Installing IBM Optim Data Privacy by using offline mode

Phase 1: Download, extract, and transfer

Complete the following steps from your connected machine:

Step 1: Obtain an IBM Container Registry entitlement key

Step 2: Download and extract the installation archive

Step 3: Extract installation scripts from the MetaDB image

Step 4: Pull container images

Step 5: Package the directory and transfer to the target machine

Phase 2: Install on the target

Complete the following steps in your offline target environment:

Step 6: Prepare the target host environment

Step 7: Extract the transferred archive

Step 8: Configure the installation

Step 9: Run the setup script

Step 10: Verify the installation

Step 11: Set up a minimal Keycloak realm

1. In a web browser, open the IBM Container Registry site.
2. Click Add new key or copy an existing key, if available.
3. Save the key to use in the steps that follow.

1. Log in to ICR using your entitlement key:

   podman login cp.icr.io -u cp

   Enter your entitlement key as the password when prompted.

2. Create a temporary container from the MetaDB image and copy the scripts to your working directory:

   podman create --name temp-extract cp.icr.io/cp/ibm-optim/optim-metadb:2.0.0-amd64
   podman cp temp-extract:/tmp/releasepatch/. ./
   podman rm temp-extract

1. Run the image packaging script:

   ./scripts/optim-imagetar.sh

2. When prompted, provide the following input:
   • Image registry URL: Enter cp.icr.io/cp/ibm-optim
   • Image tag for standard images: Enter the release tag, for example 2.0.0-amd64
3. Wait for the script to complete. The script pulls all images, re-tags each image as localhost/ibm-optim/<name>:<tag> to match optim-compose.yaml, and saves each image to a .tar file in a container-images/ subdirectory.

• IBM-optim-core-api-2.0.0-amd64.tar
• IBM-optim-metadb-2.0.0-amd64.tar
• IBM-optim-runtime-2.0.0-amd64.tar
• IBM-optim-spark-2.0.0-amd64.tar
• IBM-optim-ui-2.0.0-amd64.tar
• IBM-optim-keycloak-2.0.0-amd64.tar
• IBM-optim-catalog-2.0.0-amd64.tar
• IBM-optim-flight-service-13.2.230-amd64.tar

1. From the parent of your working directory, create the transfer archive. For example, if your working directory is ~/optim:

   zip -r optim-offline-2.0.0.zip optim/

   Alternatively, use tar:

   tar -czf optim-offline-2.0.0.tar.gz -C ~ optim/

2. Transfer the archive to the target machine:

   scp optim-offline-2.0.0.zip user@target-machine-ip:~/

1. Log in as the non-root user that you plan to use to deploy IBM Optim, then run the following command to determine the user ID:

   id -u

   Save the user ID for later.
2. Log in as a root user.
3. Install the required operating system packages:

   dnf install -y curl podman podman-docker python3-pip slirp4netns fuse-overlayfs

4. Create the required Podman runtime directories. Replace <USER-ID> with the user ID you saved earlier.

   mkdir -p /run/user/<USER-ID> && chmod 700 /run/user/<USER-ID> && chown -R <USER-ID>:<USER-ID> /run/user/<USER-ID>

5. Enable lingering for the non-root user. Replace <USER-ID> with the user ID you saved earlier.

   loginctl enable-linger <USER-ID>

6. Log in as the non-root user, then install Podman Compose if it is not already installed:

   pip3 install podman-compose --user

7. Set the runtime base directory environment variable:

   export XDG_RUNTIME_DIR=/run/user/$(id -u)

8. Enable the Podman container to auto-restart on boot:

   systemctl --user enable --now podman-restart.service

9. If you are using a non-root mounted disk to store Podman container images, export the Podman storage directories in the same shell session before continuing:

   export XDG_CONFIG_HOME=/mount-point/podman/config
   export XDG_DATA_HOME=/mount-point/podman/data

   Important: These variables must be set in the same shell session in which you run the setup script. They are not inherited by child processes and will fall back to root defaults if not set here. Ensure that the Podman directories on the mount point are already created and owned by this user. For setup instructions, see Using mounted or extended storage volumes.

unzip optim-offline-2.0.0.zip

tar -xzf optim-offline-2.0.0.tar.gz

cd optim

1. Create directories to store the following types of IBM Optim data:
   • Metastore (PostgreSQL) database files
   • Log files
   • Extract files
   • Job process job reports
   • Catalog metadata data stored in Apache Iceberg
   For example, to create a directory named /home/optim/data, run the following command:

   mkdir -p /home/optim/data

   Note: For guidance about data storage, including separating different data volumes, see Storage considerations.

   Take note of these directory paths. You will be prompted to provide them later.

