IBM Support

Readme for Cloud Pak for Business Automation 21.0.3 IF009

Fix Readme


Abstract

The following document is for IBM Cloud Pak for Business Automation 21.0.3 IF009. It includes the CASE package download, installation information, and the list of APARs that are resolved in this interim fix.

Content

Readme file for: IBM Cloud Pak® for Business Automation
Product Release: 21.0.3
Update Name: 21.0.3 IF009
Fix ID: 21.0.3-WS-CP4BA-IF009
Publication Date: 26 May 2022

Before installation

  1. Ensure you take regular backups of any databases associated with the environment.
  2. Ensure your operators are in a healthy state before upgrading.
    If one or more operators are failing, then it can prevent the system from completing an upgrade.
    It is recommended to check a few of the important CR statuses to ensure there are not failures and the statuses appear ready for the various installed components. Check the status of the following CRs when they exist:
    oc get icp4acluster -o yaml
    oc get AutomationUIConfig -o yaml 
    oc get Cartridge -o yaml 
    oc get AutomationBase -o yaml 
    oc get CartridgeRequirements -o yaml
  3. Required when you are using Business Automation Insights
    If Business Automation Insights is deployed, prune the Business Automation Insights deployment and jobs before you apply the updated custom resource YAML file.
    $ oc delete Deployment,Job -l \
    > 'app.kubernetes.io/name=ibm-business-automation-insights'
    Tip: For Flink event processing to resume from its previous state, make sure that savepoints are created before the upgrade and specified in the updated CR. For more information see, Restarting from a checkpoint or savepoint

Installing the interim fix

Important: If you used any individual image tag settings in your CP4BA CR, it could prevent the operator from updating the images to the appropriate version. Ensure you remove any of these settings for a production installation when you upgrade.
The CASE package associated with this interim fix is ibm-cp-automation-3.2.9.tgz.  Download the CASE package to wherever you are planning to perform the installation or upgrade of this interim fix (e.g., the infrastructure node of your OCP cluster) and extract the CASE package into a directory.
Cloud Pak for Business Automation 21.0.3 interim fixes are released to the v21.3 operator channel. Once the operator is upgraded, it triggers rolling updates for all the pods it manages to ensure they are updated to the appropriate version to match the operator.
If your environment has access to IBM entitled registry and has an automatic v21.3 channel subscription then production installations are upgraded automatically. This upgrade generally occurs when the interim fix is released or when images are mirrored for air gap setup.
Starting with 21.0.3-IF007 interim fix, we "pin" the version of CP4BA along with all its dependencies (i.e., IBM Automation Foundation (IAF) and IBM Foundational Services (IBM Common Services)).  In other words, the automatic updates will be turned off and you will need to perform the steps listed to upgrade your environments in the future. 
This interim fix contains the following version of CP4BA, IAF, and Common Services:
 
