Migrating to another instance and upgrading OpenPages with an internal database

You can migrate OpenPages to a new cluster that is running a later version of OpenPages.

Do this task when you want to upgrade OpenPages and you want the upgraded version to run on a new cluster.

Note: This topic applies only to environments that use an internal database.

Before you begin

The running instance of OpenPages on IBM Cloud Pak® for Data 4.8.x or 5.0.x is the source instance for the migration.
You have a new instance of OpenPages on IBM® Software Hub 5.1.x that is at a higher version than your source instance. This is the target instance for the migration.
For the target, use a new instance of OpenPages.

Important: All OpenPages data on the target instance is replaced with the content from the source instance.
The status of OpenPages is Completed in both the source and target environments.
You have a local system from which you can access both the source and target environments.
Do these steps during a maintenance window for the source environment. Ensure that no long-running processes, such as FastMap imports, are in progress.
Important: Ensure that users do not log in and that no processes run during the backup.

About this task

You can do this task for the following versions:

Source version	Target version
5.0.x 4.8.x	You can migrate to 5.4.0 or later

Complete all backup steps within a short time frame to ensure that the database and the application are in sync. Similarly, do all restore steps within a short time frame.

Note: The target OpenPages instance starts and stops during the migration.

To migrate and upgrade OpenPages, do the following tasks:

Backing up your source environment

About this task

Do the following steps in your source environment.

Procedure

Log in to your Red Hat® OpenShift® cluster as an instance administrator:
```
oc login OpenShift_URL:port
```
Change to the project where OpenPages is installed:
```
oc project ${PROJECT_CPD_INST_OPERANDS}
```
Get the OpenPages instance ID.
To get the instance ID, run the following command:
```
oc get openpagesinstance <source_openpagesinstance_name> -o jsonpath="{.spec.zenServiceInstanceId}"
```
Replace <source_openpagesinstance_name> with the name of your source OpenPages instance.
Set up and source the following environment variables.
- Set ${SOURCE_OPENPAGES_INSTANCE_ID} to the ID of your source OpenPages instance.
- Set ${SOURCE_OPENPAGES_INSTANCE_NAME} to the name of your source OpenPages instance.
- Set ${SOURCE_OPENPAGES_INSTANCE_NAMESPACE} to the project where your source OpenPages instance is installed.
- Set ${BACKUP_DIR} to /mnt/backup/online/

Back up the encryption keys in the source environment.

Do these steps so that the backup files can be decrypted in the target environment and so that the target environment has the same secrets as the source environment.

Run the following command:

oc exec -it c-db2oltp-${SOURCE_OPENPAGES_INSTANCE_ID}-db2u-0 -- /bin/bash

Type cd. You are now in the home directory of the db2inst1 user.

Locate the encryption keys by running the following command:

gsk8capicmd_64 -cert -list -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed

Look for a result that is similar to the following text:

* default, - personal, ! trusted, # secret key
#       DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.51.55_81D83D47
#       DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.56.05_AF8AC2F5

Extract the keys from the keystore by running the following command:

gsk8capicmd_64 -secretkey -extract -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -target <label>.sec -format pkcs12 -label <label>

Replace <label> with each of the DB2_SYSGEN_db2inst1_OPX_* entries from step 5.c.

For example:

gsk8capicmd_64 -secretkey -extract -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -target DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.51.55_81D83D47.sec -format pkcs12 -label DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.51.55_81D83D47
gsk8capicmd_64 -secretkey -extract -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -target DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.56.05_AF8AC2F5.sec -format pkcs12 -label DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.56.05_AF8AC2F5

Note the <label> of each key. You need this information later.

Copy each key to your local system:

oc cp -n ${SOURCE_OPENPAGES_INSTANCE_NAMESPACE}  c-db2oltp-${SOURCE_OPENPAGES_INSTANCE_ID}-db2u-0:/mnt/blumeta0/home/db2inst1/<label>.sec ./<label>.sec

