Option 2: Setting up the cluster in the OpenShift console

You can install the Cloud Pak for Business Automation operators with the IBM® catalogs in the Red Hat® OpenShift® console. By configuring a namespace-scoped Cloud Pak foundational services for your Cloud Pak for Business Automation deployment, you can install multiple CP4BA instances in the same cluster each with their own foundational services.

About this task

The recommended way to install Cloud Pak for Business Automation is by running the scripts. The scripts guide you through the process step-by-step, create SQL scripts for you to create databases, generate YAML files for the required Kubernetes secrets, and check the external resources during the installation. For more information, see (Recommended) Option 1: Setting up the cluster by running a script.

IBM provides operators to OpenShift in the form of a catalog. A catalog is added to an OpenShift cluster by using a CatalogSource resource. After you apply a CatalogSource resource, the IBM catalog appears in the OCP OperatorHub under All items > Business Automation.

Procedure

Log in to your OCP or ROKS cluster as a cluster administrator.
To allow a non-administrator user to create the Cloud Pak operators, you must create an OperatorGroup.
1. As a cluster administrator, grant administrator ClusterRoleBinding with administrator ClusterRole to the non-administrator user:
```
oc create clusterrolebinding <binding-name> --clusterrole=admin --user=<username>
```
  Where <username> is the non-administrator user and <binding-name> is the ClusterRoleBinding name.
2. Create a ClusterRoleBinding with "aggregate-olm-view" ClusterRole for the user:
```
oc create clusterrolebinding user-aggregate-olm-view --clusterrole=aggregate-olm-view --user=<username>
```
3. The cluster administrator then creates an OperatorGroup in the namespace where the non-administrator user is going to deploy the operators.
  The following operator_group.yaml file assigns spec.targetNamespaces to match the target namespace.
```
apiVersion: operators.coreos.com/v1alpha2
kind: OperatorGroup
metadata:
  name: my-user-operatorgroup  
  namespace: cp4ba-project
spec:  
  targetNamespaces:  
  - cp4ba-project
```
  Where cp4ba-project is the namespace that you created for the CP4BA deployment.
  Apply the OperatorGroup by running the following command:
```
oc create -n cp4ba-project -f operator_group.yaml
```
4. If required: Two other RBAC resources are needed to give the Content operator access to secrets when the CP4BA deployment has the sc_deployment_fncm_license custom resource parameter set to "concurrent-user" or "authorized-user". If you intend to use either license type, create the Role and RoleBinding resources from the provided template. Replace <CP4BA-OPERATORS-NAMESPACE> with the name of the target namespace.
```
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ibm-licensing-secret-reader
  namespace: ibm-licensing
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ibm-cp4a-content-operator-licensing-access
  namespace: ibm-licensing
subjects:
- kind: ServiceAccount
  name: ibm-cp4a-content-operator
  namespace: <CP4BA-OPERATORS-NAMESPACE>
roleRef:
  kind: Role
  name: ibm-licensing-secret-reader
  apiGroup: rbac.authorization.k8s.io  
```
Create two new projects in the OCP console. One project for the Certificate Manager catalog (ibm-cert-manager) and one project for the License Manager catalog (ibm-licensing).

Note: If the Red Hat Certificate Manager is already installed, you do not need to create the ibm-cert-manager project.

Add the CatalogSource resources to Operator Hub for the versions that you want to install. Each interim fix has a specific version and unique digest, which are needed for the new catalog sources.

To import the YAML into your cluster in the OCP Admin console:

Click the plus icon at the top of the console. The Import YAML editor opens.
You can import the entire catalog source YAML into the editor from the corresponding catalog_source.yaml file, and click Create. You can also paste the individual CatalogSource resource definitions one-by-one into the editor.

Note: You can find the CatalogSource YAML in the catalog_source.yaml file, which is located in the cert-kubernetes package in the cert-kubernetes/descriptors/op-olm directory.
For more information about downloading cert-kubernetes, see Preparing a client to connect to the cluster.

Tip: If the Red Hat Cert Manager is already installed, you can remove the private IBM Certificate Manager Catalog from the catalog_source.yaml file.

The following example of the catalog sources does not show the real digests for 26.0.0 and its corresponding dependencies. The example does show the names and the number and version of the catalog sources that you need to create for each new installation that you want to use. Replace XXXXXXXXXXXX with the digest for each catalog source and replace the <namespace> placeholder with openshift-marketplace for the global catalog namespace (GCN) or your target CP4BA namespace (cp4ba-project) for a private catalog.