  • CP4BA – 21.0.3-IF009
  • IAF Core – 1.3.7
  • IAF Base – 1.3.7
  • IBM Foundational Services (IBM Common Services) – 3.17.0
Note:  If you have other Cloud Paks installed on the same OCP cluster, be sure to check the compatibility of the IAF and IBM Foundational Servcies versions above with other Cloud Paks.
Depending on the current setup and state of your existing environment, there are various upgrade actions that need to be taken. The following scenarios cover what actions might be needed for a particular setup.
  • Scenario 1: You are using a starter installation.
    Actions: Starter environments do not support upgrades. Although you can use the interim fix content, install a new starter environment and use the CASE package from this interim fix.
  • Scenario 2: Your installation is version 21.0.2.x or earlier.
    Actions: If you are using a version before 21.0.3, then you must upgrade first. To upgrade your environment, follow the Upgrading automation containers instructions.
    • If attempting to upgrade using script ONLY (upgradeOperator.sh) from 21.0.2.x > 21.0.3.7 (and subsequent IFixes after), its a MUST to upgrade to 21.0.3 GA before moving on to IF007 (or any future iFixes). This is due to the change using the pinned operator catalog. It is NOT an issue if you use the Operator Hub UI and upgrade the channel.
    • When you perform the upgrade, you can substitute the CASE package from this interim fix for the 21.0.3 CASE package while you follow the instructions. For air gap, you can use the case save command in step 1 of scenario 4.
      Note: If you are using versions prior to 21.0.2 then you must incrementally upgrade and follow the instructions for each version between your source version and 21.0.3
  • Scenario 3:  Your installation is online and 21.0.3.x
    Actions: Once these steps are completed, the operators will be upgraded based on the versions from the catalog sources.
    1. Apply the catalog sources to pin the above mentioned versions for IBM Automation Foundation , IBM Foundational Services with Cloudpak for Business Automation. 
      You can apply the catalog sources below from a command line by creating a YAML file (e.g., cp4ba_catalog_sources.yaml) with the catalog sources below and performing "oc apply -f cp4ba_catalog_sources.yaml" or you can apply the catalog sources via the OCP console
      Note: you can only apply one catalog source at a time via the OCP console. 
      Note:  The DB2, IBM Business Team Service, and Postgres catalog sources are dependent components of CP4BA.
      # CP4BA 21.0.3 IF009 catalog
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        name: ibm-cp4a-operator-catalog
        namespace: openshift-marketplace
      spec:
        displayName: ibm-cp4a-operator
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-cp-automation-catalog@sha256:783a771ae289790cb8d5cc00d817c4b30d4b432939c619097b203ec13d144239
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # IBM Automation Foundation Base 1.3.7
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        name: ibm-cp-automation-foundation-catalog
        namespace: openshift-marketplace
      spec:
        displayName: IBM Automation Foundation Operators
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-cp-automation-foundation-catalog@sha256:267bbc17bad1966be259bb9a6951c520c6fb824bfa42bbec22570ba49883d4ae
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # IBM Automation Foundation Core 1.3.7
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        name: ibm-automation-foundation-core-catalog
        namespace: openshift-marketplace
      spec:
        displayName: IBM Automation Foundation Core Operators
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-automation-foundation-core-catalog@sha256:5502c003afe7a0590ce123c3bbbd76e46374af641b3a210e3c25cfe2381e4647
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # IBM Cloud Foundational Services 3.17.0
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        annotations:
          bedrock_catalogsource_priority: '1'
        name: opencloud-operators
        namespace: openshift-marketplace
      spec:
        displayName: IBMCS Operators
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-common-service-catalog@sha256:c7548371c9085492e59a813547618034c5a5628e40437b796e4151c664efd01e
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # IBM DB2 Operator Catalog 4.0.9
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        annotations:
          bedrock_catalogsource_priority: '1'
        name: ibm-db2uoperator-catalog
        namespace: openshift-marketplace
      spec:
        sourceType: grpc
        image: icr.io/cpopen/ibm-db2uoperator-catalog@sha256:99f725098b801474ff77e880ca235023452116e4b005e49de613496a1917f719
        displayName: IBM Db2U Catalog
        publisher: IBM
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # IBM Business Teams Service version 3.17.0
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        annotations:
          bedrock_catalogsource_priority: '1'
        name: bts-operator
        namespace: openshift-marketplace
      spec:
        displayName: BTS Operator
        publisher: IBM
        sourceType: grpc
        image: quay.io/opencloudio/ibm-bts-operator-catalog@sha256:770405846978fe731ac40d804a27f1666fcb4c29d76ca30e52edec51b1995d9a
        updateStrategy:
          registryPoll:
            interval: 45m
      ---
      # Cloud Native PostgresSQL 4.0.8
      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
        annotations:
          bedrock_catalogsource_priority: '1'
        name: cloud-native-postgresql-catalog
        namespace: openshift-marketplace
      spec:
        displayName: Cloud Native Postgresql Catalog
        publisher: IBM
        sourceType: grpc
        image: icr.io/cpopen/ibm-cpd-cloud-native-postgresql-operator-catalog@sha256:f3feb39b0dfb444a46d99a9cd160c616f8548d84d452cbc89e4985f0a2574486
        updateStrategy:
          registryPoll:
            interval: 45m
    2. Update the existing subscriptions of CP4BA, IAF, and Common Services to change from IBM Operator Catalog to the individual catalogs applied above.
      1. Find the update_subscription.sh script from the extracted CASE package under "../ibm-cp-automation/inventory/cp4aOperatorSdk/files/deploy/crs/cert-kubernetes/scripts"
      2. Login to your OCP cluster as a cluster administrator
      3. Execute the update_subscription.sh -n <your cp4ba namespace>
        Note: At this point the environment will be updated to use the new "pinned" catalogs. Your environment will no longer auto-update the operators when new versions are released.
    3. If you have any subscriptions set to manual, then you will need to approve any pending operator updates.
      It is not recommended to set subscriptions to manual as it can make the the upgrade more error prone if some of the many operator updates are not approved. By default all subscriptions would be set to automatic.
       
