Installing IBM Cloud Transformation Advisor

Cluster Administration Tasks for an All Namespaces Operator Installation

The cluster administrator must perform the operator installation for both the Red Hat OpenShift UI installation and the CASE installation.

Cluster Administration Tasks for a Single Namespace Operator Installation

The cluster administrator must perform the following tasks:

1. Create a project for the operator and instance.

   This can be done from the OpenShift UI as follows:

   a. Click the hamburger icon of the Red Hat OpenShift Container Platform dashboard.
   b. Expand the Home menu and select Projects.
   c. Click Create Project.
   d. Name the project and click Create.

   Alternatively, you can use the oc new-project NAMESPACE_PLACEHOLDER command from the command line, where NAMESPACE_PLACEHOLDER is substituted for the actual name of the project you want to create.

2. Set up Role Based Access Control (RBAC) for Operator.

   The YAML in this section creates a ServiceAccount, OperatorGroup, Role, RoleBinding, ClusterRole and ClusterRoleBinding resource which together configure RBAC for the operator. Apply the YAML to your cluster:

a. Copy the YAML and replace all occurrences of NAMESPACE_PLACEHOLDER with the project that you are installing into.
b. Click the + button in the OpenShift UI and paste the YAML into the Import YAML window.
c. Click Create.

Alternatively, you can save the YAML to file, replace NAMESPACE_PLACEHOLDER with the project you are installing to, and create the resources using the oc apply -f <filename> command.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: ta-operator-sa
  namespace: NAMESPACE_PLACEHOLDER

---

apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: ta-ownnamespace-operator-group
  namespace: NAMESPACE_PLACEHOLDER
spec:
  targetNamespaces:
    - NAMESPACE_PLACEHOLDER

---

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ibm-transformation-advisor
  namespace: NAMESPACE_PLACEHOLDER
rules:
  - apiGroups: ["networking.k8s.io"]
    resources: ["networkpolicies"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: ["config.openshift.io"]
    resources: ["ingresses", "infrastructures", "dnses"]
    verbs: ["get"]
  - apiGroups: ["oauth.openshift.io"]
    resources: ["oauthclients", "oauthclients/finalizers"]
    verbs: ["get", "list", "create", "delete"]
  - apiGroups: ["operators.coreos.com"]
    resources: ["clusterserviceversions"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions", "customresourcedefinitions/finalizers"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get"]
  - apiGroups: ["batch"]
    resources: ["jobs"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: [""]
    resources: ["configmaps", "persistentvolumeclaims", "pods", "services", "secrets", "serviceaccounts", "events"]
    verbs: ["*"]
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["monitoring.coreos.com"]
    resources: ["servicemonitors"]
    verbs: ["get", "create"]
  - apiGroups: ["apps"]
    resourceNames: ["ta-operator"]
    resources: ["deployments/finalizers", "statefulsets/finalizers"]
    verbs: ["update"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get"]
  - apiGroups: ["apps"]
    resources: ["replicasets"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["ta.ibm.com"]
    resources: ["*"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["route.openshift.io"]
    resources: ["routes", "routes/custom-host"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]


---

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ibm-transformation-advisor
  namespace: NAMESPACE_PLACEHOLDER
subjects:
  - kind: ServiceAccount
    name: ta-operator-sa
roleRef:
  kind: Role
  name: ibm-transformation-advisor
  apiGroup: rbac.authorization.k8s.io

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: ibm-transformation-advisor
rules:
  - apiGroups: ["oauth.openshift.io"]
    resources: ["oauthclients", "oauthclients/finalizers", "consoleyamlsamples"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["console.openshift.io"]
    resources: ["consoleyamlsamples"]
    verbs: ["get", "list", "watch", "create", "update", "delete", "patch"]
  - apiGroups: ["config.openshift.io"]
    resources: ["ingresses", "infrastructures", "dnses"]
    verbs: ["get"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings", "clusterroles", "clusterroles/finalizers", "roles", "rolebindings", "roles/finalizers", "rolebindings/finalizers"]
    verbs: ["*"]
  - apiGroups: [""]
    resources: ["endpoints", "events"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: ["discovery.k8s.io/v1"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
  - apiGroups: ["network.openshift.io"]
    resources: ["netnamespaces", "clusternetworks", "egressnetworkpolicies"]
    verbs: ["get", "list", "watch", "create", "delete", "patch"]
---