2. Copy sample.env and name it .env:

   cp sample.env .env

3. Open the .env file for editing:

   vi .env

4. Locate the section labeled Required user-set variables.
5. Set following directory path parameters to point to the storage directories that you created earlier:
   Note: If the directories are already in use, ensure that they are owned by the designated installation user for IBM Optim Data Privacy.
   • OPTIM_METADB_DATA_DIR: Path to the directory where Metastore (PostgreSQL) database files are stored.
   • OPTIM_LOG_DIR: Path to the directory where log files are stored.
   • OPTIM_EXTRACT_DIR: Path to the directory where extract files are stored.
   • OPTIM_REPORT_DIR: Path to the directory where job process report files are stored.
   • OPTIM_CATALOG_DIR: Path to the Apache Iceberg catalog service's persistent metadata.
   Note: For guidance about data storage, including separating different data volumes and using mounted or external SAN/NAS volumes, see Storage considerations. If you are using a non-root mounted volume, review Using mounted or extended storage volumes before continuing.
6. Optional: Review the Default variables section and modify other parameters as needed:
   • OPTIM_UI_PORT (default value: 7780)
   • OPTIM_METADB_PORT (default value: 5432)
   • OPTIM_KEYCLOAK_PORT (default value: 7780)
7. Check your system to ensure that there are no port conflicts before saving the .env file.
8. Optional: Review the Keycloak configuration for identity and access management.

   The installation package includes minimal-optim-realm.json. To use it, rename the file to optim-realm.json in the realm/ folder before you run the setup script. For more information about defining IBM Optim Data Privacy users, see Step 11: Set up a minimal Keycloak realm.

1. Open a terminal in the working directory.
2. Run the setup script (no flags required for offline mode):

   ./scripts/setup-optim.sh

3. When prompted, provide the following input:
   • Select the product to install (Test Data Management, Data Privacy, or Archive).
   • Specify the product license type (enterprise, solution, or workgroup).
   • Accept the license agreement.
   • Provide passwords for the following:
     • Metastore (PostgreSQL) database
     • Keycloak administrator console
     • Certificate truststore
     Important: Password requirements:

     • All passwords must be at least 6 characters in length.
     • Passwords can only include ASCII characters.
     • If you are rerunning the installation script and an existing IBM Optim Data Privacy instance is set up, you must provide the same passwords as the initial installation. Failure to do so will prevent access to the existing Metastore database.
4. Wait for the script to complete. The script automatically performs the following actions:
   • Loads all container images from container-images/*.tar
   • Creates all required data directories
   • Generates a self-signed certificate and truststore to secure communication between containers
   • Initializes secrets for passwords and credential encryption
   • Starts the containers using Podman Compose (optim-compose.yaml)
   Important: Do not interrupt the script while it is running. Doing so can result in an incomplete setup.

podman-compose -f optim-compose.yaml up -d

• IBM Optim Metastore (PostgreSQL)
• IBM Optim Runtime Engine
• IBM Optim Core API
• IBM Optim web UI
• Keycloak (IAM)
• Apache Spark
• IBM Optim Catalog

1. Determine the IBM Optim UI URL in one of the following ways:
   • Copy the URL from the console output of the installation script.
   • Open the .env file and locate the OPTIM_UI_URL variable.
   • Run the following command to retrieve the URL value:

     cat .env | grep OPTIM_UI_URL

2. Copy the URL and paste it into a web browser.
3. Log in using the default administrator credentials:
   • user: user1
   • password: 123
   Note: After verifying installation, delete the default user and set up your own administrators and users. For more information, see Managing users and roles.
4. Confirm that the IBM Optim welcome page is displayed.

1. With the IBM Optim Data Privacy containers up and running, open a web browser and navigate to the Keycloak administrator console at https://<hostname>:8443.
2. Log in as the Keycloak administrator user.
   • The default administrator username is admin. You can verify this by running:

     cat .env | grep KC_ADMIN

   • Provide the administrator password that you defined during installation. If you used an auto-generated password, retrieve it by running:

     podman secret inspect optim-keycloak-secret --format '{{.SecretData}}'

3. Create a user for IBM Optim Data Privacy:
   1. From the Manage realms menu, choose Optim, then select Users > Add user.
   2. Type a username and provide any of the other optional information, then click Create.
   3. Click the Credentials tab, then click Set password.
   4. Select Groups > Join group and choose either admin-group or user-group.
   5. Create an organization and add users:
      1. Select Organization > Create organization. Type the organization name, domain, and description, then click Save.
      2. Click Attribute and add an account-id attribute with a unique or random UUID value (such as data-ai-01/75a10144-c57a-4c0a-889c-22044d012a9a).
      3. Click Members and then choose Add realm user. Choose the user that you want to add to the organization.