  • Scenario 4:  Your installation is air gap and 21.0.3.x
    Actions:
    1. Setup the environment variables for CASE. 
      • export CASE_NAME=ibm-cp-automation 
      • export OFFLINEDIR=/tmp/cp4ba-if009
      • export CASE_VERSION=3.2.9
      • export CASE_INVENTORY_SETUP=cp4aOperatorSetup 
      • export CASE_ARCHIVE=${CASE_NAME}-${CASE_VERSION}.tgz 
      • export CASE_LOCAL_PATH=${OFFLINEDIR}/${CASE_ARCHIVE}

        Note: The values are specific to the IFix although you can choose a different empty directory for the OFFLINEDIR if you need to put the files somewhere else.
    2. Save this specific set of case packages
      cloudctl case save --case docker://icr.io/cpopen/ibm-cp-automation-case-cache@sha256:d58ab3d92f3f55f8e3c9d993b4048e44996ccc716a69059bf462885a282babfc --outputdir ${OFFLINEDIR}
      Once the above command completed all the Case archive and inventory are saved under the OFFLINEDIR.
    3. Mirror the entitled registry images to the local registry by completing the same steps used during install. For more information about this, see Mirroring images to the private registry.
      Make sure to use the CASE image OFFLINEDIR (/tmp/cp4ba-if009) from step 1.
    4. Update the catalog with the new version by running the install-catalog action.
      cloudctl case launch \
      --case ${OFFLINEDIR}/${CASE_ARCHIVE} \
      --inventory ${CASE_INVENTORY_SETUP} \
      --action install-catalog \
      --namespace ${NAMESPACE} \
      --args "--registry ${LOCAL_REGISTRY} --inputDir ${OFFLINEDIR} --recursive" 
    5. If you have any subscriptions set to manual, then you will need to approve any pending operator updates.
      It is not recommended to set subscriptions to manual as it can make the the upgrade more error prone if some of the many operator updates are not approved. By default all subscriptions would be set to automatic.
After the operators are upgraded, it will trigger the upgrade of the related deployments and pods. See the items mentioned in "Performing the necessary tasks after installation" for additional actions that may be needed after the upgrade is completed.
 