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ibm-transformation-advisor-NAMESPACE_PLACEHOLDER
subjects:
  - kind: ServiceAccount
    name: ta-operator-sa
    namespace: NAMESPACE_PLACEHOLDER
roleRef:
  kind: ClusterRole
  name: ibm-transformation-advisor
  apiGroup: rbac.authorization.k8s.io

Install the operator using the Red Hat OpenShift UI

• Navigate the to Operators...OperatorHub in OpenShift navigation.
• Select the IBM Operator Catalog in the Source filter.
• Select the Transformation Advisor tile, filtering as necessary. Read the installation instructions and action as necessary.
• Click Install
• Choose the desired options and click Install

After a few minutes you should see confirmation that the operator has installed successfully. The Transformation Advisor operator is now available in the chosen namespace or all namespaces, depending on the install mode selected.

Option 1: Create the entitlement key secret with the OpenShift console

1. Obtain the entitlement key that is assigned to your IBMid. Log in to MyIBM Container Software Library with the IBMid and password details that are associated with the entitled software.
2. In the OpenShift console, ensure that you are in the Project (for example, my-project) that you installed the operator into.
3. Click Workloads > Secrets > Create, then select Image pull secret.
4. In the Secret name field, enter ibm-entitlement-key.
5. In the Registry server address field, enter cp.icr.io.
6. In the Username field, enter cp.
7. In the Password field, enter the credential that you received from entitlement.
8. (Optional) In the Email field, enter a contact email address.

Option 2: Create the entitlement key secret with the CLI

Obtain the entitlement key that is assigned to your IBMid. Log in to MyIBM Container Software Library Opens in a new tab with the IBMid and password details that are associated with the entitled software. In the Entitlement keys section, select Copy key to copy the entitlement key to the clipboard. From the Red Hat OpenShift CLI, run the following command to create an image pull secret called ibm-entitlement-key.

oc create secret docker-registry ibm-entitlement-key \
--docker-username=cp\
--docker-password=<entitlement-key> \
--docker-server=cp.icr.io \
--namespace=<namespace>

Where:

- `<entitlement-key>` is the entitlement key that you copied in step 2.
- `<namespace>` is the namespace that you want to install the Transformation Advisor instance in.

As an alternative to creating the ibm-entitlement-key secret, you may update the cluster's global pull secret using your entitlement key credentials. See https://docs.openshift.com/container-platform/4.9/openshift_images/managing_images/using-image-pull-secrets.html#images-update-global-pull-secret_using-image-pull-secrets for how to update the global pull secret. Due to a limitation in the product, if you use the global pull secret, you still need to add the imagePullSecret properties to the Transformation Advisor instance configuration (See Configuration for more details). In this case, the value you use for the properties does not have to exist as a secret.

Configuring the instance

• You will need to read and accept the license terms on the create instance page before you will be allowed to proceed with the install of the instance.

• The default configuration gives you most of what you need to install the product. Click the YAML View radio button to access the custom resource YAML. Update values in that YAML as required.

• You will need to configure the persistence before proceeding with the install. This can be done from the UI form view, or the YAML view. Please see the Configure Storage document for full details, including examples, of the persistence configuration.

• You may also need to add image pull secrets to access Transformation Advisor images in the entitled registry. See Create Entitlement Key and Planning section for more details on accessing images in the entitled registry.

See Configuration page for a full list of the configurations available in the custom resource YAML file.

• When you are happy with your configuration, click Create.

Access the Transformation Advisor UI

By default, the Transformation Advisor operator exposes the UI as a Route on OpenShift. Go to Networking - Routes and click the location of the ui-route.

Validating a successful install

To validate the installation, on the OpenShift UI navigate to the pods for the projects where Transformation Advisor is installed. You should see the following fours pods in a READY and Running state:

ta-couchdb-0
ta-neo4j-0
ta-server-<ID>
ta-ui-<ID>

Additionally, you should see the instance pre-install job in a "Completed" state:

ta-operator-instance-preinstall-<ID>

If you have performed a single namespace install, then you will also see the operator pod in a READY and Running state:

ibm-transformation-advisor-manager-<ID>

Navigate to the Transformation Advisor UI as described here. Click on the kebab icon on the top right of the Transformation Advisor UI and then click on "What's New". Confirm the Transformation Advisor version in the What's New dialog.