look similar to:
      spec:   
database:
    external:
      type: postgresql
      enableSSL: true
      dbServerCertSecret: wfps-db-cacert-secret
      Optionally, if you want to enable both SSL and database certificate-based authentication, create the secret with client.crt and client.key. Set the value of spec.database.external.sslMode to verify-ca or verify-full. To create your secret, run a command similar to:
      kubectl create secret generic wfps-db-cacert-secret --from-file=ca.crt=./ca_crt.pem --from-file=tls.crt=./client.crt --from-file=tls.key=./client.key
      Important:

      When configuring PostgreSQL with server-side authentication for Workflow Process Service Runtime, the database TLS secret must include the following three keys:

      • tls.crt - Client certificate
      • serverca.pem - Server CA certificate
      • ca.crt - Certificate authority (required for Workflow Process Service Runtime only)

      To create the secret configuration for Workflow Process Service Runtime, run the following command:

      oc create secret generic postgresql-server-secret \
  --from-file=tls.crt=<path-to-client-cert> \
  --from-file=serverca.pem=<path-to-server-ca-cert> \
  --from-file=ca.crt=<path-to-ca-cert> \
  -n <namespace>

      This requirement differs from Workflow Process Service Authoring, which does not require the ca.crt key for server-side authentication.

      If the ca.crt key is missing from the secret, the Workflow Process Service Runtime pod fails to start with the following error:

      FailedMount: MountVolume.SetUp failed for volume "tls-dbcacert": references non-existent secret key: ca.crt
    5. Optional: If you want to use custom Java™™ database connectivity (JDBC) files inside the Workflow Process Service Runtime server, set the database.customJDBCPVC parameter. The persistent volume claim (PVC) needs to be in ROX (ReadOnlyMany) or RWX (ReadWriteMany) access mode, otherwise high availability disaster recovery (HADR) will be affected, since all pods must be allocated to the same node and the PVC is mounted at the /shared/resources/jdbc/postgresql directory inside the container. The jdbc/postgresql directory must be created inside customJDBCPVC. For example, the structure of the remote file system might look like: 
      jdbc
├── postgresql
      ├── postgresql-42.2.15.jar
  2. Prepare storage for the Workflow Process Service Runtime server. The Workflow Process Service Runtime server supports persistence on three types of files: data files, log files and dump files. By default, data file persistence is enabled, while log and dump file persistence are disabled.
    • Option 1: If your environment supports dynamic provisioning, you can enable or disable each type of file persistence and configure each storage class. For example:
      spec:
  persistent:
    data:
      accessMode: RWO #default is RWO, RWX can also be configured
      enable: true
      size: 1Gi
      storageClassName: data-storage-class
    dump:
      accessMode: RWO #default is RWO, RWX can also be configured
      enable: false
      size: 1Gi
      storageClassName: dump-storage-class
    logs:
      accessMode: RWO #default is RWO, RWX can also be configured
      enable: false
      size: 1Gi
      storageClassName: logs-storage-class
    • Option 2: If your environment does not support dynamic provisioning and you do not have available storage classes on your cluster, choose this option. When using static provisioning, Kubernetes automatically binds the PVCs that workflow process service creates (for example: datasave, logssave, and dumpsave) to pre-created PVs when the following specifications are met:
      1. StorageClassName – the PV's storageClassName must match the value that is specified in the WFPS custom resource.
      2. Capacity – the PV must have storage equal to or greater than the PVC request (for example, 1Gi).
      3. Access mode – must be compatible (Default is ReadWriteOnce).
      4. PV status – must be Available (not already bound to another PVC).
        Note:
        • The PV name itself does not matter; Kubernetes matches PVs to PVCs based on the specifications before.
        • Each PVC binds to its own PV. If WfPS creates three PVCs (datasave, logssave, dumpsave), you need three PVs available.
      You can manually create your PV with spec.storageClasssName configured so that it can be used as storageClasssName in the Workflow Process Service Runtime custom resource. If you want to scale up to 2 instances of the Workflow Process Service Runtime server, you need to create another set of PVs and associate them with corresponding storage class.
  3. Use the shared_configuration.sc_generate_sample_network_policies parameter in the Cloud Pak for Business Automation custom resource to control internet access. The default value is false. You must set it to true to create sample network policies, which can be installed after the CP4BA deployment is ready by running a script. For more information, see Optional: Installing network policies.
  4. Create a custom resource YAML file for your Workflow Process Service Runtime configuration. For more information about parameters, see Workflow Process Service parameters. After you complete the following steps, your custom resource might look similar to the following: 
    apiVersion: icp4a.ibm.com/v1
kind: WfPSRuntime
metadata:
  name: wfps-instance1
spec:
  appVersion: "25.0.0"
  deploymentLicense: production    
  license:
    accept: true
    1. Optional: If you are using LDAP, it is recommended to update the value of spec.admin.username with an LDAP user.
      By default, the operator sets spec.admin.username to be the Common Services admin user from the platform-auth-idp-credential secret in the Common Services namespace.
      • If you are using the shared Common Services, the namespace is ibm-common-services.
      • If you are using a dedicated Common Services, you can find the namespace from the common-service-maps ConfigMap from the kube-public namespace. For more information about the common-service-maps ConfigMap, see step 2 in Setting up the cluster in the OpenShift console.

