Migrating ML for IBM z/OS to Enterprise edition v3.2.0

If you are currently running ML for IBM z/OS® v3.1.0 Enterprise edition, you may migrate to the ML for IBM z/OS Enterprise edition v3.2.0. If you are already on ML for IBM z/OS v3.2.0 Enterprise edition from an earlier deliverable, such as APAR PH66196, you have the option to upgrade to the latest deliverable of v3.2.0 Enterprise edition, released as APAR PH69959.

Before you begin

The following procedure is intended for z/OS system programmers or administrators who will migrate MLz. Instructions apply to all installation options; differences are noted wherever they occur.

For ease of reference, v3.2.0 from an earlier deliverable and v3.1.0 are collectively referred to as <current-version>.

For PTF information, see https://www.ibm.com/support/pages/node/7003489.

Before you start the migration procedure, make sure that you complete the following tasks:

  • Update your current MLz system to meet all v3.2.0 requirements, including system capacity and prerequisites, and apply all mandatory maintenance packages (PTFs) as described in Installing ML for IBM z/OS.
  • Create a new $IML_HOME directory for v3.2.0 to which you will migrate and mount it to a zFS file system with a minimum of 10 GB storage available.
    Note: If you are already running v3.2.0 from an earlier deliverable, such as APAR PH66196, the new $IML_HOME directory should be used for the latest deliverable released as APAR PH69959.

    Verify that <mlz_setup_userid> or another ID you will use for this migration procedure has READ access to the current $IML_HOME directory and has READ and WRITE to the new $IML_HOME directory. See Configuring user ID for setting up Machine Learning for IBM z/OS Enterprise Edition for details about required permissions, environments, and system resources for the user ID.

  • If you migrate from v3.1.0 2023 June, August, and September maintenance level, in which you enable AT-TLS, you must create an AT-TLS policy for the Liberty scoring service and Python scoring service. For more information about the AT-TLS policy for MLz services, see Configuring AT-TLS for secure network connections with MLz.
    Note:

    You must create the AT-TLS policy before you restart the MLz services.

Procedure

  1. Back up your <current-version> code library in case that you need to fall back.
  2. Locate the v3.2.0 SMP/E images, PTFs, and Program Directories on your z/OS system.
  3. Follow the instructions in the Program Directory for ML for IBM z/OS Enterprise edition to run the SMP/E program and install MLz Enterprise.
    The SMP/E program installs MLz Enterprise in the default /usr/lpp/IBM/aln/v3r2/core directory and /usr/lpp/IBM/aln/v3r2/ent directory, which are referred to as $IML_INSTALL_DIR and $IML_INSTALL_ENT_DIR respectively.

    The core directory structure should look similar to the following example:

    |-- alnsamp
    |-- bin
    |-- configuration
    |   |-- defaults
    |   `-- 
    |-- extra
    |   |-- examples
    |   `-- log4j2.properties
    |-- iml-library
    |-- iml-services
    |-- iml-utilities
    |-- iml-zostools
    |-- nodejs
    |-- spark
    `-- usr
        |-- extension
        |   |-- installableApps
        |   |   `-- scoring-wola.war
        |   `-- lib
        |       `-- scoring-osgi_1.0.0.jar
        `-- servers
    |-- version.txt
    `-- zosmf-wf
     
    The enterprise directory structure should look similar to the following example:
    
    |-- cics-scoring
    |-- iml-onnx
    |-- iml-portal
    |-- imlpython
    |-- node_modules
    `-- pyz
    |-- trust-ai
    `-- version.txt
     