Back up the database.
Do the following task: Backing up a Db2 database offline.
For the backup_dir, use /mnt/backup/offline/.
Copy the ${BACKUP_DIR} directory to a local system that can access both the source and target environments.
```
oc cp c-db2oltp-${SOURCE_OPENPAGES_INSTANCE_ID}-db2u-0:/${BACKUP_DIR}/ .
```
You now have the backups of the database and the keystore files on your local system.
Back up the application by running the following commands.
1. Scale to 1 replica.
```
oc scale --replicas=1 sts/openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-sts
```
2. Log in to the application server pod and open a terminal.
```
oc exec -it openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-sts-0 -- /bin/bash
```
3. Create the /openpages-shared/temp directory.
```
mkdir -p /openpages-shared/temp
```
4. Back up the openpages-storage directory to the /openpages-shared/temp directory.
```
cd /opt/ibm/OpenPages/aurora/bin
./OPBackup.sh /openpages-shared/temp nosrvrst
```
  Important: Do not use the /openpages-shared/openpages-backup-restore directory for this command.
5. Back up the application configuration.
```
cd /opt/ibm/OpenPages/aurora/bin
./OPBackup.sh /openpages-shared/openpages-backup-restore app-cp4d nosrvrst
```
You now have the following backups:
- The openpages-storage backup file is in the /openpages-shared/temp directory.
- The application configuration backup file is in the /openpages-shared/openpages-backup-restore directory.
Make a note of each backup file name.

Copy the application backup files to your local system that has access to both the source and target environments.

Copy the backup of the openpages-storage directory by running the following command:

oc cp -n ${SOURCE_OPENPAGES_INSTANCE_NAMESPACE} openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-sts-0:/openpages-shared/temp/<Backup_File_Name> <Backup_File_Name>

Copy the backup of the application configuration by running the following command:

oc cp -n ${SOURCE_OPENPAGES_INSTANCE_NAMESPACE} openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-sts-0:/openpages-shared/openpages-backup-restore/<Backup_File_Name2> <Backup_File_Name2>

Get the secrets from the source environment. Make a note of each key and the value of its secret.
1. Get the encryption key secret.
```
oc get secret openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-platform-secret -o jsonpath="{.data.encryption-key-pw}
```
2. Get the keystore secret.
```
oc get secret openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-platform-secret -o jsonpath="{.data.keystore-pw}
```
3. Get the opsystem user secret.
```
oc get secret openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-platform-secret -o jsonpath="{.data.opsystem-pw}
```
4. Get the secrets for the default user accounts.
  Do this step, for example, if you did not change the initial password of a user account and you want to migrate the initial secret to your target instance. To get the secret, run the following command for each secret that you want to migrate:
```
oc get secret openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-initialpw-secret -o jsonpath="{.data.<username>}"
```
  For example, to get the secret for the OpenPagesAdministrator user, run the following command:
```
oc get secret openpages-${SOURCE_OPENPAGES_INSTANCE_NAME}-initialpw-secret -o jsonpath="{.data.OpenPagesAdministrator}"
```
You now have a list of keys and their secrets. Verify that you have the following information:
- The secret for encryption-key-pw.
- The secret for keystore-pw.
- The secret for opsystem-pw.
- The secrets for the default user accounts, if you want to migrate these secrets.

Restoring in the target environment

Before you begin

Verify that you have the following items:

You have the backup .zip file that contains the openpages-storage directory.
You have the backup .zip file that contains the application configuration.
The ${BACKUP_DIR} on your local system contains the two keystore files and the database backup.
You have a list of keys and their secrets.
- The secret for encryption-key-pw.
- The secret for keystore-pw.
- The secret for opsystem-pw.
- The secrets for the default user accounts, if you want to migrate these secrets.

About this task

Do the following steps in the target environment.

Procedure

In your target environment, log in to your Red Hat OpenShift cluster as an instance administrator.
```
oc login OpenShift_URL:port
```
Change to the project where OpenPages is installed:
```
oc project ${PROJECT_CPD_INST_OPERANDS}
```
Get the ID of your target OpenPages instance.
To get the instance ID, run the following command:
```
oc get openpagesinstance <target_instance_name> -o jsonpath="{.spec.zenServiceInstanceId}"
```
Replace <target_instance_name> with the name of your target OpenPages instance.
Set up and source the following environment variables.
- Set ${TARGET_OPENPAGES_INSTANCE_ID} to the ID of your target OpenPages instance.
- Set ${TARGET_OPENPAGES_INSTANCE_NAME} to the name of your target OpenPages instance.
- Set ${TARGET_OPENPAGES_INSTANCE_NAMESPACE} to the project where your target OpenPages instance is installed.
Copy the /mnt/backup/online/ directory from your local environment to the target environment.
```
oc cp OPX.0.db2inst1.DBPART000.<timestamp>.001 c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0:/mnt/backup/online/ . --retries=-1
```
The /mnt/backup/online/ directory in your target environment now contains the database backup.

Import the encryption keys to the target environment.

