Enabling and disabling IBM Cloud Private components

IBM® Cloud Private includes several components which are composed of one or more management services.

After you install IBM Cloud Private, you can enable or disable management services that are comprised in a component. For more information on the default values for the management services, see Customizing the cluster with the config.yaml file. For more information on the components that are available and the management services that are included with the component, see IBM® Cloud Private components. This topic covers the platform that a service can run on, service dependencies.

See IBM® Cloud Private components for more information on the components that are available and the management services that are included with the component.

Required user type or access level: Cluster administrator.

If you are enabling or disabling a service, you must configure the helm command line interface (CLI) as a cluster admin user. For more information about configuring the Helm CLI, see Installing the Helm CLI (helm).

1. If you are upgrading to version 3.1.0, or later, you must reformat the management services section in the config.yaml file before you upgrade. The section of the file before the upgrade reads similar to the following example:

      disabled_management_services:["istio","vulnerability-advisor","custom-metrics-adapter"]
   

   The section of the file after the changes for the upgrade reads similar to the following example:

      management-services:
        istio: disabled
        vulnerability-advisor: disabled
        custom-metrics-adapter: disabled
   

   If you are enabling the vulnerability-advisor after upgrade, deploy the new vulnerability advisor (VA) nodes. For more information about deploying the new VA nodes, see Adding an IBM Cloud Private cluster node.

   Note: If you enabled vulnerability-advisor on the previous version, ensure that the vulnerability-advisor entry is enabled in the management-services section of the config.yaml file after the upgrade. Your vulnerability-advisor parameter might resemble the following parameter value: vulnerability-advisor: enabled. The setting is disabled by default in the upgraded version, and the setting is not automatically retained during the upgrade.

2. Add a service to the management_services parameter list in the config.yaml file to disable or enable a service. Change the service parameter value to disabled to disable a service, or change the service parameter value to enabledto enable the service.

   Important: You must also enable or disable all services that comprise a component. The following services cannot be disabled: tiller, calico/nsx-t, kube-dns, monitoring-crd, cert-manager.

3. Run the add-on command to enable or disable the service on your CPU architecture:

    docker run --rm -t -e LICENSE=accept --net=host -v $(pwd):/installer/cluster ibmcom/icp-inception-$(uname -m | sed 's/x86_64/amd64/g'):3.2.0-ee addon
   

   If IBM Cloud Private is installed with OpenShift, run the following command to enable or disable the service:

    sudo docker run -t --net=host -e LICENSE=accept -v $(pwd):/installer/cluster ibmcom/icp-inception-$(uname -m | sed 's/x86_64/amd64/g'):3.2.0-rhel-ee install-with-openshift
   

IBM Cloud Private management services have dependency relationships between each other. For example, the auth-idp service depends on the mongodb service. If mongodb is disabled, the auth-idp service cannot function.

Important: Disabling services may impact the installation of IBM Cloud Pak.

Note: The dependency relationships are valid only if tiller, calico/nsx-t, kube-dns, monitoring-crd and cert-manager are enabled.

View the following table of the IBM Cloud Private management services, their dependencies, and whether they are required for the IBM Cloud Private with OpenShift environment or for supporting IBM Cloud Pak:

Note: Identity and Access Management (IAM) includes the following services: auth-idp, auth-pap, auth-pdp, auth-apikeys, and secret-watcher.