      You can configure LDAP in Identity Access Management and then set the LDAP user to be spec.admin.username. The Workflow Process Service Runtime operator automatically configures the LDAP user as a Zen user. To configure LDAP, see step 1 of Completing post-deployment tasks for Workflow Process Service Runtime.

    2. If you want to let the Workflow Process Service Runtime operator provision an EDB Postgres instance, you must make sure that your OpenShift Container Platform cluster already has a default storage class defined. If there is no default storage class that is defined, set the storage class name by using the spec.persistent.storageClassName parameter. For example: 
      spec:
   persistent:
     storageClassName: <storage_class_name>
    3. Optional: If you want to add custom files inside the Workflow Process Service Runtime server, you can update node.customFilePVC. The persistent volume claim (PVC) must be in ROX (ReadOnlyMany) or RWX (ReadWriteMany) access mode, otherwise HADR is affected, since all pods must be allocated to the same node and the PVC is mounted at the /opt/ibm/bawfile directory inside the container. For example, the customFilePVC might look similar to:
      spec:
  node:
     customFilePVC: my-custom-wfps-pvc
    4. Optional: If you want to enable the full text search feature, include the following lines:
      spec: 
  capabilities: 
    fullTextSearch: 
      enable: true 
      adminGroups: 
      - example_group 
      esStorage:
        storageClassName: BlockStorageClassName
        size: 50Gi
      esSnapshotStorage:
        storageClassName: BlockStorageClassName
        size: 10Gi
      If you installed Cloud Pak foundational services Elasticsearch, you don't need to add capabilities.fullTextSearch.esStorage and capabilities.fullTextSearch.esSnapshotStorage. If you didn't install Cloud Pak foundational services Elasticsearch and capabilities.fullTextSearch.enable is set to true, you must add capabilities.fullTextSearch.esStorage and capabilities.fullTextSearch.esSnapshotStorage in the custom resource yaml file. The StorageClass for Elasticsearch and Elasticsearch snapshot should create the storage type of the PVs in block mode rather than file system mode.
    5. Optional: If you want to start external services in your workflows, you need to retrieve the certificate of the external service and add it into the server trust list as a secret. For the serverTrustCertificateList parameter, enter a list of secrets, where every secret stores a trusted certificate. To create a secret, run the following command: 
      kubectl create secret generic <example_ocp_external_default_certificate> --from-file=tls.crt=./cert.crt
      Your serverTrustCertificateList configuration might look similar to:
      spec:
   tls: 
     serverTrustCertificateList:
     - <example_ocp_external_default_certificate>
    6. Apply the custom resource by running the following command:
      oc apply -f <custom_resource_name>.yaml
    7. After a few minutes, verify that you see your pods, services, and route. If you chose EDB Postgres, the server pod and services are also listed. For example:
      [root@xxxxxxx]# oc get pod
wfps-instance1-postgre-0 1/1 Running 0 21h
wfps-instance1-wfps-runtime-server-0 1/1 Running 0 21h                         1/1     Running     0          21h
      [root@xxxxxx]# oc get service
NAME                                                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                      AGE
wfps-instance1-postgre-any                              ClusterIP   172.30.60.216    <none>        5432/TCP                     6d
wfps-instance1-postgre-r                                ClusterIP   172.30.43.94     <none>        5432/TCP                     6d
wfps-instance1-postgre-ro                               ClusterIP   172.30.234.237   <none>        5432/TCP                     6d
wfps-instance1-postgre-rw                               ClusterIP   172.30.105.46    <none>        5432/TCP                     6d
wfps-instance1-wfps-headless-service                      ClusterIP   None             <none>        9443/TCP                   6d
wfps-instance1-wfps-service  
      [root@xxxxxx]# oc get route
NAME   HOST/PORT                                          PATH   SERVICES        PORT                   TERMINATION            WILDCARD
cpd    cpd-cp4a-project.apps.xxxxxx.cp.fyre.ibm.com          ibm-nginx-svc   ibm-nginx-https-port   passthrough/Redirect   None

