Installing the Assistant chat by using a Helm chart

You must deploy Assistant chat agents to a Red Hat OpenShift cluster by using a Helm chart in the IBM Cloud Container Registry package. You use a values.yaml file to populate the required fields for your environment.

Before you begin

You must have the following access, software, and permissions:
  • Access to a Red Hat OpenShift cluster (OCP) with permission to create namespaces and deploy applications
  • Helm 3.8 or later
  • Open Shift CLI (oc)
  • An IBM Cloud API key (entitlement key) to pull container images from the IBM Cloud Container Registry

Procedure

  1. Log in to the IBM Cloud Container Registry from any machine that is connected to the OCP cluster and replace <ZDBA_ENTITLEMENT_KEY> with your IBM Cloud API key:
    echo -n "<ZDBA_ENTITLEMENT_KEY>" | helm registry login icr.io \
      --username iamapikey \
      --password-stdin
  2. Pull and extract the chart package. The latest version is 1.1.0.1, for example: --version 1.1.0-1.
    helm pull oci://icr.io/z-database-assistant/z-database-assistant-charts --version 1.1.0-1 --untar
  3. Change to the directory that contains the values.yaml file, the deploy.sh file, and the templates/ subdirectory before you continue.
    cd z-database-assistant-charts
  4. Open the values.yaml file and populate the fields that are empty or need environment-specific values before you deploy.
    Work with your OCP administrator or the person responsible for maintaining your watsonx Assistant™ for Z to obtain these values.
    Restriction: The values.yaml file can contain sensitive values. Do not commit environment-specific secrets to version control.
    General settings
    The following settings configure the language model runtime for your deployment.
    entitlementKey
    IBM Cloud entitlement key used for the image pull secret. This key is the same key that you use to pull the Helm chart.
    env.modelRuntime
    Model runtime type. You must set this value to cloud, openai-protocol, or on-prem. The value you specify determines which model runtime settings are required, as described in the following three sections. Complete the section that applies to the model runtime time that you specified.
    Settings required for the cloud model runtime type
    The following settings are required if you set the env.modelRuntime setting to cloud.
    env.projectId or env.deploymentSpaceId
    Set either the env.projectId or the env.deploymentSpaceId field depending on whether you are working with a project or deployment space in watsonx.ai. These parameters are mutually exclusive.
    env.llmBaseUrl
    Base URL for the model service endpoint.
    env.llmApiKey
    API key for the configured language model service.
    Settings required for the openai-protocol model runtime type
    The following settings are required if you set the env.modelRuntime setting to openai-protocol.
    env.llmModel
    Model name or identifier to use for inference, for example, openai/gpt-oss-120b.
    env.llmBaseUrl
    Base URL for the model service endpoint.
    env.llmApiKey
    API key for the configured language model service.
    Settings required for the on-prem model runtime type
    The following settings are required if you set the env.modelRuntime setting to on-prem.
    env.llmModel
    Model name or identifier to use for inference, for example, openai/gpt-oss-120b.
    env.llmBaseUrl
    Base URL for the model service endpoint.
    env.cpdUsername
    Cloud Pak for Data user name if applicable, for example, cpdadmin.
    env.cpdVersion
    Cloud Pak for Data version if applicable, for example, 5.3.
    env.instanceId
    Instance identifier. The default is openshift.
    env.llmApiKey
    API key for the configured language model service.
    Values from watsonx Assistant for Z
    The following settings connect IBM® Z Database Assistant to watsonx Assistant for Z services for knowledge retrieval and document ingestion.
    env.opensearchUser
    User name for the OpenSearch wrapper service.
    env.opensearchPassword
    Password for the OpenSearch wrapper service.
    env.opensearchRoute
    Route or URL for the OpenSearch wrapper service.
    env.ingestionServiceUrl
    URL for the ingestion service used for knowledge file ingestion.
    env.ingestionServicePassword
    Password for the ingestion service.
  5. Review and set these fields appropriately if your environment requires client certificate authentication for the IMS Operations API:
    env.mcpCertSecret.cer
    Client certificate for IMS Operations API authentication. This field contains placeholder content that must be replaced if certificate authentication is required.
    env.mcpCertSecret.key
    Private key for the client certificate.
    env.mcpCertSecret.serverCA
    Server CA certificate that is used to validate the remote endpoint.
  6. Deploy to OpenShift.
    1. Because the deploy.sh script requires a .env file for OpenShift cluster credentials, create the .env file from the .env.example file by running the following command:
      cp .env.example .env
      
    2. Enable the file permissions for the .env file and the deploy.sh script by running the following commands:
      
      chmod 600 .env
      chmod +x deploy.sh
    3. Edit the .env file and populate it with your environment-specific values. These are the required values from the .env.example file:
      OCP_CLUSTER
      OCP cluster API endpoint, not the OCP cluster web endpoint.
      OCP_USERNAME
      User name that has access to the OCP cluster to deploy the agents.
      OCP_PASSWORD
      Password for that user name.

      Save and close the .env file.

    4. Run the deploy.sh script to deploy the Assistant chat agents to the OpenShift cluster:
      
      ./deploy.sh -i
      Tip: For more information about the deploy.sh script file, run ./deploy.sh -h.

Results

The deploy.sh -i command logs in to OpenShift, creates the namespace if needed, and deploys the Helm chart by using the values from the values.yaml file. Two pods are created that contain multiple containers, including the agents, MCP services, and PostgreSQL. When the deploy.sh command completes, a list of Assistant chat agents is displayed with their routes and container names:
Agent Route Container
admin-object-compare-mcp admin-object-compare-mcp-z-database-assistant.your-cluster-endpoint admin-object-compare-mcp
db2z-mcp db2z-mcp-z-database-assistant.your-cluster-endpoint db2z-mcp
db2zai-mcp db2zai-mcp-z-database-assistant.your-cluster-endpoint db2zai-mcp
engine engine-z-database-assistant.your-cluster-endpoint engine
idaa-mcp idaa-mcp-z-database-assistant.your-cluster-endpoint idaa-mcp
zdba-ims-agent zdba-ims-agent-z-database-assistant.your-cluster-endpoint zdba-ims-agent
Important: The default namespace for the routes is z-database-assistant, the default protocol is HTTPS, and the default port is 443.
Tip: To redisplay this information after the initial installation, issue the ./deploy.sh -r command. Consider piping this information to a text file for future reference; for example:
./deploy.sh -r >> install-log.txt

What to do next

Take note of the following routes, which you will need during the configuration of the IBM Z Database Assistant user interface:
  • https://engine-z-database-assistant.your-cluster-endpoint (default https port 443)
  • https://db2z-mcp-z-database-assistant.your-cluster-endpoint (default https port 443)