  4. Install the latest product updates (APARs and PTFs).
    For more information, see the Prerequisites and Maintenance for Machine Learning for IBM z/OS section in the IBM support portal.
  5. Store your Db2® credentials in CDA Cloud Credential Storage if your instance is using Db2 for z/OS as the repository. See Step 2 in Configuring MLz to use CDA cloud credential storage for details.
    Note: Starting with v3.2.0 release (APAR PH69959), MLz uses the z/OS CDA cloud credential storage to store the Db2 credentials used by the repository service.
  6. Store your Db2 and IBM Data Virtualization Manager for z/OS (DVM) batch deployment data source credentials in CDA if your instance contains existing batch deployments. See Step 2 in Configuring MLz to use CDA cloud credential storage for details.
    Note: Starting with v3.2.0 release (APAR PH72155), MLz uses the z/OS Cloud Data Access (CDA) cloud credential storage to retrieve the Db2 and DVM credentials used by batch deployments.
  7. Store your host credentials in CDA if your instance has Trustworthy AI or ONNX Compiler service(s) installed. See Step 2 in Configuring MLz to use CDA cloud credential storage for details.
    Note: Starting with v3.2.0 release (APAR PH69959), MLz uses the z/OS Cloud Data Access (CDA) cloud credential storage to store host credentials required for the Trustworthy AI and ONNX Compiler services.
  8. Create a unique MLz instance name. The migration step that you will perform in step 10, you will be prompted to enter the MLz instance name. See Managing MLz users and privileges for details. Before proceeding to the migration step, ensure that:
    • The user ID that will run the migration step is granted SYSADM privileges.
    • The user ID associated with the MLz Core Server has read access to the BPX.SERVER FACILITY class.
    Note: Starting with v3.2.0 release (APAR PH69959), MLz utilizes SAF profiles to manage MLz users and MLz instance name is part of the SAF profiles that authorize interactions with the instance.
  9. Stop all services and processes that are running on MLz. See Stopping and starting services running on ML for IBM z/OS for instructions.
    If you've configured the scoring service in a CICS® region, you must also stop the ALNSCSER server and discard the scoring service bundle by issuing the following CICS command:
    CEMT SET BUNDLE(ALNSCBDL) DISABLED
    CEMT SET JVMSERVER(ALNSCSER) DISABLED
    CEMT DISCARD BUNDLE(ALNSCBDL)
    CEMT DISCARD JVMSERVER(ALNSCSER)
  10. Backup your user profile and update the profile for user <mlz_setup_userid> or another ID of your choice. Refer to the $IML_INSTALL_DIR/alnsamp/profile.template,
    1. Set $JAVA_HOME to the directory where a version of IBM® 64-bit SDK for z/OS Java™ is installed. See Installing prerequisite hardware and software for ML for IBM z/OS for the list of MLz supported IBM Java on z/OS.
    2. Set $WLP_INSTALL_DIR to the directory where Liberty installation is installed. The default is /usr/lpp/liberty_zos/current.
    3. Set $IML_INSTALL_DIR to the directory where your ML for z/OS Core is installed. The default is /usr/lpp/IBM/aln/v3r2/core.
    4. Set $IML_HOME to the directory that is mounted with the zFS file system you allocated for v3.2.0.
    5. Set $IML_JOBNAME_PREFIX to define the prefix of the jobnames of all MLz services. See Customizing the prefix of a ML for IBM z/OS service jobname and Configuring user ID for setting up Machine Learning for IBM z/OS Enterprise Edition for more information.
    6. Set $SPARK_HOME to "${IML_INSTALL_DIR}"/spark.
    7. Set $AIE_INSTALL_DIR to the directory where the IBM Z Deep Neural Network Library (zDNN) is located on your z/OS system. See Configuring user ID for setting up Machine Learning for IBM z/OS Enterprise Edition for more information.
    8. Verify that the LIBPATH environment variable is correctly set as shown in the following example:
      LIBPATH=$LIBPATH:"${IML_INSTALL_DIR}"/iml-services/utils
    9. Remove or unset the ANACONDA_ROOT environment variable, which is no longer used.
    10. Remove the ANACONDA_ROOT reference from the PATH environment variable as shown in the following example:
      PATH=$PATH:"${ANACONDA_ROOT}"/bin
    11. Set $IML_INSTALL_ENT_DIR to the directory where ML for z/OS Enterprise is installed. The default is /usr/lpp/IBM/aln/v3r2/ent.
    12. Verify that the PATH environment variable is correctly set as shown in the following example if you have Python runtime configured:
      PATH=$PATH:"${IML_INSTALL_ENT_DIR}"/pyz/pyz-313/bin
    13. Verify that the LIBPATH environment variable is correctly set as shown in the following example if you have Python runtime configured:
      LIBPATH=$LIBPATH:"${IML_INSTALL_ENT_DIR}"/pyz/pyz-313/lib
    14. Add the following environment variables if you have Python runtime configured:
      export _TAG_REDIR_ERR=txt
      export _TAG_REDIR_IN=txt
      export _TAG_REDIR_OUT=txt
      
