Activating Query Optimizer in IBM watsonx.data with limited privileges

For customers needing to run the Query Optimizer with limited privileges, IBM® watsonx.data now offers an option that uses the restricted-v2 Security Context Constraint (SCC). This mode eliminates the need for additional privileges or custom SCCs but requires the creation of a tethered namespace for the Query Optimizer.

About this task

Follow the steps in this instructions to activate Query Optimizer with limited privileges in watsonx.data.

Procedure

Run the following command to create a new empty project for the Query Optimizer tether namespace:
```
export OPT_TETHER_NS=<namespace>
oc new-project $OPT_TETHER_NS
```
Annotate the new namespace with specific GUID and UID ranges required by the Query Optimizer:
```
oc annotate ns $OPT_TETHER_NS --overwrite openshift.io/sa.scc.supplemental-groups=1001000000/10000 openshift.io/sa.scc.uid-range=1001000000/10000 openshift.io/sa.scc.mcs=s0:c27,c512
```
Attention: Changing a namespace UID range will alter the process ID that pods start with. This can break file permissions if pods have already created files owned by specific UIDs before the namespace was annotated. Therefore it is crucial to create a new, empty namespace with no pods in it for the Query Optimizer.

Use cpd-cli to set up the tethered namespace and link it with the Software Hub control plane. If you already have existing tethered namespaces, provide them as a comma-separated list in the --additional_ns= argument:

cpd-cli manage authorize-instance-topology \
--cpd_operator_ns=${PROJECT_CPD_INST_OPERATORS} \
--cpd_instance_ns=${PROJECT_CPD_INST_OPERANDS} \
--additional_ns=${OPT_TETHER_NS}

cpd-cli manage setup-instance \
--release=${VERSION} \
--license_acceptance=true \
--cpd_operator_ns=${PROJECT_CPD_INST_OPERATORS} \
--cpd_instance_ns=${PROJECT_CPD_INST_OPERANDS} \
--tethered_instance_ns=${OPT_TETHER_NS} \
--block_storage_class=${STG_CLASS_BLOCK} \
--file_storage_class=${STG_CLASS_FILE} \
--run_storage_tests=false

cpd-cli manage setup-tethered-ns \
--cpd_instance_ns=${PROJECT_CPD_INST_OPERANDS} \
--tethered_instance_ns=${OPT_TETHER_NS}

Patch watsonx.data with the tethered namespace and the privilege setting for the Query Optimizer:

oc patch wxdaddon/wxdaddon \
  --type=merge \
  -n ${PROJECT_CPD_INST_OPERANDS} \
  -p '{ "spec": { 
    "optimizer": {
      "namespace": "ibm-lh-tether", 
      "privileged": false
  } } }'

Install the Query Optimizer by following the instructions in Activating Query optimizer in IBM watsonx.data.