For on-premise Netcool/OMNIbus ObjectServer

Preparing credentials for authentication

This section is only applicable if you are using either the AuthOnly or SSLAndAuth connection mode.

For the probe to connect with a secured ObjectServer, the probe must be configured with a valid credential otherwise the ObjectServer will reject the connection. The credentials will be set in a Secret for the pods to retrieve the secret and configure the probe. Follow the steps below to prepare the required files prior creating the Secret.

Contact your Netcool®/OMNIbus Administrator to obtain the credentials that should be used by probe clients to authenticate with the ObjectServer. Optionally, you can also request for an encrypted password with its encryption key file from the administrator to be used in the Secret.
Create a temporary workspace directory if necessary. The following steps use /tmp/probe as the workspace directory.
```
 # Create a temporary directory to mount to the container
 $ mkdir /tmp/probe
```
Create a new file called username.txt and insert the username string into the file. For example:
```
 echo -n "<probe_username>" > /tmp/probe/username.txt
```
Where <probe_username> is the username to authenticate with the ObjectServer
Verify that the following files are created in the temporary workspace directory.
- password.txt
- username.txt
```
 $ ls -1 /tmp/probe/
 password.txt
 username.txt
```

Extracting server certificates for SSL communication

For the probe to connect using SSL, the probe needs the server certificate in its key database in order to authenticate with the server when establishing a connection. The key database files are then put in a Secret. Follow the steps below to setup the key database files and add the server certificate.

This is section is only applicable if you are using either the SSLOnly or SSLAndAuth connection.

Contact your Netcool/OMNIbus Administrator to extract the SSL certificate from the server key database which will then be added into the key database of the probe client. Use the nc_gskcmd to extract the certificate from the server's key database on the server host, for example:
```
 $NCHOME/bin/nc_gskcmd -cert -extract \
 -db "$NCHOME/etc/security/keys/omni.kdb" \
 -pw password \
 -label "keylabel" \
 -target "$NCHOME/etc/security/keys/certname.arm"
```
Where password is the password for the key database, keylabel is the description of the certificate in the key database (specify this value as a quoted string), and certname is the name of the certificate that you want to extract.

Specify the path to the certificate as a quoted string. A sample command to extract the a root CA certificate with the label "NCOMS_CA" into the file ca.crt:
```
 $NCHOME/bin/nc_gskcmd -cert -extract \
 -db "$NCHOME/etc/security/keys/omni.kdb" \
 -pw password \
 -label "NCOMS_CA" \
 -target "$NCHOME/etc/security/keys/ca.crt"
```
Create a temporary workspace directory if necessary. The following steps uses /tmp/probe as the workspace directory.
```
 $ mkdir /tmp/probe
```
Copy the server certificate into the workspace directory.
```
 $ cp ca.crt /tmp/probe
```

Create a probe-server communication secret

After preparing the required files, use kubectl to create a secret generic command with the --from-file option to create a Kubernetes secret.

Depending on the connection mode that is required by the ObjectServer, create a Secret with the required fields. The secret name should contain the helm release name as a prefix for easy reference.

Example commands are shown below for each connection mode using probe as the release name to create a secret called probe-omni-secret in the noi-integrations namespace.

To create a secret for secured communication (AuthOnly connection mode):

 kubectl create secret generic probe-omni-secret \
 --namespace noi-integrations \
 --from-file=AuthUserName=/tmp/probe/username.txt \
 --from-file=AuthPassword=/tmp/probe/password.txt

To create a secret for SSL enabled communication (SSLOnly connection mode):

 kubectl create secret generic probe-omni-secret \
 --namespace noi-integrations \
 --from-file=ca.crt=ca.crt

To create a secret for SSL enabled and secured communication (SSLAndAuth connection mode):

 kubectl create secret generic probe-omni-secret \
 --namespace noi-integrations \
 --from-file=AuthUserName=/tmp/probe/username.txt \
 --from-file=AuthPassword=/tmp/probe/password.txt \
 --from-file=ca.crt=ca.crt

Note: Each field key must follow the expected names AuthUserName, AuthPassword, tls.crt and ca.crt are case sensitive. If any of the field key is misspelled, the pod might fail to mount to the secret to obtain the secret.

Remember to clean up this directory after you have successfully created the Kubernetes secret.