       
    15. Comment out the line source $IML_HOME/spark/conf/spark.profile if it exists.
    16. Issue the source .profile command to activate the changes.
    Note: If you are using started tasks to manage MLz services such as MLz UI, MLz core services, make sure the updated paths in the environment variables $JAVA_HOME, $IML_INSTALL_DIR, $IML_INSTALL_ENT_DIR, $IML_HOME, $AIE_INSTALL_DIR, $WLP_INSTALL_DIR, $SPARK_HOME, $PATH, $LIBPATH, _TAG_REDIR_ERR, _TAG_REDIR_IN, and _TAG_REDIR_OUT are also updated in started tasks stdenv file (for example, stdenvs-STDENV.template described in z/OS started tasks). Additionally, make sure that STDENV and ALNSERV are enhanced with any updates related to the installed version of the product.
  11. Run the aln-migrate.sh script in the $IML_INSTALL_DIR/alnsamp directory as shown in the following example:
    ./aln-migrate.sh 
    When prompted, respond or provide any required information that the script requests. The script will perform the following major tasks:
    1. Ask your old home which refers to the <current-version> $IML_HOME directory.
    2. Ask your RACF Keyring info to configure keyring-based keystore if file-based keystore is currently being used.
    3. Ask to verify your old Spark environment variables settings.
    4. Ask if opt-out Python.
    5. Ask your source to install Python packages if you choose not to opt-out Python.
    6. Ask your MLz instance name if not already defined in your old home deploy.cfg.
    7. Ask your host alias (either zcx-<hostAlias> or zlinux-<hostAlias> for host credentials stored in CDA cloud credential storage), LPAR name, and CPC name if the Trustworthy AI service is configured in your instance.
    8. Ask your host alias (either zcx-<hostAlias> or zlinux-<hostAlias> for host credentials stored in CDA cloud credential storage), LPAR name, and CPC name if the ONNX Compiler service is configured in your instance.
    9. Copy the content from the <current-version> $IML_HOME directory into the new v3.2.0 $IML_HOME directory.
    10. Update the configuration files of Python runtime, Spark runtime, and scoring service.
    11. Generate the staging configuration file trust-ai.cfg in $IML_HOME/migration for aln-post-migrate.sh to apply later if the Trustworthy AI service is configured in your instance.
      Note: Starting with v3.2.0 release (APAR PH69959), MLz introduces Service hosts in MLz Core services, each host represents a zCX environment that MLz will communicate with. A service host can be designated for one or more services, such as Trustworthy AI or ONNX Compiler. As a result, MLz moves the existing Trustworthy AI configuration from $IML_HOME to the MLz repository.
    12. Generate the staging configuration file onnx-compiler.cfg in $IML_HOME/migration for aln-post-migrate.sh to apply later if the ONNX Compiler service is configured in your instance.
      Note: Starting with v3.2.0 release (APAR PH69959), MLz introduces Service hosts in MLz Core services, each host represents a zCX environment that MLz will communicate with. A service host can be designated for one or more services, such as Trustworthy AI or ONNX Compiler. As a result, MLz moves the existing ONNX Compiler configuration from IML_HOME to the MLz repository.
    13. Reuse and reassign <current-version> network ports for v3.2.0.
    14. For the scoring service in a CICS region, the script will also update the ALNSCSER.jvmprofile file in your v3.2.0 $IML_HOME/cics-scoring/configuration/generated/<cics_region_name> directory. Copy the file to <JVMPROFILEDIR> used by the CICS region.