For the Certificate Manager and License Manager catalogs, use private catalogs and set the recommended namespaces of ibm-cert-manager and ibm-licensing.

# CP4BA Multi-pattern Catalog 26.0.0 
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cp4a-operator-catalog
  namespace: <namespace>
spec:
  displayName: ibm-cp4a-operator
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-cp-automation-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM Content Cortex Catalog 26.0.0
apiVersion: operators.coreos.com/v1alpha1 
kind: CatalogSource 
metadata: 
  name: ibm-fncm-operator-catalog
  namespace: <namespace> 
spec: 
  displayName: ibm-fncm-operator 
  publisher: IBM 
  sourceType: grpc 
  image: icr.io/cpopen/ibm-content-cortex-catalog@sha256:XXXXXXXXXXXX 
  updateStrategy: 
    registryPoll: 
    interval: 45m

# IBM Cloud Pak foundational services 4.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cs-install-catalog-v4-x-0
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM CS Install Operators v4.x
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-cs-install-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Business Teams Service Catalog 3.35.x
 apiVersion: operators.coreos.com/v1alpha1
 kind: CatalogSource
 metadata:
  annotations:
    bedrock_catalogsource_priority: '1'
  name: ibm-bts-operator-catalog-v3-35
  namespace: <namespace>
 spec:
  displayName: BTS Operator-3.35.x
  publisher: IBM
  sourceType: grpc
  image: quay.io/opencloudio/ibm-bts-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM CS Flink Operator Catalog
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-opencontent-flink
  namespace: <namespace>
spec:
  displayName: IBM CS Opencontent Flink Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-opencontent-flink-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM CS Opensearch Operator Catalog
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-cs-opensearch-catalog
  namespace: <namespace>
spec:
  displayName: IBM CS Opencontent Opensearch Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/opencontent-elasticsearch-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Certificate Manager Catalog 4.2.x
apiVersion: operators.coreos.com/v1alpha1 
kind: CatalogSource 
metadata: 
  name: ibm-cert-manager-catalog 
  namespace: openshift-marketplace 
spec: 
  displayName: ibm-cert-manager-4.2.x
  publisher: IBM 
  sourceType: grpc 
  image: icr.io/cpopen/ibm-cert-manager-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy: 
    registryPoll: 
    interval: 45m

# IBM Licensing Catalog 4.2.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-licensing-catalog
  namespace: openshift-marketplace
spec:
  displayName: ibm-licensing-4.2.x
  publisher: IBM
  image: icr.io/cpopen/ibm-licensing-catalog@sha256:XXXXXXXXXXXX
  sourceType: grpc
  updateStrategy:
    registryPoll:
      interval: 45m

# IBM CS IM Operator Catalog 4.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-iam-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM IM Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-iam-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Zen Operator Catalog
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-zen-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM Zen Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-zen-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Events Operator Catalog
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-events-operator-catalog
  namespace: <namespace>
  annotations:
    bedrock_catalogsource_priority: '1'
spec:
  displayName: IBM Events Operator Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-events-operator-catalog@sha256:XXXXXXXXXXXX
  updateStrategy:
    registryPoll:
      interval: 45m
  priority: 100

# IBM Usage Metering Catalog 1.0.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-usage-metering-catalog
  namespace: openshift-marketplace
spec:
  displayName: ibm-usage-metering-1.0.x
  publisher: IBM
  image: icr.io/cpopen/ibm-usage-metering-operator-catalog@sha256:XXXXXXXXXXXX
  sourceType: grpc
  grpcPodConfig:
    securityContextConfig: restricted

# IBM Redis CP Operator Catalog for 1.4.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-redis-cp-operator-catalog
  namespace: openshift-marketplace
spec:
  displayName: IBM Redis CP Catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-redis-cp-operator-catalog@sha256:XXXXXXXXXXXX
  grpcPodConfig:
    securityContextConfig: restricted
updateStrategy:
  registryPoll:
    interval: 45m

From 26.0.0-IF001

# IBM PG Operator Catalog v28.x
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
  name: ibm-pg-operator-catalog
  namespace: openshift-marketplace
spec:
  displayName: ibm-pg-operator-catalog
  publisher: IBM
  sourceType: grpc
  image: icr.io/cpopen/ibm-pg-operator-catalog@sha256:XXXXXXXXXXXX
  grpcPodConfig:
    securityContextConfig: restricted

Install the IBM Certificate Manager and IBM License Service operators from the OperatorHub.
Tip: From OpenShift 4.20, you must switch to the target namespace to access the list of available catalogs. OperatorHub is no longer a view in the OCP console. From the Software Catalog view, you can search and install operators.

