Preparing your cluster

Edit online

Prepare your cluster for the installation of Netcool® Operations Insight® on Red Hat® OpenShift®.

Complete the following steps to prepare your cluster.

Provision the required machines.
The hardware architecture on which Netcool Operations Insight is installed must be with x86 based architecture, like AMD64 and Intel. Kubernetes can have a mixture of worker nodes. For operating system and other detailed system requirements, search for the latest version of the Netcool Operations Insight product in the Software Product Compatibility Reports website: https://www.ibm.com/software/reports/compatibility/clarity/softwareReqsForProduct.html.
Download and install Red Hat OpenShift.
Netcool Operations Insight must be installed by a user with administrative access on the cluster, so ensure that you have access to an administrator account on the target Red Hat OpenShift cluster.
For Red Hat OpenShift documentation, see https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/

For Red Hat OpenShift videos, see: https://www.youtube.com/user/rhopenshift/videos

Install the Red Hat OpenShift command line interface (oc) on your cluster's boot node. Run the oc login command. For more information, see Getting started with the OpenShift CLI in the Red Hat OpenShift documentation.
During Red Hat OpenShift installation, if an OpenShift proxy is being defined, add the IP address of the Kubernetes service in the noProxy definition of the Proxy object.
1. Run the following command to get the list of services:
```
oc get svc -n default
```
  The IP address of the Kubernetes service is displayed, for example 172.30.0.1.
2. Use the oc edit command to modify the Proxy object:
```
$ oc edit proxy/cluster
```
3. Configure the Kubernetes service IP address in the noProxy parameter for the proxy, as in the following example:
```
apiVersion: config.openshift.io/v1
kind: Proxy
metadata:
  name: cluster
spec:
  httpProxy: http://<username>:<pswd>@<ip>:<port>
  httpsProxy: http://<username>:<pswd>@<ip>:<port>
  noProxy: example.com, 172.30.0.1
  readinessEndpoints:
  - http://www.google.com
  - https://www.google.com
  trustedCA:
    name: user-ca-bundle
```
Create a custom namespace to deploy into.
```
oc create namespace namespace
```
Where namespace is the name of the custom namespace that you want to create.
Optional: If you want multiple independent installations of Netcool Operations Insight within the cluster, then create multiple namespaces within your cluster. Run each installation in a separate namespace. Additional disk space and worker nodes are required to support multiple installations.
Create a docker registry secret to enable your deployment to pull Netcool Operations Insight images from the IBM® Entitled Registry.
1. Obtain the entitlement key that is assigned to your IBM ID which will grant you access to the IBM Entitled Registry. Log into https://myibm.ibm.com/products-services/containerlibrary with the account (username and password) that has entitlement to IBM software. The key that is displayed is the key that will be used when accessing the Entitled Registry.
2. Select Copy key to copy the entitlement key to the clipboard, in the Entitlement keys section.
3. Run the following command to create the entitlement key secret:
```
oc create secret docker-registry noi-registry-secret \
--docker-username=cp \
--docker-password=entitlement_key \ 
--docker-server=cp.icr.io \
--namespace=namespace
```
Where:
- noi-registry-secret is the name of the entitlement key secret that you are creating to pull the Netcool Operations Insight images from the IBM® Entitled Registry. Suggested value is noi-registry-secret.
- entitlement_key is the entitlement key that you copied in the previous step.
- namespace is the namespace that you want to deploy Netcool Operations Insight in.
Note: This step assumes that the cluster has internet access to: cp.icr.io, which is IBM's Entitled Registry. An exemption is typically made available for this along with other registries. If a connection to these registries is not permitted due to security constraints, then a production grade Docker 2 compatible image registry must be provided and an airgap installation performed to mirror the external image registries internally. For more information, see Installing Event Manager in an air-gapped environment (offline) with the oc-ibm_pak plug-in and a bastion host for a full cloud install, or Installing Event Manager in an air-gapped environment (offline) with the oc-ibm_pak plug-in and a bastion host for a hybrid install.
Ensure that your Red Hat OpenShift environment is updated to allow network policies to function correctly.
In some Red Hat OpenShift environments an additional configuration is required to allow external traffic to reach the routes. This is due to the required addition of network policies to secure pod communication traffic. For example, if you are attempting to access a route which returns a 503 Application Not Available error, then a network policy may be blocking the traffic. Check if the ingresscontroller is configured with the endpointPublishingStrategy: HostNetwork value by running the command
```
oc get ingresscontroller default -n openshift-ingress-operator -o yaml
```
If endpointPublishingStrategy.type is set to HostNetwork, then the network policy will not work against routes unless the default namespace contains the selector label. To allow traffic, add a label to the default namespace by running the command:
```
oc patch namespace default --type=json -p '[{"op":"add","path":"/metadata/labels","value":{"network.openshift.io/policy-group":"ingress"}}]'
```
For more information, see About network policy in the Red Hat OpenShift documentation.
(Optional) You can restrict the Netcool Operations Insight pods in a namespace to only run on worker nodes with a specific tag. You can tag worker nodes by adding the tag env=test or app=noi. For example, you can run the command:
```
oc label nodes <yournode> app=noi
```
and then edit the YAML on the Netcool Operations Insight namespace by adding the node-selector to the annotations section. You can run the following command to edit the YAML:
```
oc edit ns <namespace-name>
```
The result is:
```
apiVersion: v1
kind: Namespace
metadata:
 name: <namespace-name>
 annotations:
   scheduler.alpha.kubernetes.io/node-selector: app=noi
spec: {}
status: {}
```