Tenants

On physical DataPower® appliances with the Tenant feature, you can create and manage tenants. The Tenant feature is available after you activate the Tenant Module from IBM® Passport Advantage®.

Tenants provide runtime-isolation and upgrade flexibility among API Connect and traditional DataPower workloads without business disruption. In other words, the landlord and tenants can run any combination of release independent but supported firmware versions. Each tenant uses a tenant-specific firmware image that is available from IBM Fix Central.

Attention: On 8496 appliances, you cannot install a firmware version earlier than 10.5.0.1.

To help you understand the architecture of a DataPower Gateway with tenants, you need to understand the term landlord. The landlord is the originally deployed DataPower Gateway. From the landlord, you can create two tenants.

To determine the number of tenants that can be installed and are installed, view the Tenant licenses status provider.

Generally you can configure and use all functions. However, the following caveats apply.

  • The tenant inherits the following settings from the landlord.
    Network interfaces.
    These configurations are read only to the tenant.
    Network settings.
    This configuration is read only to the tenant.
    Local time and date.
    You can independently manage the local time zone for each tenant.
    NTP service.
    This configuration is read only to the tenant.
    Activated features in modules with the following exceptions.
    • The self-balanced standby feature and integration with the z/OS® Sysplex Distributor that are part of the Application Optimization Module. Use of the Sysplex Distributor Target Control Service is deprecated.
    • B2B Module
    • IMS feature
    • TIBCO EMS (Tibco-EMS) feature
  • Even when the landlord has the following functions, the tenant cannot use and has no access to them.
    HSM
    Attention: Although tenants cannot use the HSM, in version 10.5.0.2 and earlier you needed to disable all hardware crypto features on a tenant.
    GUI
    1. In the search field, enter crypto.
    2. From the search results, click Crypto tools.
    3. Click the Disable crypto hardware tab.
    4. From the Crypto hardware disablement mode list, select All.
    5. Click Disable crypto hardware, and follow the prompts.
    CLI
    configure terminal
crypto
crypto-hw-disable all
    IPMI
    RAID storage
  • You cannot define the following configurations on tenants.
    • Access Manager client
    • NFS mounts
    • NFS poller handlers
    • WebSphere® JMS handlers
    • WebSphere JMS servers
  • You cannot run the following actions on a tenant. These actions are available to only the landlord.
    • The startup command
    • The tenant command
    • The tenant-install command

Network between the landlord and its tenants

When you change the firmware version or the appliance restarts, you must be aware of the following behavior.
Landlord
  • When the landlord restarts, the landlord and tenants are restarted. Network connections to tenants are unavailable until the landlord is up and running.
  • When the firmware for the landlord is reloaded, network connections to tenants are unavailable until the landlord is up and running.
  • When the landlord is stopped, the landlord and tenants are stopped. Network connections to tenants are unavailable until the landlord is up and running.
Tenant
  • When a tenant restarts, only this tenant is affected.
  • When a tenant firmware is reloaded, only this tenant is affected.
  • When a tenant is stopped, only this tenant is affected.

Reinitialization and tenants

You can run the reinitialize command on the landlord or on tenants. If you use the reinitialize command, you must be aware of the following behavior.
  • When you run the command on the landlord, the tenants and their connection details are deleted. However, the tenants themselves are not deleted. If you want to re-create these tenants, make sure that you have the appropriate artifacts for the tenants before you run the reinitialize command on the landlord.
    • When you want to re-create the tenants, make sure that you have the tenant names and all appropriate artifacts for the tenants before you run the reinitialize command on the landlord.
    • When you do not want to re-create the tenants, delete the tenant connection details from the landlord configuration.
  • When you run the reinitialize command on a tenant, its configuration is deleted. When the tenant restarts, the connection details that the landlord defines are in place. If you cannot connect to the tenant, complete the following steps on the landlord.
    1. Access the configuration that defines the tenant.
    2. Change Administrative state to Off, and click Apply.
    3. Change Administrative state to On, and click Apply.

Deleting a tenant

From the default domain of the landlord, delete a tenant and its firmware with the following steps.
  1. In the search field, enter tenant.
  2. From the search results, click Tenant.
  3. Select the tenant to delete.
  4. Click Submit.
  5. Click Apply to save changes to the running configuration.
  6. Click Save to save changes to the persisted configuration.