Deploying CP4BA Automated Upgrade container

Use the Helm chart to deploy the CP4BA Automated Upgrade container on OpenShift® or Kubernetes.

Before you begin

Make sure that the following prerequisites are met before you begin.

Download cert-kubernetes to update the catalog sources for the new release.
1. Open the Cloud Pak for Business Automation download document click Cert Kubernetes, and then select and copy the displayed command.
2. Run the copied git clone command to download the files.
CLI tools.
The container does not include kubectl or oc CLI tools. You need to download a compatible version and upload it to the container by using the /upload endpoint.

The CLI must be compatible with RHEL 9.7 (UBI9 base image) and the CLI version must match your cluster version.
To download OpenShift CLI (oc):
1. Select the OpenShift version that you want to download. For more information, see OpenShift mirror . The minimum supported version is 4.18.
2. Run the following command to download the tool.
```
curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable/openshift-client-linux.tar.gz
tar -xzf openshift-client-linux.tar.gz oc
```
  For example, run the following command to download version 4.18.
```
curl -LO https://mirror.openshift.com/pub/openshift-v4/clients/ocp/stable-4.18/openshift-client-linux.tar.gz
tar -xzf openshift-client-linux.tar.gz oc
```
To download Kubernetes CLI (kubectl), go to Install and Set Up kubectl on Linux .
For example, run the following command to download RHEL 9.
```
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
```
Install Helm 3.x. For more information, see Installing Helm .
You must have cluster administrator access to deploy the container.
POSIX-compliant storage class or Persistent Volume Claim (PVC) created with POSIX-compliant storage.

About this task

The CP4BA Automated Upgrade container is deployed by using a Helm chart that is stored in the cert-kubernetes repository. You can specify a StorageClass or reference an existing Persistent Volume Claim (PVC) in the Helm chart. You can also configure access to the API by using any one of the following options or both.

Kubernetes secret that contains a username and password. The API uses these credentials for authentication.
Kubernetes secret that contains the TLS files (tls.key and tls.pem). The API uses these certificates for TLS verification.

The Helm chart includes configurable parameters that you can modify based on your requirements. For more information, see CP4BA Automated Upgrade Helm chart parameters.

Important: You need to deploy the CP4BA Automated Upgrade container on the Cloud Pak for Business Automation cluster where the deployment version you want to upgrade is running.

You configure the following parameters in the values.yaml file located in cert-kubernetes/descriptors/CP4BA/helm-charts/cp4ba-api/values.yaml.

serviceAccount.operandNamespace - The namespace in which the CP4BA operands run.
serviceAccount.operatorNamespace - The namespace where the CP4BA operators run. If the namespace is the same as the operands namespace, then enter "".
route.hostname - The route hostname. The route hostname must match the TLS certificate.
persistence.storageClass - The storage class name. It must support ReadWriteMany access mode.
auth.username - The username for HTTP Basic Authentication. This parameter is used only when auth.createSecret=true. The default value for auth.createSecret is false. If you set auth.createSecret=true, then the chart creates the secret automatically by using the values from auth.username and auth.password. In a production environment, it is recommended to create the username manually.
auth.password - The password for HTTP Basic Authentication. This parameter is used only when auth.createSecret=true. The default value for auth.createSecret is false. If you set auth.createSecret=true, then the chart creates the password automatically. In a production environment, it is recommended to create the password manually.

Procedure

Go to cert-kubernetes/descriptors/CP4BA/ directory.
```
cd cert-kubernetes/descriptors/CP4BA/
```
Set the following environment variable.
```
export projectName=<cp4ba-project>
```
where <cp4ba-project> is the CP4BA namespace.
Create the TLS certificate secret.
Important:
- If you are using a self-signed certificated, then tls.crt can contain only the self-signed certificate.
- If you are using a CA-signed certificate, then tls.crt must contain the full chain (server cert + intermediate CAs + root CA).
- The hostname in the certificate's SAN must match the route.hostname parameter in the values.yaml file.
- The certificates and key must be provided in unencrypted PEM format.
Run the following command to create the TLS certificate secret.
```
kubectl create secret generic cp4ba-installer-upgrade-tls \
  --from-file=server-cert.pem=<path_to_secret>/tls.crt \
  --from-file=server-key.pem=<path_to_secret>/tls.key \
  -n $projectName
```
replace <path_to_secret> with the actual location of the certificates.
Optional: Create the authentication secret.
Note: If you set auth.createSecret=true, then the chart creates the secret automatically by using values from auth.username and auth.password. For production, it is recommended to create the secret manually and set auth.createSecret=false.
Run the following command to create the authentication secret.
```
kubectl create secret generic cp4ba-api-auth \
  --from-literal=username=your-username \
  --from-literal=password=your-secure-password \
  -n $projectName
```
where your-username is the username for HTTP Basic authentication, and your-secure-password is the password for HTTP Basic authentication.

Deploy the CP4BA Automated Upgrade container by using any of the following methods.

Option 1: Manual secret management.

Create the my-values.yaml file.

cat > my-values.yaml <<EOF
serviceAccount:
  operandNamespace: "cp4ba-operand"
  operatorNamespace: ""  # Empty if same namespace
route:
  hostname: "cp4ba-api-cp4ba.apps.mycluster.example.com"
persistence:
  storageClass: "ocs-storagecluster-cephfs"  # Must support ReadWriteMany
auth:
  createSecret: false  # Secret already created manually
EOF

Run the following command to deploy the CP4BA Automated Upgrade container.

helm install ibm-cp4ba-api helm-charts/cp4ba-api -f my-values.yaml -n $projectName

Option 2: Using command line parameters.

Run the following command to deploy the CP4BA Automated Upgrade container. The chart creates the authentication secret automatically.

helm install ibm-cp4ba-api helm-charts/cp4ba-api \
  --set serviceAccount.operandNamespace=cp4ba-operand \
  --set serviceAccount.operatorNamespace="" \
  --set route.hostname=cp4ba-api-cp4ba.apps.mycluster.example.com \
  --set persistence.storageClass="ocs-storagecluster-cephfs" \
  --set auth.createSecret=true \
  --set auth.username=admin \
  --set auth.password=your-secure-password \
  -n $projectName

Replace the route.hostname and auth.password parameters with appropriate values.

Optional: The chart includes built-in validation. You can check the error messages.
- Run the following command to check whether the required values in the values.yaml file are missing.
```
helm lint helm-charts/cp4ba-api
```
- Run the following command to test deployment of the CP4BA Automated Upgrade container with the values you defined.
```
helm lint helm-charts/cp4ba-api -f my-values.yaml
```
- Run the following command for a dry-run.
```
helm install ibm-cp4ba-api helm-charts/cp4ba-api -f my-values.yaml --dry-run --debug
```