Note: If the Red Hat Cert Manager is already installed, you can skip the sub-steps (a to g) to install the IBM Certificate Manager operator.
1. In the All Items field, enter IBM Cert Manager. The IBM Cert Manager catalog is displayed.
2. Click the IBM Cert Manager tile. The IBM Cert Manager window is displayed.
3. Click Install. The Install Operator page is displayed.
4. Set the Update Channel to v4.2. If the Channel v4.2 version is not available, click a different IBM Cert Manager tile from Operator Hub to install the correct version.
5. Set the Installed Namespace to the ibm-cert-manager(Operator recommended) namespace.
6. Set the Update approval to Automatic.
7. Click Install.
8. In the All Items field, enter IBM Licensing. The IBM Licensing catalog is displayed.
9. Click the IBM Licensing tile. The IBM Licensing window is displayed.
10. Click Install. The Install Operator page is displayed.
11. Set the Update Channel to v4.2.
12. Set the Installation Mode to A specific namespace on the cluster.
13. Set the Installed Namespace to the ibm-licensing namespace.
14. Set the Update approval to Automatic.
15. Click Install.
Create the IBM Licensing Service secret.
Convert the token to the Base64 format. Use the following Bash command.
```
export TOKEN="<token>"
printf %s "$TOKEN" | base64 | tr -d '\n'
```
1. Open the ibm-licensing namespace.
2. Go to Workloads > Secrets.
3. Edit the following YAML example to be in line with your environment.
```
kind: Secret
apiVersion: v1
metadata:
  name: <name>
data:
  token: <IBM entitlement key>
type: Opaque
```
  Where the name is the name of your choice, and token is the IBM entitlement key in the Base64 format.
4. Apply the YAML.
Either an admin user or a non-admin user can now login to the OpenShift console, click Operators to open the OperatorHub, and then enter cp4ba in the Filter by keyword box under All items.
Click the IBM Cloud Pak® for Business Automation (CP4BA) multi-pattern (ibm-cp4a-operator) catalog item, and click Install.
1. In the configuration panel, enter values for all the required fields.
  Select the channel (v26.0 for 26.0.0).
  
  If you set any subscriptions to manual, then you must approve any pending operator updates. It is not recommended to set subscriptions to manual because it can make the installation error prone when some of the dependency operators are not approved. By default, all subscriptions are set to automatic.
  Tip: Subscriptions for the Cloud Pak foundational services operators are created when they are "needed". Some subscriptions are created during the installation of the operators. If other subscriptions are needed, they are created during the installation of the CP4BA deployment. Business Teams Service, for example, is installed only "if it is needed". To check for subscriptions that are waiting for approval, get the install plans by running the following command.
```
oc get installPlan
```
  The default mode is All namespaces on the cluster, but choose A specific namespace on the cluster under Installation Mode and select a namespace from the Installed Namespace menu to install in a single or the operator's own namespace.
  Attention: All namespaces is not recommended by IBM for new installations. If you do want to install in the All namespaces mode, create the "ibm-common-services" namespace for Cloud Pak foundational services and then make sure that you create a ConfigMap (ibm-cp4ba-common-config) with the following YAML.
```
kind: ConfigMap
apiVersion: v1
metadata:
  name: ibm-cp4ba-common-config
  namespace: <namespace>
data:
  operators_namespace: "openshift-operators"
  services_namespace: "ibm-common-services"
  network_cidr: "<value>"
  networkType: "<value>"
```
  If you do not want to install in the All namespaces mode, create a ConfigMap (ibm-cp4ba-common-config) in the namespace that you created and prepared for the operator (cp4ba-project).
```
kind: ConfigMap
apiVersion: v1
metadata:
  name: ibm-cp4ba-common-config
  namespace: <namespace>
data:
  operators_namespace: "<namespace>"
  services_namespace: "<namespace>"
  network_cidr: "<value>"
  networkType: "<value>"
```
  Set the <namespace> that you created and prepared for the operator (cp4ba-project). For more information, see Preparing a namespace for the operator.
  
  You can get the values for the network_cidr and networkType keys by running the following command.
```
oc get network cluster -o yaml
```
  Important: Before you install the operators, check for existing installations of the Cloud Pak for Business Automation operators. If there are existing operators that are installed in the openshift-operators namespace, then you must continue to use the All namespaces on the cluster option. If there are existing operators that are installed in specific namespaces but not in the openshift-operators namespace, then you must continue to use the A specific namespace on the cluster option.
  The oc get csv -A command shows all the operator installations.
2. Click Install.
3. In the Installed Operators view, verify the status of the IBM Cloud Pak for Business Automation installation.
Install the IBM Usage Metering Service operator, by going to Operator Hub > Installed Operators. Search for IBM Usage Metering, and install it in your target namespace.