Enabling Process Federation Server (PFS)

Before completing post-deployment tasks, deploy the Process Federation Server to enable unified access and management of process data across multiple workflow systems.
apiVersion: icp4a.ibm.com/v1
kind: ProcessFederationServer
metadata:
  name: pfsdeploy
  labels:
    app.kubernetes.io/instance: ibm-dba
    app.kubernetes.io/managed-by: ibm-dba
    app.kubernetes.io/name: ibm-dba
    release: 25.0.0
    cp4ba.ibm.com/backup-type: mandatory
spec:
  appVersion: 25.0.0
  license:
    accept: true
  shared_configuration: 
    sc_deployment_license: production
    sc_image_repository: cp.stg.icr.io
    storage_configuration:
      sc_medium_file_storage_classname: sc-type
      sc_slow_file_storage_classname: sc-type
  pfs_configuration:
    replicas: 1
    image:
      pull_policy: Always
      repository: icr.io/cp4ba-shared/pfs/pfs-prod
      tag: latest-amd64
    application_engine:
      workplace_image:
        pull_policy: Always
        repository: icr.io/cp4ba-baw/iaws-ibm-workplace
        tag: latest-amd64

Completing post-deployment tasks for Workflow Process Service Runtime

You can choose to configure LDAP or a third-party identity access and management provider.
  1. Go to the cluster in your Common UI console. To access the Common UI console, see Accessing your cluster by using the console External link opens a new window or tab. To configure an LDAP connection, see Configuring LDAP connection External link opens a new window or tab.
  2. Add LDAP users in Cloud Pak Platform UI.
    1. Connect to the URL: https://cluster_address, where cluster_address is the IBM Cloud Pak console route. You can get the IBM Cloud Pak console route by running the command: 
      oc get route cpd -o jsonpath='{.spec.host}' && echo
      The output might look similar to: 
      cpd-namespace_name.apps.mycluster.mydomain
      Using the example output, the console URL would look similar to: 
      https://cpd-namespace_name.apps.mycluster.mydomain/zen
    2. Log in to the IBM Cloud Pak dashboard and select OpenShift Container Platform authentication for kubeadmin, or log in with the IBM® provided credentials from step 1a, if you are an administrator.
    3. Go to Manage users > Add users.
    4. Type the names of users that you want to add, and click Next.
    5. Assign the users to roles, or add them to a group. You can add your LDAP user under Users or you can add your LDAP user group under User groups. For both users and user groups, make sure that at least one role is selected. For example, roles include administrator, automation administrator, automation analyst, automation developer, automation operator, and user.
    6. Click Add to register the users.

