Db2U Next Generation

The core of the operator is the reconciler, which manages the state of the application in Kubernetes.  The reconciler continuously monitors for changes in the application and takes corrective actions to ensure that the application is in the desired state.

The Next Gen operator enables independent updates to resources, while providing users with clear visibility into each resource's status. This enhances overall performance, improves serviceability, and delivers a better user experience.

How is Next Gen different from the current operator?

The Next Gen operator offers key improvements over the current generation operator offering. This includes improved security posture, Kubernetes resource reduction, and the use of the validation webhook:

Improved security posture

• Reduced clusterrole privileges.
• Optionally, bring your own security context constraints (SCC), service account, RBAC (roles, RoleBindings).
• Fewer images leading to reduced attack surface.
• Better integration with native certificate managers for Kubernetes.
• Better integration with identity providers.

Kubernetes resource reduction 

• Reduced deployment time and resource consumption.
• Default Db2 configuration settings are embedded into the image.
• Simplified operator model with fewer intermediary resources required.
• Removed external dependencies such as etcd.

Validation webhook

The validation webhook is a Kubernetes admission controller that intercepts requests to the API server before they are persisted. It validates incoming requests and rejects those that do not meet predefined criteria. This mechanism helps enforce policies and ensures that only valid resources are created or updated in the cluster.

The Db2u validation webhook is used to enforce certain policies on the Db2uInstance custom resource. This includes the following policies:

1. The Db2uInstance Custom Resource (CR) must have a valid image 
   
   The webhook checks the Db2uInstance CR to ensure that the image specified in the spec.image field is valid for the particular operator version. If the image is not valid, for example if it violates the semantic versioning scheme, the webhook will reject the request..

   The webhook also rejects any image that is not from the icr.io registry. This is to ensure that only images from the IBM Container Registry are used in the cluster. The webhook will also check the image name and reject any image that does not match the pattern icr.io/db2u/*. However, for air-gapped deployments, this can be bypassed by setting the imageRegistryOverride config in the Db2uInstance CR.

2. The Db2uInstance CR must be annotated to allow changes that cause downtime

   
   The webhook looks for the maintenance annotation in the CR:

   db2u.databases.ibm.com/maintenance: "true"
   

   It only allows changes that cause a downtime if the annotation is present. The flow for this process is as follows:

   · If the annotation is present: the webhook allows changes that cause downtime. For example scale up/down, cpu/memory changes or update/upgrade, and restore.
   · If the annotation is not present, but the changes can be done online, for example labels or annotations: the webhook allows the changes.

3. Changes to db and dbm config variables will only be allowed via ADMIN_CMD post CR creation
   The webhook checks the Db2uInstance CR to ensure that changes to the db and dbm variables are only allowed on CR creation. Any changes to these variables after CR creation must be done through the ADMIN_CMD procedure. This provides a more consistent experience to native Db2 externals.
4. Other user-provided settings in the CR
   For example, validating the items array that defines required certificates in the secret when SSL is enabled in the CR. 

• Reduces reliance on cluster-admin permissions during installation and upgrade.
• Eliminates the need for OpenShift global pull secrets and image content source policies (ICSPs).
• Removes cluster-level RBAC for operators wherever feasible and allows administrators to provide their - own RBAC resources, such as SCC, service accounts, roles, and role bindings.
• Compatibility with GitOps tools, including Argo CD.

Independent image and operator updates

• Db2 images can be updated independently of the operator, enhancing security and simplifying upgrades.
• Operator updates are only required for new features or security fixes that affect the operator.

Semantic versioning 

spec.image: icr.io/db2u/db2u.<DBTYPE>:VRMF-CSB

icr.io/db2u/db2u.db2wh:12.1.3.0

environment:
  prechecker:
    enabled: true

environment:
  prechecker:
    enabled: true
    disabledPrechecks:
      - SELINUX_CONTEXT

Events:
  Type     Reason             Age               From                Message
  ----     ------             ----              ----                -------
  Warning  BackOff            17s               kubelet             Back-off   restarting failed container prechecker in pod c-db2-example-db2u-0_db2-instance-ns(0145c43f-a114-4df6-81c2-9d98f35339a1)

$ kubectl -n <db2-instance-ns> logs c-db2-example-db2u-0 -c prechecker  
[2025-09-08 12:12:37,414] - INFO: Executing storage precheck... 
[2025-09-08 12:12:37,426] - WARNING: [NFS_VERSION] - NFS is configured with a version which is not fully supported: 4 
[2025-09-08 12:12:37,680] - ERROR: [SELINUX_CONTEXT] - NFS missing in SELinux context 
[2025-09-08 12:13:05,533] - INFO: [WRITE_SPEED] - Storage write speed: 38.9 MB/s (BS=1M count=1024) 
[2025-09-08 12:13:12,911] - INFO: [WRITE_SPEED_LIGHT] - Storage write speed (lite): 574 kB/s (BS=4K count=1024) 
[2025-09-08 12:13:12,919] - INFO: Storage prechecks executed in 35.493459s 
[2025-09-08 12:13:12,927] - ERROR: Prechecker failed: At least one critical precheck did not pass 

environment:
  prechecker:
    enabled: true
    disabledPrechecks:
      - WRITE_SPEED
      - SELINUX_CONTEXT

$ kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml

tar -zxvf db2-operator-0.1.tar.gz
cd 0.1

platform: K8S

$ kubectl create ns <db2-operator-ns> 
$ kubectl create ns <db2-instance-ns> 

namespace: <db2-operator-ns>
image:
  repository: icr.io/db2u/db2-operator
watchNamespace:
  - <db2-instance-ns>

$ kubectl -n=<db2-operator-ns/db2-instance-ns> create secret docker-registry db2u --docker-server=localregistry.io --docker-username=cp --docker-password='<secret-key>'

imagePullSecrets:
  - db2u

$ oc project <db2-operator-ns> 

$ kubectl config set-context --current --namespace=<db2-operator-ns>

helm install db2-operator ./db2-operator -f overrides.yaml --set image.tag=0.1

image.tag=0.1@sha256:4eeb63064fd135cb6f8f3d3ed8ad44adf7d129290560a48dbe7122966362c7fd

$ kubectl get po 

image: icr.io/db2u/db2u.db2oltp:12.1.3.0@sha256:847373ea58d9402b9ac0c79faccfa21b634abccbefd8b0a9aeafd39a865b8589

apiVersion: db2u.databases.ibm.com/v1
kind: Db2uInstance
metadata:
  name: db2-oltp-next-gen
spec:
  image: icr.io/db2u/db2u.db2oltp:12.1.3.0
  environment:
    databases:
    - name: BLUDB
    dbType: db2oltp
  license:
    accept: true
  nodes: 1
  podTemplate:
    db2u:
      resource:
       db2u:
         limits:
           cpu: 2
           memory: 8Gi
  storage:
  - name: meta
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 10Gi
      storageClassName: <storage-class-fs>
    type: create
  - name: archivelogs
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 10Gi
      storageClassName: <storage-class-fs>
    type: create
  - name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 100Gi
      storageClassName: <storage-class-block>
    type: template

$ kubectl -n <db2-instance-ns> apply -f db2uinstance_oltp.yaml

$ kubectl -n <db2-instance-ns> get db2uinstance
NAME STATE MAINTENANCESTATE AGE
db2-oltp-next-gen converge 8s

$ kubectl -n <db2-instance-ns> get db2uinstance
NAME STATE MAINTENANCESTATE AGE
db2-oltp-next-gen Ready 4m58s

apiVersion: db2u.databases.ibm.com/v1
kind: Db2uInstance
metadata:
  name: db2-wh-next-gen
spec:
  image: icr.io/db2u/db2u.db2wh:12.1.3.0
  addOns:
    opendataformats:
      enabled: true
  environment:
    ssl:
      fromVolumeSource:
        secret:
          secretName: db2ssl-certs
          items:
            - key: tls.crt
              path: tls.crt
            - key: tls.key
              path: tls.key
            - key: ca.crt
              path: ca.crt
    partitionConfig:
      total: 6
    authentication:
      ldap:
        enabled: false
    databases:
    - name: BLUDB
    dbType: db2wh
  license:
    accept: true
  nodes: 3
  podTemplate:
    db2u:
      resource:
        db2u:
          limits:
            cpu: 2
            memory: 12Gi
  storage:
  - name: meta
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 100Gi
      storageClassName: <storage-class-fs>
    type: create
  - name: archivelogs
    spec:
      accessModes:
      - ReadWriteMany
      resources:
        requests:
          storage: 100Gi
      storageClassName: <storage-class-fs>
    type: create
  - name: data
    spec:
      accessModes:
      - ReadWriteOnce
      resources:
        requests:
          storage: 200Gi
      storageClassName: <storage-class-block>
    type: template

​​​​​​db2u.databases.ibm.com/maintenance: "true"

namespace=<namespace of Db2uInstance>
db2uinstance=<db2uinstance name>
   kubectl -n ${namespace} annotate db2uinstance ${db2uinstance} db2u.databases.ibm.com/maintenance="true"
   kubectl patch db2uinstance ${db2uinstance} -n ${namespace} --type merge --patch '{"spec": { 
   "podTemplate": {
       "db2u": {
           "resource": {
               "db2u": {
                   "limits": {
                       "cpu": "4",
                       "memory": "16Gi"
                   }
               }
           }
       }
 
   }
   }}'

kubectl -n ${namespace} annotate db2uinstance ${db2uinstance} db2u.databases.ibm.com/maintenance-

namespace=<namespace of Db2uInstance>
                                                                                                                                                                                                                                                                                                            db2uinstance=<db2uinstance name>

kubectl -n ${namespace} delete db2uinstance ${db2uinstance}

helm uninstall db2-operator --namespace db2u-next-gen

$ oc project <db2-operator-ns>

$ helm uninstall db2-operator

scc:
  create: false
rbac:
  create: false
instanceRbac:
  create: false

sv pause db2runner

sv pause bigsql-metastore bigsql-scheduler

sv cont db2runner

sv cont bigsql-metastore bigsql-scheduler

sv status db2runner

sv status bigsql-metastore bigsql-scheduler