For example, use the namespace cp4ba-project.
After the subscription is created, apply the UMS metrics CRs from <cert-kubernetes>/descriptors/patterns/cp4ba-metrics.

Before you apply the CRs, make sure that you change the <REPLACE_NAMESPACE> to your CP4BA namespace.
Create the UMS secret with your IBM Entitlement Key from MyIBM Container Software Library.
Convert the IBM entitlement key to the Base64 format.
```
export TOKEN=<entitlement key>
printf %s "$TOKEN" | base64 | tr -d '\n'
```
To create the secret.
1. Go to the CP4BA project namespace.
2. Go to Workloads > Secrets.
3. Expand the Create menu, and select From YAML.
4. Paste the edited YAML example.
```
kind: Secret
apiVersion: v1
metadata:
  name: <name>
data:
  token: <IBM entitlement key>
type: Opaque
```
  Where the name is the name of your choice, and token is the IBM entitlement key in the Base64 format.
5. Click Create.
Apply the Software Central Connection CR from <cert-kubernetes>/descriptors/patterns/cp4ba-metrics/software-central-connection.
Modify the cp4ba_swc_connection.yaml file, and make sure that you change the <REPLACE_NAMESPACE> to your CP4BA namespace and <REPLACE_SECRET_NAME> to the name of the secret that you created.

Then apply the YAML file.
```
oc apply -f cp4ba_swc_connection.yaml
```

Install the IBM Redis operator with the subscription YAML from <cert-kubernetes>/descriptors/op-olm/redis-subscription.yaml.

apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: ibm-redis-cp-operator-catalog-subscription
  namespace: <cp4ba-project>
spec:
  channel: v1.3
  installPlanApproval: Automatic
  name: ibm-redis-cp
  source: ibm-redis-cp-operator-catalog
  sourceNamespace: <cp4ba-project>

Replace <cp4ba-project> with the namespace of your CP4BA deployment.

Verify the Cloud Pak for Business Automation operators successfully installed.
1. On the left panel in the OpenShift console, click Workloads > Pods, and switch to the project where you installed the operator. Verify that all the pods are running.
2. On the left panel, click Operators > Installed Operators.
3. Make sure that all operators have the status "Succeeded" in your selected <namespace>.
  Note: The version number (26.0) shown below the installed operators corresponds to the channel for Cloud Pak for Business Automation 26.0.0.
  
  The OLM is now aware of the operators. A ClusterServiceVersion (CSV) for the operators appear in the target namespace, and APIs provided by the operators are available to use.
Tip: If the Cloud Pak operator is inactive for some time, you can delete the operator pod and force it to reconcile.

What to do next

You can monitor the operator logs with the following commands. Where the <namespace> is the project (cp4ba-project) that you created and prepared for the operator. For an all namespaces installation, the namespace is always openshift-operators.

oc project <namespace>
oc logs -f deployment/ibm-cp4a-operator -c operator

Grant permissions to non-admin user to create a CP4BA deployment

If you want to allow a non-admin user to create a CP4BA deployment, then you can get the role and cluster role names of the operator to give access to a specified user. To get the names after the operator is deployed successfully, use the following command.

oc get role | grep ibm-cp4a-operator | sort -t"t" -k1r | awk 'NR==1{print $1}'

Run the following commands for each specified user that you want to give permission to create a CP4BA deployment.

oc project <namespace>
oc adm policy add-role-to-user edit <user_name> 
oc adm policy add-role-to-user registry-editor <user_name>
oc adm policy add-role-to-user <role_name> <user_name> 
oc adm policy add-cluster-role-to-user icp4aclusters.icp4a.ibm.com-v1-crdview <user_name>

Where <role_name> is the name of the role that you got from running the oc get command, and the <namespace> is the project (cp4ba-project) that you created and prepared for the CP4BA deployment.

You can see the list of operators that are installed in your cluster on the Operators > Installed Operators page. For more information about foundational services, see Cloud Pak foundational services External link opens a new window or tab .

To verify the foundational services installation, check whether all the pods in the namespace that are used for the CP4BA deployment are running. Use the following command:

oc get pods -n <namespace>

You can also use the following command to verify whether the services are successfully installed:

oc -n <namespace> get csv

Continue to prepare everything that you need for each capability that you want to install in Preparing your chosen capabilities.