  12. Update the metadata table if you are using Db2 for z/OS as your repository.
    1. Run the gen-alnwmeta.sh script in the $IML_INSTALL_DIR/alnsamp directory and specify the -u option as shown in the following example:
      ./gen-alnwmeta.sh -u <version>

      where <version> is the version of MLz you upgraded from. If the upgrade is from the v3.2.0 deliverable released under APAR PH66196, specify 3.2.0.1. If the upgrade is from an earlier v3.2.0 deliverable, specify 3.2.0.

      The script generates sample JCL files ALNWMETA and ALNWMETA.037. The content of the files is the same but as their names indicate, their encoding is different, with the former in ASCII and the latter in IBM-037. Both files are stored in the $IML_HOME/alnsamp directory.

    2. Customize and run the JCL job to update the metadata table and other database objects. See Creating metadata objects for the Machine Learning for IBM z/OS Enterprise Edition repository service for instructions. If the upgrade is performed from v3.2.0 or v3.1.0, the ALTER statements in the job will place the associated tablespaces in ADVISORY REORG PENDING status, resulting in a return code of 04 (RC=04).
    3. If the upgrade is performed from version v3.2.0 or v3.1.0, run Db2 REORG on the tablespaces in your metadata database that are altered in the previous step. The following is a sample REORG statement:
      REORG TABLESPACE !ALNDB! <tablespace> COPYDDN SYSCOPY 
           SHRLEVEL REFERENCE
       

      where <tablespace> refers to the altered tablespaces – TSMDVERS and TSDPLOY.

      The REORG job for TSMDVERS will complete with a return code of 04 (RC=04), as they place two auxiliary tablespaces in COPY PENDING status.

      The REORG job for TSDPLOY will complete with a return code of 04 (RC=04), as they place three auxiliary tablespaces in COPY PENDING status.

    4. If the upgrade is performed from version v3.2.0 or v3.1.0, run a Db2 IMAGE COPY on the tablespaces that are in COPY PENDING status. The following is a sample COPY statement:
      COPY TABLESPACE !ALNDB!.<tablespace>
  13. Logout and login back in for the user profile update to take effect.
  14. Start v3.2.0 services and processes. See Stopping and starting services running on ML for IBM z/OS for instructions.
  15. If you run the scoring service in a CICS region, complete the following steps:
    1. Run the following command from the $IML_INSTALL_ENT_DIR directory to update the CICS scoring server configuration:
      cics-scoring/bin/server.sh config <cics_region_name>
    2. Copy the ALNSCSER.jvmprofile file from the $IML_HOME/cics-scoring/configuration/generated/<cics_region_name> directory to the <JVMPROFILEDIR> directory that the CICS region uses.
    3. Verify that your CICS region user ID (<cics_region_userid>) can read and write to the $IML_HOME/tmp and $IML_HOME/cics-scoring/configuration directories.
    4. Verify that the same user ID has Read access to the v3.2.0 $IML_INSTALL_ENT_DIR/cics-scoring/bundle directory.
    5. Modify the CICS scoring service bundle to point to your v3.2.0 $IML_INSTALL_ENT_DIR directory by issuing the following command:
      CEDA ALTER BUNDLE(ALNSCBDL) GROUP(ALNSCGRP)
      BUNDLEDIR($IML_INSTALL_ENT_DIR/cics-scoring/bundle)
    6. Start the ALNSCSER JVM server and the scoring service bundle as described in step 9 and step 10 in Configuring ML for IBM z/OS scoring services in a CICS region.
  16. Sign into the ML for IBM z/OS administration dashboard as a MLz sysadmin user and from the sidebar, navigate to the System management - Function level page.
  17. Activate new ML for IBM z/OS function level.

