Set up FlashSystem.ai container

The FlashSystem.ai container enables the FlashSystem.ai assistant to interpret natural‑language queries and perform supported administrative tasks on IBM FlashSystem storage. The container runs entirely on customer-managed, on‑premises Kubernetes or OpenShift environment, and integrates securely with both IBM FlashSystem systems and IBM Storage Insights.

FlashSystem.ai requires an active IBM Storage Insights connection, using a Storage Insights API key and tenant ID. The container uses a secure proxy service through Storage Insights for language processing.

Environment requirements

Secure communication
To ensure secure interaction between FlashSystem systems and the container:
  • Use TLS‑protected communication end to end.
  • Install certificates trusted by both the FlashSystem and the FlashSystem.ai container.
  • Enable only the network paths necessary for FlashSystem.ai.
  • The Kubernetes ingress controller must expose a valid TLS endpoint and support WebSocket connections.
Deployment characteristics
  • Deploy the container in a customer-managed, on‑premises Kubernetes or OpenShift environment.
  • GPUs not required.
  • A single container instance can support multiple FlashSystem systems.
  • One container per grid is recommended.
Connectivity
FlashSystem.ai uses REST API and WebSocket protocols. Your environment must allow the following connections:
Table 1. Connectivity requirements
Direction Protocol Requirement
FlashSystem ↔ Container
  • HTTPS 443
  • WSS 443
  • Outbound to ingress endpoint
  • FlashSystem REST API
  • Bi-directional communication
Container → IBM Storage Insights HTTPS
  • Required for AI processing
  • Unidirectional communication

FlashSystem.ai does not connect to IBM Cloud services directly.

Required credentials

Configure the container with the following credentials:

From IBM Storage Insights
  • Storage Insights API key
  • Storage Insights tenant ID

For more information, see IBM Storage Insights User Access Management

From IBM FlashSystems
  • One administrator service account per FlashSystem
From IBM Cloud
  • IBM Cloud login credentials

TLS certificate configuration modes

This deployment uses two TLS layers:

  • Frontend TLS: The certificate that the Kubernetes Ingress or OpenShift Route presents to external clients.
  • Backend TLS: The certificate that enables TLS re-encryption between the ingress controller (or OpenShift router) and the application pod.
Choose a certificate mode before you start the installation. The mode determines which certificates and secrets need to be manually created.
Quick selection guide
  • Choose wildcard if you already have a default frontend ingress/router certificate that covers your hostname via wildcard or explicit CN/SAN naming.
  • Choose custom if you need to either create or can provide a certificate for frontend TLS.
  • Choose cert-manager if you want automated front and back end certificate issuance and cert-manager is available in your target cluster.
Wildcard
Use Wildcard mode when your ingress controller or OpenShift router already provides a default TLS certificate that covers the application hostname. Examples:
  • A wildcard certificate such as *.example.com
  • A certificate whose CN or SAN includes the exact hostname that you will use
What happens in this mode
  • The ingress or router default certificate is used for frontend TLS.
  • You create the backend TLS secret before you install the chart.
You must do before installation
Create the backend TLS secret in the target namespace.
Custom

Use Custom mode when you want to provide a dedicated front-end certificate for this application, or when the ingress controller does not have a suitable default certificate.

What happens in this mode
  • You create the frontend TLS secret.
  • You create the backend TLS secret.
  • Both secrets must exist before you run helm install.
You must do before installation
  • Create the frontend TLS secret in the target namespace.
  • Create the backend TLS secret in the target namespace.
cert-manager

Use cert-manager mode when your cluster uses cert-manager to issue and renew certificates automatically.

What happens in this mode
  • cert-manager issues the frontend certificate by using your configured Issuer or ClusterIssuer.
  • The chart creates a self-signed Issuer for the backend certificate.
  • You do not create TLS secrets manually before installation.
  • After installation, you must wait until the certificates are ready.
OpenShift requirement
On OpenShift, after cert-manager issues the certificate, run 
helm upgrade
so the Route is updated with the generated certificate content.

Common setup

Complete these steps once before you follow any of the six installation paths.

  1. Create an IBM Cloud API key
    You need an IBM Cloud API key to authenticate to IBM Container Registry (icr.io).
    1. Sign in to https://cloud.ibm.com.
    2. Go to Manage > Access (IAM) > API keys.
    3. Select Create, enter a name for the key, and save the key value immediately. IBM Cloud shows the key only once and you cannot retrieve it later.
      Note:
      • You use this API key in the registry login and image pull secret steps. Treat the API key like a password. Do not store it in source control or share it in tickets or chat.
      • IBM Cloud requires a credit card to verify your account during account creation. FlashSystem.ai does not require payment.
  2. Pull and unpack the Helm chart
    Use iamapikey as the literal username. Do not replace it with your API key.
    
helm registry login icr.io --username iamapikey --password <YOUR_IBM_CLOUD_API_KEY>
helm pull oci://icr.io/flashsystem-ai-release/flashsystem-ai:1.1.0 --untar
cd flashsystem-ai
    Run the remaining commands from the extracted chart directory.
  3. Create the namespace or project
    Create the target namespace (Kubernetes) or project (OpenShift).
    Kubernetes
    kubectl create namespace flashsystem-app
    OpenShift
    oc new-project flashsystem-app
  4. Create the image pull secret
    Use iamapikey as the literal username. Do not replace it.
    Kubernetes
    kubectl create secret docker-registry icr-io \
  --docker-server=icr.io \
  --docker-username=iamapikey \
  --docker-password=<YOUR_IBM_CLOUD_API_KEY> \
    OpenShift
    oc create secret docker-registry icr-io \
  --docker-server=icr.io \
  --docker-username=iamapikey \
  --docker-password=<YOUR_IBM_CLOUD_API_KEY> \

Choose an installation path

After you select your platform and TLS certificate mode, and you complete the common setup for that platform, follow one installation section only.

Post-installation configuration

After deployment
  1. In a browser, go to the following URL:
    https://<APPLICATION_DNS_NAME>/setup
  2. Provide IBM Storage Insights tenant ID and API key
  3. Generate a management GUI key
  4. Register FlashSystem systems for management

Register each FlashSystem

Run the following command on each FlashSystem to connect it to the container:
svctask chaicontainerinfo -key <GUI_KEY> -url <APPLICATION_DNS_NAME>:443
svcinfo lsaicontainerinfo
where:
  • <GUI_KEY> comes from the setup page.
  • <APPLICATION_DNS_NAME> is a fully qualified DNS name that resolves to the external ingress endpoint.

Using FlashSystem.ai in the management GUI

After registration is complete and successful connectivity to the container:
  • The FlashSystem.ai icon appears in the management GUI.
  • Selecting the icon opens the AI assistant panel.
  • Each interaction creates a session that is associated with the logged‑in user.
  • Sessions end when the page is refreshed or when the user logs out.