Copy the encryption key labels to the target Db2 container by running the following command:
```
oc cp -n ${TARGET_OPENPAGES_INSTANCE_NAMESPACE} <label>.sec c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0:/mnt/backup/online 
```
Run the command for each <label> that you backed up. (See step 5.)

Run the following command:

oc exec -it c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0 -- /bin/bash

Import the encryption keys by running the following command for each key.

The <label> must match the <label> from the source environment.

gsk8capicmd_64 -secretkey -add -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -label <label> -format pkcs12 -file <key_file_path_and_name>

Run the command for each key that you backed up. (See step 5.)

For example:

gsk8capicmd_64 -secretkey -add -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -label DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.51.55_81D83D47 -format pkcs12 -file /tmp/seckey/DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.51.55_81D83D47.sec
gsk8capicmd_64 -secretkey -add -db /mnt/blumeta0/db2/keystore/keystore.p12 -stashed -label DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.56.05_AF8AC2F5 -format pkcs12 -file /tmp/seckey/DB2_SYSGEN_db2inst1_OPX_2024-10-19-17.56.05_AF8AC2F5.sec

Restart the application server pod by running the following commands:

oc scale --replicas=0 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts
oc scale --replicas=1 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts

Copy the openpages-storage backup file to your target environment, and then restore openpages-storage.
1. Copy the backup file to your target environment.
```
oc cp -n ${TARGET_OPENPAGES_INSTANCE_NAMESPACE} <backup_file_path_and_name> openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts-0:/openpages-shared/openpages-backup-restore/<backup_file_name>
```
2. Log in to the application server pod and open a terminal.
```
oc exec -it openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts-0 -- /bin/bash
```
3. Go to the /openpages-shared/openpages-backup-restore directory.
4. Verify that the backup file that you copied is the most recent op_backup_<timestamp>.zip file in the directory.
5. Get the database password by running the following command:
```
export OPDB_PASSWORD="$(cat "${SECRETS_PATH}/op-db-secret/openpage-pw")"
```
6. Run the following commands:
```
cd /opt/ibm/OpenPages/aurora/bin
./OPRestore.sh <backup_filename_without_the_file_extension> 
```
  For example, if the openpages-storage backup is in op_backup_2024_10_20_21_43_04.zip, the commands are:
```
cd /opt/ibm/OpenPages/aurora/bin
./OPRestore.sh op_backup_2024_10_20_21_43_04
```
  The openpages-storage directory from your source instance is restored in your target instance.
7. Remove the openpages-storage backup file from the /openpages-shared/openpages-backup-restore directory.
Copy the application configuration backup file to your target environment.
1. Copy the backup file to the /openpages-shared/openpages-backup-restore directory in your target environment.
```
oc cp -n ${TARGET_OPENPAGES_INSTANCE_NAMESPACE} <backup_file_path_and_name> openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts-0:/openpages-shared/openpages-backup-restore/<backup_file_name>
```
2. Verify that the backup file is the most recent backup file in the /openpages-shared/openpages-backup-restore directory.
3. Restart the application server pod by running the following commands:
```
oc scale --replicas=0 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts
oc scale --replicas=1 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts
```
  The application configuration from your source instance is restored in your target instance.
  You do not need to wait for the application pod to be ready. You can continue to the next step.
Stop the application server pods.
1. Scale down to 0 replicas.
```
oc scale --replicas=0 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts
```
2. Wait until all application server pods are deleted.
Restore the database.
1. Log in to the database server pod.
  Run the following command:
```
oc exec -it c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0 -- /bin/bash
```
2. Do the steps in the following task: Restoring Db2 from an offline backup using commands.
  
  For ${DBNAME}, use OPX.
  
  For backup_dir, use /mnt/backup/offline/.
  
  The database from your source instance is restored in your target instance.
3. Verify the schema version of the database.
```
oc exec -it c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0 -- /bin/bash
db2 connect to ${DBNAME}
db2 "select * from openpage.schemaversion"
```
  The result shows the schema version of your source environment.
The database in your target environment now has the data from your source environment.
Restore the secrets in the target environment.
1. Run the following command to edit the secrets:
```
oc edit secrets openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-platform-secret -n ${TARGET_OPENPAGES_INSTANCE_NAMESPACE}
```
2. Update the values of the following secrets:
  - encryption-key-pw.
  - keystore-pw.
  - opsystem-pw.
3. If you want to restore the initial secrets for the default user accounts, run the following command:
```
oc edit secrets openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-initialpw-secret
```
  Update the values of the secrets.
The secrets from your source environment are restored in your target environment.