Performing the necessary tasks after installation

  1. Update Kafka certificates when you are using Business Automation Insights
    If you are using Business Automation Insights and upgrading from an IBM Automation Foundation version before 1.3, the operator will fail to become ready after the upgrade and kafka/zookeeper pods show SSL errors. To resolve the issue, follow the "To renew the leaf certificates for Kafka" instructions in Changes to CA certificate and key does not automatically rotate Kafka leaf certificates.
  2. Review the installation
    It is recommended that you review the CR yaml status section and operator logs after the upgrade to ensure there are no failures preventing your pods from upgrading.
    oc get icp4acluster -o yaml > CP4BAconfig.yaml
    oc logs deployment/ibm-cp4a-operator -c operator > operator.log
    If you are interested in verifying the expected image digest for a particular image, then you can review the ibm-cp-automation\inventory\cp4aOperatorSdk\resources.yaml file in the CASE package. This file has a listing of the images managed by the CP4BA operator and their expected digest for this particular interim fix level.
  3. Required when you are using Workflow Process Service OCP deployment
    If you used any individual image tag settings in your WfPSRuntime CR, it could prevent the operator from updating the images to the appropriate version. Ensure you remove any of these settings when you upgrade.
  4. Required when you are using Workflow Process Service Docker Compose Edition
    1. Follow the step 2 of section "3. Running your environment" in Installing Workflow Process Service to log in to the entitled registry with your entitlement key.
    2. Back up your database backup, docker-compose.yml and folder for docker volumes “production_workflow_runtime_data” and “production_workflow_runtime_logs”.
    3. (Optional) Push the images to your docker registry. Log in to your docker registry, and push the docker images into your docker registry  by using the following commands:
      docker login <server>
      docker tag cp.icr.io/cp/cp4a/workflow-ps/workflow-ps-server:<tag> \
       <server>/workflow-ps-server:<tag>
      docker tag cp.icr.io/cp/cp4a/workflow-ps/workflow-ps-authoring:<tag> \
       <server>/workflow-ps-authoring:<tag>
      docker push <server>/workflow-ps-server:<tag>
      docker push <server>/workflow-ps-authoring:<tag>
      Where <server> is the host of the docker image registry that you want to use to pull the images. For example, myregistry.local:5000 or localhost:8080 for a self-hosted registry. Also, replace <tag> with the corresponding tag matching this interim fix's tag in the form of <release>-IFxxx, for example, 21.0.3-IF009.
    4. Run docker-compose down command to stop the Workflow Process Server container.
    5. Update the image url's tags in docker-compose.yml.
      <server>/workflow-ps-server:<tag>
      <server>/workflow-ps-authoring:<tag>
      Where <tag> is the corresponding tag matching this interim fix's tag in the form of <release>-IFxxx, for example, 21.0.3-IF009.
    6. Run docker-compose up command to start the Workflow Process Server container
    For more detail on Workflow Process Service refer to Installing Workflow Process Service .
    Troubleshooting: If you are using a Docker Desktop version 4.3.0 or greater, you might get an out of memory error when you start the server. For more details and possible resolution to this issue, and other troubleshooting guidance, refer to Troubleshooting Workflow Process Service.
  5. Required when you are using Operational Decision Manager
    You must update your Rule Designer:
    • Open Eclipse 
    • Open menu Help > Check for Updates
    • select IBM Operational Decision Manager for Developers v8.11.x - Rule Designer
    • Proceed with installation.

Uninstalling

There is no procedure to uninstall the interim fix.

List of Fixes

APARs fixed by this interim fix are listed in the following tables.
The columns are defined as follows: 
Column title Column description
APAR The defect number
Title A short description of the defect
Sec. A mark indicates a defect related to security
Cont. A mark indicates a defect specific to the Cloud Pak integration of the component
B.I. A mark indicates the fix has a business impact. Details are found in the title column or the APAR document
General
APAR Title Sec. Cont. B.I.
N/A
Cloud Pak for Business Automation delivers container images that include operating system level and other open source libraries. Vulnerabilities (CVEs) for these libraries are published regularly.
 
This interim fix includes fixes for these libraries to address:
CVE-2022-26336, CVE-2020-35452, CVE-2021-33193, CVE-2021-36160, CVE-2021-44224, CVE-2021-41617, CVE-2022-21449, CVE-2021-25219, CVE-2021-23222, CVE-2022-21426, CVE-2022-21434, CVE-2022-21443, CVE-2022-21476, CVE-2022-21496, CVE-2020-19131, CVE-2022-24329, CVE-2020-35492, CVE-2022-29078, CVE-2021-43138
 