    When you open the Function level page, an administration dashboard service will check and display the MLz function and metadata levels on your z/OS system.

    If you are using Derby as your repository, it is already up to date. However, you can fall back to <current-version> if needed.

    If you are using Db2 as your repository, the current function level should be <current-version>. If the new function level is v3.2.0.26 (the latest v3.2.0 deliverable), you have the option to activate the new function level, do nothing, or fall back to <current-version>.

    Important: You cannot fall back to <current-version> after you activate the new v3.2.0 function level.
    • Activate the new v3.2.0 function level. Under the Action column, select Activate to update your function level to v3.2.0.26. After the process completes successfully, your MLz will be running at the latest v3.2.0 deliverable. You can perform normal machine learning activities, including creating, training, deploying, and scoring models.
    • Do nothing. Your MLz will be running in read-only mode. You can continue running the existing scoring workload for testing purpose, but you cannot create, train, or deploy models.
    • Fall back to <current-version>. In this case, complete the following steps to revert your MLz installation and environment back to <current-version>:
      1. Stop all v3.2.0 services and processes that are currently running on z/OS, including those of scoring service. See Stopping and starting services running on ML for IBM z/OS for instructions.
      2. Switch the user profile back to the original one and issue a source .profile command to update the environment.
      3. Remove the AT-TLS policy you just added for your Liberty scoring service and Python scoring service.
      4. Start all <current-version> services and processes.

        You do not need to revert metadata level from v3.2.0.26 to <current-version>. The <current-version> code is forward compatible with v3.2.0 metadata objects.

  18. Update the default runtime environment: Update the default runtime environment for your MLz v3.2.0.
    1. Follow the instructions in Adding a runtime environment to the administration dashboard to create a new runtime environment.
    2. Select z/OS Spark 4.0 or z/OS Spark 4.0 with Python as the runtime environment type.
    3. On the Runtime environments page, select the new runtime environment and from the Action menu action menu, select Enable to make it the default.
    4. Remove any existing Python-related runtime environment from the Runtime environments page.
  19. Run post-migration script: Run aln-post-migrate.sh script in the $IML_INSTALL_DIR/alnsamp directory to apply the Trustworthy AI and ONNX Compiler service from the staging files under new $IML_HOME/migration if they are configured in your instance.
    ./aln-post-migrate.sh
     
  20. Optional: Configure JupyterHub: Run the model-dev-environment.sh in the $IML_INSTALL_ENT_DIR/imlpython/bin directory to configure JupyterHub if you are migrating from v3.1.0.
    Note: In v3.2.0, JupyterHub replaces the Jupyter Notebook server.
  21. Optional: Update scoring service configuration: Run the server.sh in the $IML_INSTALL_DIR/bin directory to update the scoring service configuration file with the cluster_ip setting if the scoring service was created prior to the v3.2.0 release under APAR PH66196 and is missing the cluster_ip setting:
    ./server.sh update <name>

    From the update main menu, choose option 2, and then select option 2 from the sub-menu to update the cluster host. You will be prompted to enter IP address or host name of your Sysplex scoring cluster or press <enter> to leave blank for SHAREPORT or standalone.

    Note: Starting with v3.2.0 released as APAR PH66196, the standard scoring service includes an enhancement to bind the server and optionally the admin port to a specified LPAR IP and a DVIPA for high availability, instead of all available LPAR interfaces.
  22. Optional: Re-train SparkML models : Re-train your SparkML models on Spark 4.0. Starting with v3.2.0 (APAR PH69959), the Spark version is upgraded to 4.0. After migration, you might need to re-train your Spark models on Spark 4.0 or re-import your Spark 3.x models; MLeap models need to be re-exported from a retrained model. See Submitting application to Spark for model training for details. Otherwise, they will cease to be operational in Spark 4.0.