You must deploy Assistant chat agents
to a Red Hat OpenShift cluster by using a Helm chart in the IBM Cloud Container Registry package.
You use a values.yaml file to populate the required fields for your
environment.
Before you begin
You must have the following access, software, and permissions:
- Access to a Red Hat OpenShift cluster (OCP) with permission to create namespaces and deploy applications
- Helm 3.8 or later
- Open Shift CLI (oc)
- An IBM Cloud API key (entitlement key) to pull container images from the IBM Cloud Container Registry
Procedure
- Log in to the IBM Cloud Container Registry from any machine that is connected to the OCP cluster and replace <ZDBA_ENTITLEMENT_KEY> with your IBM Cloud API key:
echo -n "<ZDBA_ENTITLEMENT_KEY>" | helm registry login icr.io \
--username iamapikey \
--password-stdin
- Pull and extract the chart package. The latest version is 1.1.0.1, for example:
--version 1.1.0-1.
helm pull oci://icr.io/z-database-assistant/z-database-assistant-charts --version 1.1.0-1 --untar
- Change to the directory that contains the values.yaml file, the deploy.sh file, and the templates/ subdirectory before you continue.
cd z-database-assistant-charts
- Open the values.yaml file and populate the fields that are empty or need environment-specific values before you deploy.
Work with your OCP administrator or the person responsible for maintaining your
watsonx Assistant™ for Z to obtain these values.
Restriction: The values.yaml file can contain sensitive values. Do not commit environment-specific secrets to version control.
- General settings
- The following settings configure the language model runtime for your deployment.
- entitlementKey
- IBM Cloud entitlement key used for the image pull secret. This key is the same key that you use to pull the Helm chart.
- env.modelRuntime
- Model runtime type. You must set this value to cloud, openai-protocol, or on-prem. The value you specify determines which model runtime settings are required, as described in the following three sections. Complete the section that applies to the model runtime time that you specified.
- Settings required for the cloud model runtime type
- The following settings are required if you set the
env.modelRuntime setting to cloud.
- env.projectId or env.deploymentSpaceId
- Set either the
env.projectId or the env.deploymentSpaceId field depending on whether you are working with a project or deployment space in watsonx.ai. These parameters are mutually exclusive.
- env.llmBaseUrl
- Base URL for the model service endpoint.
- env.llmApiKey
- API key for the configured language model service.
- Settings required for the openai-protocol model runtime type
- The following settings are required if you set the
env.modelRuntime setting to openai-protocol.
- env.llmModel
- Model name or identifier to use for inference, for example, openai/gpt-oss-120b.
- env.llmBaseUrl
- Base URL for the model service endpoint.
- env.llmApiKey
- API key for the configured language model service.
- Settings required for the on-prem model runtime type
- The following settings are required if you set the
env.modelRuntime setting to on-prem.
- env.llmModel
- Model name or identifier to use for inference, for example, openai/gpt-oss-120b.
- env.llmBaseUrl
- Base URL for the model service endpoint.
- env.cpdUsername
- Cloud Pak for Data user name if applicable, for example, cpdadmin.
- env.cpdVersion
- Cloud Pak for Data version if applicable, for example, 5.3.
- env.instanceId
- Instance identifier. The default is openshift.
- env.llmApiKey
- API key for the configured language model service.
- Values from watsonx Assistant for Z
- The following settings connect IBM® Z Database Assistant to watsonx Assistant for Z services for knowledge retrieval and document ingestion.
- env.opensearchUser
- User name for the OpenSearch wrapper service.
- env.opensearchPassword
- Password for the OpenSearch wrapper service.
- env.opensearchRoute
- Route or URL for the OpenSearch wrapper service.
- env.ingestionServiceUrl
- URL for the ingestion service used for knowledge file ingestion.
- env.ingestionServicePassword
- Password for the ingestion service.
- Review and set these fields appropriately if your environment requires client certificate authentication for the IMS Operations API:
- env.mcpCertSecret.cer
- Client certificate for IMS Operations API authentication. This field contains placeholder content that must be replaced if certificate authentication is required.
- env.mcpCertSecret.key
- Private key for the client certificate.
- env.mcpCertSecret.serverCA
- Server CA certificate that is used to validate the remote endpoint.
- Deploy to OpenShift.
- Because the deploy.sh script requires a .env file for OpenShift cluster credentials, create the .env file from the .env.example file by running the following command:
- Enable the file permissions for the .env file and the deploy.sh script by running the following commands:
chmod 600 .env
chmod +x deploy.sh
- Edit the .env file and populate it with your environment-specific values. These are the required values from the .env.example file:
- OCP_CLUSTER
- OCP cluster API endpoint, not the OCP cluster web endpoint.
- OCP_USERNAME
- User name that has access to the OCP cluster to deploy the agents.
- OCP_PASSWORD
- Password for that user name.
Save and close the .env file.
- Run the deploy.sh script to deploy the Assistant chat agents to the OpenShift cluster:
./deploy.sh -i
Tip: For more information about the deploy.sh script file, run ./deploy.sh -h.
Results
The deploy.sh -i command logs in to OpenShift, creates the namespace if needed, and deploys the Helm chart by using the values from the values.yaml file. Two pods are created that contain multiple containers, including the agents, MCP services, and PostgreSQL. When the deploy.sh command completes, a list of Assistant chat agents is displayed with their routes and container names:
| Agent |
Route |
Container |
| admin-object-compare-mcp |
admin-object-compare-mcp-z-database-assistant.your-cluster-endpoint |
admin-object-compare-mcp |
| db2z-mcp |
db2z-mcp-z-database-assistant.your-cluster-endpoint |
db2z-mcp |
| db2zai-mcp |
db2zai-mcp-z-database-assistant.your-cluster-endpoint |
db2zai-mcp |
| engine |
engine-z-database-assistant.your-cluster-endpoint |
engine |
| idaa-mcp |
idaa-mcp-z-database-assistant.your-cluster-endpoint |
idaa-mcp |
| zdba-ims-agent |
zdba-ims-agent-z-database-assistant.your-cluster-endpoint |
zdba-ims-agent |
Important: The default namespace for the routes is z-database-assistant, the default protocol is HTTPS, and the default port is 443.
Tip: To redisplay this information after the initial installation, issue the
./deploy.sh -r command. Consider piping this information to a text file for future reference; for example:
./deploy.sh -r >> install-log.txt
What to do next
Take note of the following routes, which you will need during the configuration of the
IBM Z Database Assistant user interface:
- https://engine-z-database-assistant.your-cluster-endpoint (default https port 443)
- https://db2z-mcp-z-database-assistant.your-cluster-endpoint (default https port 443)