Upgrading

Before you begin

An administrator must set up the required permissions for the user who will do the upgrade. If the user has cpd admin or cluster access, then they can complete the steps to upgrade.

You can use the following example commands as a guide. These examples assume that the user doesn’t have any permission set.

These commands must be run by an admin user of the cluster who has the required permissions to run these commands on the user's account.

Replace the following values to give the user the permissions to upgrade: <cpd_instance_ns>: Your target cluster’s instance namespace. <tenant_user>: The user who will do the upgrade. <openpages_instance_id>: The ID of the target instance.

Create the roles with the required permissions:

oc create role crud-pod-role --verb=get,list,create,update,watch,patch --resource=pod -n <cpd_instance_ns>
oc create role crud-pod-exec-role --verb=get,list,create,update,watch,patch --resource=pods/exec -n <cpd_instance_ns>
oc create role crud-pod-log-role --verb=get,list,create,update,watch,patch --resource=pods/log -n <cpd_instance_ns>
oc create role read-ns --verb=get,list,watch --resource=namespace -n <cpd_instance_ns>

Add the roles to the user:

oc adm policy add-role-to-user crud-pod-role tenant_user --role-namespace= <cpd_instance_ns> -n <cpd_instance_ns>
oc adm policy add-role-to-user read-ns tenant_user --role-namespace= <cpd_instance_ns> -n <cpd_instance_ns>
oc adm policy add-role-to-user crud-pod-exec-role tenant_user --role-namespace= <cpd_instance_ns> -n <cpd_instance_ns>
oc adm policy add-role-to-user crud-pod-log-role tenant_user --role-namespace= <cpd_instance_ns> -n <cpd_instance_ns>

Add the SCCs to the user:

oc adm policy add-scc-to-user privileged <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user rook-ceph-csi <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user restricted  <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user anyuid  <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user restricted-v2  <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user nonroot-v2  <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user nonroot  <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user noobaa-db <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user noobaa-endpoint <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user hostmount-anyuid <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user machine-api-termination-handler <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user hostnetwork-v2 <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user hostnetwork <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user hostaccess <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user zen-ns-c-db2oltp-<openpages_instance_id>-scc <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user rook-ceph <tenant_user> -n <cpd_instance_ns>
 oc adm policy add-scc-to-user node-exporter <tenant_user> -n <cpd_instance_ns>

About this task

These steps upgrade the OpenPages data that you restored from your source environment. Do all of these steps on the target cluster.

Procedure

Get the cluster service version by running the following command:
Replace PROJECT_CPD_INST_OPERATORS with the namespace where the operators are installed on the target cluster.
```
oc get csv ${PROJECT_CPD_INST_OPERATORS} | grep openpage
```

Scale down to 0 replicas and delete the OpenPages operator.

oc scale --replicas=0 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts
oc delete subscription.operators.coreos.com/ibm-cpd-openpages-operator clusterserviceversion.operators.coreos.com/ibm-cpd-openpages-operator.v<cluster_service_version> -n PROJECT_CPD_INST_OPERATORS

Patch the instance by running the following command.
```
oc patch openpagesinstance  ${openpages_instance_cr_name }  --type=merge -p '{"spec":{"run_debug_provisioner":true}}'
```
A new debug container pod is created. Wait for the pod to become ready.
Run the following commands to verify the database schema version.
```
oc exec -it c-db2oltp-${TARGET_OPENPAGES_INSTANCE_ID}-db2u-0 -- /bin/bash
db2 connect to ${DBNAME}
db2 "select * from openpage.schemaversion"
```
The expected result depends on the version of IBM Software Hub that you are using on the target cluster.
- 5.4.09.1.2.1-433
- 5.4.0 9.1.3.1-730

Scale the application server to one replica.

oc scale --replicas=1 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts

Configure another debug container to run the OpenPages data loader upgrade.

