Using a custom certificate and hostname (IBM Concert Operate on Red Hat OpenShift)

Choose one of the following options:

Option A: (Recommended) Configure a custom certificate for the Red Hat OpenShift cluster.

Follow the instructions in the Red Hat OpenShift documentation Replacing the default ingress certificate. Exit this topic.

Option B: Configure a custom certificate for the IBM Concert Operate or Infrastructure Automation console only.

Use the following procedure to replace the default Red Hat OpenShift routes created for IBM Concert Operate, and secure them with a custom TLS certificate instead of the Red Hat OpenShift default ingress cluster certificate.

1. Set hostname and environment variables
2. Prepare certificates
3. Create a secret for the custom certificates
4. Update cpd route with custom hostname
5. Create the Tenant Config configmap
6. Restart pods
7. Verify routes
8. Restart Managed services pods (Managed services users only)
9. Refresh ChatOps pods (ChatOps users only)

• The custom hostnames that you use must be unique, especially within the Red Hat OpenShift cluster.
• The custom hostnames that you use must be resolvable from inside and outside of the Red Hat OpenShift cluster.

This procedure changes only the hostname of the IBM Concert Operate or Infrastructure Automation console for browser access. No other routes, hostnames, or certificates are affected or changed.

Export environment variables for your project, the version of ibm-common-service-operator that your IBM Concert Operate deployment is using, and the custom hostnames that you want to use.

export PROJECT=<project>
export CUSTOM_HOSTNAME=<custom_hostname>
export CPCONSOLE_HOSTNAME=<custom_cp_hostname>
oc project $PROJECT

Where

• <project> is the project (namespace) where IBM Concert Operate or Infrastructure Automation is deployed. For example, concert-operate.
• <custom_hostname> is the custom hostname that you want to use for the IBM Concert Operate homepage. For example, concert-operate.mycompany.com.
• <custom_cp_hostname> is the custom hostname that you want to use for the authentication console. For example, concert-operate-cpconsole.mycompany.com.

1. Prepare the certificate files.

   You must have the following four PEM-encoded certificate files:

   • cachain.pem: A certificate chain that contains the root and intermediate certificates in this order: the signer of the IBM Concert Operate or Infrastructure Automation application certificate, the intermediate certificates, the root certificate.
   • carootcert.pem: The root certificate of your certificate authority (CA), with no intermediate or application certificates.
   • aiops.key.pem: An unencrypted private key file for the signed certificate in aiops.pem.
   • aiops.pem: A IBM Concert Operate or Infrastructure Automation certificate.

2. Add your root CA (carootcert.pem) to the CA bundle so that it is trusted across the Red Hat OpenShift cluster.

   For more information, see the instructions in Replacing the CA Bundle certificate.

Create a secret called custom-tls-secret-<date> with your custom certificates. The secret name must be unique so that ZenService is able to detect changes in the following steps.

Run the following commands to create the secret:

export CUSTOM_TLS_SECRET=custom-tls-secret-$(date '+%Y%d%m%H%M')
oc create secret generic ${CUSTOM_TLS_SECRET} --from-file=ca.crt=./cachain.pem --from-file=tls.crt=./aiops.pem --from-file=tls.key=./aiops.key.pem --dry-run=client -o yaml | oc apply --validate -f -

Run the following command:

oc patch ZenService/iaf-zen-cpdservice --type json -p '[{"op":"remove","path":"/spec/zenDefaultIngressReencrypt"}]'
oc patch ZenService/iaf-zen-cpdservice --type merge -p '{"spec":{"zenCustomRoute":{"route_reencrypt":true, "route_host":"'$CUSTOM_HOSTNAME'", "route_secret":"'$CUSTOM_TLS_SECRET'"}}}'

Run the following command to create or update the cs-onprem-tenant-config configmap:

cat <<EOF | oc apply -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: cs-onprem-tenant-config
  labels:
    cs_onprem_tenant_config: "true"
data:
  custom_hostname: ${CPCONSOLE_HOSTNAME}
  custom_host_certificate_secret:  ${CUSTOM_TLS_SECRET}
EOF

