Changing default values for Cloud Pak foundational services

The foundational services help you manage and administer IBM® software on your cluster. For example, the Cloud Pak foundational services include services such as the Platform UI (Zen) Service, the License Service, and the Identity Management (IM) Service. From the Platform UI (Zen), you can view key metrics for components of IBM Cloud® Paks and Cloud Pak foundational services that are installed on the cluster.

You might want to configure the foundational services in the following ways.

• Adding service-related configuration
• Cluster administrator password
• Platform UI (Zen) customization
• Custom certificates
• Mutual authentication for LDAP connections
• Default storage class

Adding service-related configuration

For more information, see Services configuration .

Cluster administrator password

The cluster administrator password is stored in a Kubernetes secret. You can change the auto-generated password and restart the services that use the password by running a cloudctl command.

Note: IBM Cloud Pak® CLI (cloudctl) is useful to view information about your cluster and to manage your cluster. To install cloudctl, see Installing IBM Cloud Pak® CLI (cloudctl) .

cloudctl pm update-secret kube-system platform-auth-idp-credentials -d admin_password

The password must follow the defined password rules. To list the password rules, run the following command:

cloudctl pm password-rules <namespace>

Platform UI (Zen) customization

The Zen Service is a reverse proxy that provides a common external URL to access Cloud Pak for Business Automation capabilities. For more information, see Platform UI . Zen uses specific roles to define who can access a particular interface. For more information about managing the roles and user permissions, see Managing users .

The ibm-zen-operator manages the Zen Service, and the Cloud Pak for Business Automation operator does not manage the Zen settings after the initial creation. Customization of the Zen Service must be made directly in the Zen custom resource (CR).

You can review the settings and health of the Zen Service by running the following command, where <namespace> is usually the Cloud Pak for Business Automation namespace.

oc get zenservice -o yaml -n <namespace> 

The route that is associated with Zen is called cpd and it uses secure TLS communications. If you need the root CA for an external truststore, see Exporting the Zen CA and common services CA. When you access the cpd route, login requests are redirected to the IM service and the cp-console route. You can customize the hostname and certificates for these routes. For more information, see Customizing the Cloud Pak Identity Management (IM) service.

All the TLS certificates for Cloud Pak foundational services are created during installation, but you can replace the certificate and the route hostname for the foundational services entry point. The entry point is the endpoint that is used to access the console from outside the cluster. For more information, see Customizing the Cloud Pak entry point.

License Service custom certificates

To avoid certificate issues and untrusted certificates when you access the UIs and REST APIs, you can configure a custom certificate for License Service communication.

1. Change the certificate name to tls.crt.
2. Change the name of the key to tls.key.
3. Run the following command to change the directory to where the certificate and the key are stored:

   cd <certificate_directory>

4. Create a secret by using the following command:

   licensingNamespace=$(oc get pods --all-namespaces | grep "ibm-licensing-service-" | awk {'print $1'})
   oc create secret tls ibm-licensing-certs --key tls.key --cert tls.crt -n ${licensingNamespace}

5. Edit the IBM Licensing custom resource to enable the https connection.

   apiVersion: operator.ibm.com/v1alpha1
   kind: IBMLicensing
   metadata:
     name: instance
   spec:
     httpsEnable: true

   To access the IBM Licensing operator in the OpenShift® console:

   1. From the navigation menu, click Operators > Installed Operators > IBM Licensing Operator.
   2. Click the IBM License Service tab.
   3. Click the IBMLicensing instance, and then click the YAML tab.
6. To apply the custom certificate that you created, add the httpsCertsSource parameter:

   apiVersion: operator.ibm.com/v1alpha1
   kind: IBMLicensing
   metadata:
     name: instance
   spec:
     httpsEnable: true
     httpsCertsSource: ibm-licensing-certs

Mutual authentication for LDAP connections

Mutual Transport Layer Security (mTLS) requires both the client and the server to present and verify their own certificates to each other before a secure connection is opened. For the LDAP mutual TLS authentication to work, you must allow your LDAP server to import the CP4BA signer certificate otherwise the session is immediately cancelled.

When mTLS is enabled, a successful mutual connection is established between Identity Management (IM) and the LDAP server. However, basic authentication (username and password) is still required to login to IM. For the LDAP mutual TLS authentication to work, you must allow your LDAP server to import the CP4BA signer certificate otherwise the session is immediately cancelled. For more information, see Configuring mutual TLS authentication between IM and an LDAP server .

Default storage class

The block storage class that you select for your CP4BA deployment is set as the CommonService storage class. You can manually change the default storage class if needed for specific use cases or non-production environments. For more information, see Storage options for IBM Cloud Pak foundational services .