Use the following YAML template to create a file named openpages_<target_openpagesinstance_name>-debug-upgrade_loader_data.yaml.

apiVersion: v1
kind: Pod
metadata:
  name: openpages-<target_openpagesinstance-name>-provision-db-debug
  namespace: <target_openpagesinstance-namespace>
spec:
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: kubernetes.io/arch
            operator: In
            values:
            - amd64
  automountServiceAccountToken: false
  containers:
  - command: ["/bin/sh", "-ec", "<script_name>.sh"]
    env:
    - name: INSTANCE_ID
      value: "<target_openpagesinstance_id>"
    - name: INSTANCE_NAME
      value: <target_openpagesinstance-name>
    - name: ZEN_CONTROL_PLANE_NS
      value: <instance-namespace>
    - name: INSTANCE_NAMESPACE
      value: <instance-namespace>
    - name: OP_CONTEXT_ROOT
      value: openpages-<target_openpagesinstance-name>
    - name: OP_EXT_HOST
      valueFrom:
        configMapKeyRef:
          key: URL_PREFIX
          name: product-configmap
    - name: OP_EXT_PORT
      value: "443"
    - name: DATABASE_TYPE
      value: internal
    - name: OPDB_PORT
      value: "50001"
    - name: SCHEMA_VERSION
      value: "<openpages_schema_version>"
    - name: OPDB_ALIAS
      value: OPX
    - name: OPDB_USER
      value: openpage
    - name: OPDB_OWNER
      value: "db2inst1"
    image: cp.icr.io/cp/hub/openpages-cpd-provisioner@${PROVISIONER_IMAGE_DIGEST}
    imagePullPolicy: Always
    name: opdbprovisioner-pre-install-job-container
    resources:
      limits:
        cpu: 500m
        ephemeral-storage: 60Mi
        memory: 512Mi
      requests:
        cpu: 250m
        ephemeral-storage: 60Mi
        memory: 256Mi
    securityContext:
      allowPrivilegeEscalation: false
      runAsUser: 0
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/op-initialpw-secret
      name: op-initialpw-secret
    - mountPath: /var/run/op-platform-secret
      name: op-platform-secret
    - mountPath: /var/run/op-db-secret
      name: op-db-secret
    - mountPath: /var/run/sharedsecrets
      name: zen-service-broker-secret
    - mountPath: /var/run/certs
      name: internal-tls
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  imagePullSecrets:
  - name: ibm-entitlement-key
  nodeSelector:
    kubernetes.io/arch: amd64
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Never
  schedulerName: default-scheduler
  serviceAccount: zen-norbac-sa
  serviceAccountName: zen-norbac-sa
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  - effect: NoSchedule
    key: node.kubernetes.io/memory-pressure
    operator: Exists
  volumes:
  - name: op-platform-secret
    secret:
      defaultMode: 420
      items:
      - key: opsystem-pw
        path: opsystem-pw
      - key: encryption-key-pw
        path: encryption-key-pw
      secretName: openpages-<target_openpagesinstance-name>-platform-secret
  - name: op-db-secret
    secret:
      defaultMode: 420
      items:
      - key: openpage-pw
        path: openpage-pw
      - key: db2inst1-pw
        path: db2inst1-pw
      secretName: openpages-<target_openpagesinstance-name>-db-secret
  - name: op-initialpw-secret
    secret:
      defaultMode: 420
      secretName: openpages-<target_openpagesinstance-name>-initialpw-secret
  - name: zen-service-broker-secret
    secret:
      defaultMode: 420
      secretName: zen-service-broker-secret
  - name: internal-tls
    secret:
      defaultMode: 420
      items:
      - key: ca.crt
        path: certificate.pem
      - key: tls.crt
        path: tls.crt
      - key: tls.key
        path: tls.key
      secretName: internal-tls

Edit the YAML file and replace the following variables:
- <target_openpagesinstance_name>
- <instance_name>
- <target_openpagesinstance_id>
- <script_name>: Use upgrade_loader_data.

Create the debug container by running the following command:
```
oc apply -f openpages_${TARGET_OPENPAGES_INSTANCE_NAME}-provision-debug-upgrade_loader_data.yaml
```
Wait for the debug container job to complete successfully.
Install the OpenPages operator.
1. In the Red Hat OpenShift console, go to operatorHub and select the cpd operator namespace.
2. Search for the OpenPages operator.
3. Install the OpenPages operator. Select Specific namespace, and then select the cpd operator project.
4. Wait for operator to be ready and in a Running state.

Scale the application server to one replica.

oc scale --replicas=1 sts/openpages-${TARGET_OPENPAGES_INSTANCE_NAME}-sts

Verify the status of the OpenPages instance CR by running the following command.
```
oc get openpagesinstance ${TARGET_OPENPAGES_INSTANCE_NAME} -o json
```
The following example shows the expected result for IBM Software Hub 5.4.0:
```
openpagesBuildNumber: 9.1.3.1-X
openpagesStatus: Completed
reconciledVersion: 9.6.1
```