1. Run the following commands:

   oc delete pod -l component=ibm-nginx
   oc delete pod -l name=ibm-zen-operator

2. Monitor the progress of the new configuration updates.

   Run the following command:

   watch oc get zenservice iaf-zen-cpdservice -o jsonpath=\''{"Progress: "}{.status.progress}{" "}{.status.progressMessage}{"\n"}'\'

   Wait for about 15 minutes for the system to begin recognizing the updates, and for Progress to be less than 100%. After that, it typically takes another 30–60 minutes for all of the changes to be fully processed. When Progress returns to 100%, all of the changes are complete and you can log in to the IBM Concert Operate or Infrastructure Automation console.

Run the following command to verify that your routes are using the new custom hostname.

oc get routes -o=custom-columns=NAME:.metadata.name,HOST:.spec.host

NAME                                        HOST
cp-console                                  concert-operate-cpconsole.mycompany.com
cpd                                         concert-operate.mycompany.com
iaf-system-kafka-0                          iaf-system-kafka-0-concert-operate.apps.mycluster.ocp.mycompany.com
iaf-system-kafka-bootstrap                  iaf-system-kafka-bootstrap-concert-operate.apps.mycluster.ocp.mycompany.com
id-mgmt                                     concert-operate-cpconsole.mycompany.com
platform-auth                               concert-operate-cpconsole.mycompany.com
platform-id-auth                            concert-operate-cpconsole.mycompany.com
platform-id-provider                        concert-operate-cpconsole.mycompany.com
platform-login                              concert-operate-cpconsole.mycompany.com
platform-oidc                               concert-operate-cpconsole.mycompany.com
saml-ui-callback                            concert-operate-cpconsole.mycompany.com
social-login-callback                       concert-operate-cpconsole.mycompany.com
whconn-04e8ca21-eb4d-4393--route-991df384   whconn-04e8ca21-eb4d-4393-bd46-3ae1b2367e61-concert-operate.apps.mycluster.ocp.mycompany.com

When the certificate is verified as working correctly and you can access IBM Concert Operate or Infrastructure Automation, delete any previous custom-tls-secret secret.

Skip this step if you are not using Managed services .

1. If you are using Managed services, run the following command to restart the pods:

   oc delete pod -l release=cam
   

2. When all the pods are up and running, go to the Library and Instances pages in the Infrastructure Automation UI console and check for problems.

3. If any problem persists, check the cam-tenant-api pod logs. Search the logs for the term apikey in configboot, and verify that a valid key is displayed. If the key is empty, restart the cam-tenant-api pod.

4. Go to the Service catalog page. If the page shows an error, restart the following two pods:

   oc delete pod -l app=cam-service-library-ui-api
   oc delete pod -l app=cam-service-library-ui
   

If errors persist, contact IBM Support.

Skip this step if you are not using ChatOps.

If you are using ChatOps, run the following commands to pass in an updated URL and restart the deployments.

Run the following commands:

oc set env deployment/$(oc get deploy -l app.kubernetes.io/component=chatops-orchestrator -o jsonpath='{.items[*].metadata.name }') ZEN_URL=$CUSTOM_HOSTNAME
oc set env deployment/$(oc get deploy -l app.kubernetes.io/component=chatops-slack-integrator -o jsonpath='{.items[*].metadata.name }') ZEN_URL=$CUSTOM_HOSTNAME
oc set env deployment/$(oc get deploy -l app.kubernetes.io/component=chatops-teams-integrator -o jsonpath='{.items[*].metadata.name }') ZEN_URL=$CUSTOM_HOSTNAME

Where <new_url> is the new URL for the cp-console route that uses your custom hostname.

If the application is not available, then try the following checks:

1. Verify that the Domain Name System (DNS) is updated correctly.
2. Check certificate validity and check the Subject Alternative Names (SANs).
3. Review the ZenService status and logs.

If problems persist, contact IBM Support.