Verifying your Workflow Process Service Runtime deployment

To access services provided by Workflow Process Service Runtime, you might need to log in with your LDAP user and password.
  1. Make sure your Workflow Process Service Runtime deployment is ready by running the command: 
    oc get wfps <CR_name> -o=jsonpath='{.status.components.wfps.configurations[*].value}'
    The output might look similar to: 
    <CR_name>-admin-client-secret Ready Ready Ready Ready
  2. To access the Workplace console, you have two options. You can run the command: 
    oc get wfps <CR_name> -o=jsonpath='{.status.endpoints[2].uri}'
    Alternatively, you can manually splice the Workplace console URL:
    https://(oc get route cpd -o jsonpath="{.spec.host}")/<CR_name>-wfps/Workplace
    For example, the resulting Workplace console URL might look like: 
    https://cpd-cp4a-project.apps.xxxxxx.cp.fyre.ibm.com/<CR_name>-wfps/Workplace
  3. To access the Operations REST APIs Swagger UI, you have two options. You can run the command:
    oc get wfps <CR_name> o=jsonpath='{.status.endpoints[3].uri}'
    Alternatively, you can manually splice the Operations REST APIs Swagger UI URL: 
    https://(oc get route cpd -o jsonpath="{.spec.host}")/<CR_name>-wfps/ops/explorer
    For example, the resulting Operations REST APIs Swagger UI URL might look like: 
    https://cpd-cp4a-project.apps.xxxxxx.cp.fyre.ibm.com/<CR_name>-wfps/ops/explorer
  4. To construct the URLs of exposed REST services and exposed web services, you must locate the endpoint of Workflow Process Service Runtime in the custom resource file's status field. To determine the URL of your REST services and web services, complete the following steps:
    1. Run the command: 
      oc get wfps wfps-instance1 -o yaml
    2. In the endpoints section, locate the URI of the external Workflow Process Service Runtime instance. For example:
          - name: External Base URL
      scope: External
      type: https
      uri: https://cpd-wfps3.apps.fjk-ocp474.cp.example.com/wfps-instance1-wfps
    3. The URLs of your REST services have the following structure:
      http://host_name:port/[<custom_prefix>/]automationservices/rest/<process_app_name>/[<snapshot_name>/]<rest_service_name>/docs{}
      Where:
      • https://host_name:port/[<custom_prefix>/] is your URI value from the previous step.
      • <process_app_name> is the name of the process application.
      • <snapshot_name> is the optional name of the snapshot.
      • <rest_service_name> is the name of the REST service.
    4. The URL of your web services have the following structure:
      https://host_name:port/[<custom_prefix>/]teamworks/webservices/<process_app_name>/[<snapshot_name>/]<web_service_name>.tws
      Where:
      • https://host_name:port/[<custom_prefix>/] is your URI value from step 4b.
      • <process_app_name> is the name of the process application.
      • <snapshot_name> is the optional name of the snapshot.
      • <web_service_name> is the name of the web service.

Managing your EDB Postgres server

  1. To access data in your EDB Postgres server:
    1. Run the command oc get cluster to get the EDB Postgres cluster name. For example, the cluster name might be similar to: wfps-instance1-postgre.
    2. Run the command kubectl port-forward --address 0.0.0.0 wfps-instance1-postgre-rw 5432:5432 on the OpenShift Container Platform infrastructure node. The infrastructure node IP and port (5432) are the database server and database port that are externally accessible.
    3. Get the username and password from the wfps-instance1-postgre-app secret to access the default database wfpsdb. To expose more EDB Postgres services, see Exposing Postgres Services External link opens a new window or tab.
  2. Check your license.
    1. Run the command oc get cluster to get the EDB Postgres cluster name. For example, the cluster name might be similar to wfps-instance1-postgre.
    2. Run the command oc get cluster <cluster_name> -o yaml to check the license status. The output might look like:
       licenseStatus:
      isTrial: true
      licenseExpiration: "2024-10-01T00:00:00Z"
      licenseStatus: Valid license (IBM - Data & Analytics (Cloud))
      repositoryAccess: false
      valid: true
  3. To configure backup and recovery for EDB Postgres, see Backup and Recovery External link opens a new window or tab.
  4. You can configure the operator's management of the EDB Postgres cluster.
    1. If you want to manage the EDB Postgres cluster, you need to update the value of spec.database.managed.managementState to Unmanaged in the Workflow Process Service Runtime custom resource yaml file. After you update the value of spec.database.managed.managementState, the Workflow Process Service Runtime operator will not manage the EDB Postgres cluster. To change the parameters and resources of the EDB Postgres cluster, see PostgreSQL Configuration External link opens a new window or tab and Resource management External link opens a new window or tab. To add nodeSelector and select the nodes that a pod can run on, see Node selection through nodeSelector External link opens a new window or tab.
      When you are in the Unmanaged state, you need to manually delete the EDB Postgres cluster after you delete the Workflow Process Service Runtime instance. For example, to delete your cluster, your command might look similar to:
      oc delete cluster wfps-instance1-postgre
      where wfps-instance1-postgre is the name of your EDB Postgres cluster.
    2. If you want the Workflow Process Service Runtime operator to manage the EDB Postgres cluster, set spec.database.managed.managementState to Managed. The EDB Postgres cluster will have the default configuration and the EDB Postgres cluster will be deleted automatically after the Workflow Process Service Runtime instance is deleted.