Previous interim fixes will have included fixes which are also addressed with this interim fix. Consult the Related links section for readmes of previous interim fixes, at the bottom of this document.
Cloud Pak for Business Automation Operator
APAR Title Sec. Cont. B.I.
N/A N/A
Automation Document Processing
APAR Title Sec. Cont. B.I.
JR64955 ADP PROJECT DEPLOYMENT PRECHECK FAILS X X
JR64983 LOADDEFAULTDATA SCRIPT FAILS WITH MISSING SQL FILE ERROR X X
Automation Decision Services
APAR Title Sec. Cont. B.I.
N/A N/A
APAR Title Sec. Cont. B.I.
JR64881 BUSINESS AUTOMATION APPLICATION MIGHT NOT FUNCTION CORRECTLY WHEN USING THE NO CODE DATA VALIDATION
JR64977 UNEXPECTED ICONS AND SCRIPT TEXT APPEAR ON BUSINESS AUTOMATION OR BUSINESS APPLICATION PAGE IN IBM BUSINESS AUTOMATION STUDIO
Business Automation Insights
APAR Title Sec. Cont. B.I.
N/A N/A
Business Automation Navigator
APAR Title Sec. Cont. B.I.
N/A N/A
Business Automation Studio
APAR Title Sec. Cont. B.I.
JR64852 PORTION OF A VARIABLE PICKER MAY BE COVERED BY IBM PROCESS DESIGNER TOOLBAR HEADER
JR64977 UNEXPECTED ICONS AND SCRIPT TEXT APPEAR ON BUSINESS AUTOMATION OR BUSINESS APPLICATION PAGE IN IBM BUSINESS AUTOMATION STUDIO
Business Automation Workflow including Automation Workstream Services
APAR Title Sec. Cont. B.I.
JR64596 SECURITY APAR - CVE-2022-22361 - CROSS SITE REQUEST FORGERY VULNERABILITY IN PROCESS ADMIN CONSOLE X
JR64590 IF THE OBJECT STORE DISPLAY NAME IS DIFFERENT THAN THE SYMBOLIC NAME IN THE CR FILE CASE INIT JOB FAILS
JR64671 IF YOU ARE USING FRENCH LOCALE SETTING IN THE BROWSER, YOU CAN'T OPEN A SOLUTION THAT WAS CLOSED IMPROPERLY
JR64788 UNABLE TO OPEN AND DEPLOY THE SOLUTION IF THE BROWSER USES CHINESE LANGUAGE
JR64821 'CPE METADATA CACHE TIME TO LIVE' SETTING IS NOT CONFIGURABLE IN CLOUD PAK FOR BUSINESS AUTOMATION ENVIRONMENTS
JR64850 A SNAPSHOT WITH A CASE SOLUTION IS MADE DEFAULT WHEN DEPLOYED VIA SWAGGER API WITH AN INACTIVE OPTION
JR64883 UMS WLPTAI AND UMS JAASLOGINMODULE FAIL TO DECODE SOME JWT TOKENS
JR64884 INCORRECT CLIENT-SIDE HUMAN SERVICE PAGE VALIDATION ERROR MESSAGES WHEN WEB BROWSER LANGUAGE IS SET TO CHINESE
JR64931 ERROR OCCURS WHEN DEBUGGING A HUMAN SERVICE IN DESKTOP PROCESS DESIGNER INSPECTOR
JR64828 SECURITY APAR - DENIAL OF SERVICE VULNERABILITY IN JACKSON-DATABIND
Enterprise Records
APAR Title Sec. Cont. B.I.
N/A
N/A
FileNet Content Manager
Operational Decision Management
APAR Title Sec. Cont. B.I.
RS03909 BUSINESS CONSOLE UI IMPORT PROJECT/ANT TOOL/APIS SHOULD SUPPORT IMPORTING INDIVIDUAL STANDARD DS PROJECTS
RS03911 IMPORTING COBOL SOLUTION IN RULE DESIGNER FAILS WITH A STACKOVEFLOW
RS03914 CLASSCASTEXCEPTION GENERATING RULEAPP FROM DEPLOYMENT SNAPSHOT USING REST API
RS03917 ENABLING TRACES IN HTDS SLOWS DOWN REST JSON EXECUTIONS
User Management Service
APAR Title Sec. Cont. B.I.
JR64927 Business Teams Service (BTS) creates a large amount of OAuthClient resources
Workflow Process Service
APAR Title Sec. Cont. B.I.
JR64596 SECURITY APAR - CVE-2022-22361 - CROSS SITE REQUEST FORGERY VULNERABILITY IN PROCESS ADMIN CONSOLE X
JR64931 ERROR OCCURS WHEN DEBUGGING A HUMAN SERVICE IN DESKTOP PROCESS DESIGNER INSPECTOR

Known Limitations

Document change history

  • 15 July 2022: Added APAR JR64828 to Business Automation Workflow table.
  • 24 June 2022: Updated air gap installation instructions
  • 3 June 2022: Added APARs JR64931 and JR64596 to fix list tables.
  • 26 May 2022: Initial publish.
  • [{"Type":"MASTER","Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBYVB","label":"IBM Cloud Pak for Business Automation"},"ARM Category":[{"code":"a8m0z0000001gWWAAY","label":"Other-\u003ECloudPak4Automation Platform"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

    Document Information

    Modified date:
    15 July 2022

    UID

    ibm16579189