IBM Support

Readme for Cloud Pak for Automation 20.0.2 IF002

Fix Readme


Abstract

The following document is the documentation for IBM Cloud Pak for Automation 20.0.2 IF002.
Including download and installation information and the list of APARs that are resolved in this interim fix.

Content

Readme file for: IBM Cloud Pak® Automation
Product Release: 20.0.2
Update Name: 20.0.2 IF002
Fix ID: 20.0.2-WS-CP4A-IF002
Publication Date: 30 Oct 2020
Last modified date: 30 Oct 2020

Contents

Download location

Download 20.0.2-WS-CP4A-IF002 from Fix Central here.

Prerequisites

Components impacted

  • ADS
  • BAA
  • BAS

Prior to installation

If you installed any of the Cloud Pak components on a Kubernetes cluster, you can update them with the 20.0.2 IF002 by using the updated operator and the relevant container interim fixes. Details like the image: tag of the interim fix image can be found in the pattern templates on GitHub.
To deploy this interim fix as an update to a 20.0.2 deployment, follow the instructions in the Installing section. If you want to use the interim fix as a part of a new deployment or you want to upgrade a release prior to 20.0.2, refer to IBM Knowledge Center. For more information, see IBM Cloud Pak for Automation 20.0.x.

Installing

Step 1: Get access to the interim fix container images
You can access the container images in the IBM image registry with your IBMid (Option 1), or you can download the images from Fix Central (Option 2).
Option 1: Create a pull secret for the IBM Cloud Entitled Registry
  1. Log in to MyIBM Container Software Library with the IBMid and password that is associated with the entitled software.
  2. In the Container software library tile, click "View library" and then click "Copy key" to copy the entitlement key to the clipboard.
  3. Log in to your Kubernetes cluster and set the context to the project/namespace for your existing deployment.
  4. Create a pull secret by running a kubectl create secret command.
    $ kubectl create secret docker-registry admin.registrykey --docker-server=cp.icr.io --docker-username=cp --docker-password="<API_KEY_GENERATED>" --docker-email=<USER_EMAIL>
    Note: The "cp.icr.io" value for the docker-server parameter is the only registry domain name that contains the images. Use "cp" for the docker-username. The docker-email must be a valid email address (associated to your IBM ID). Make sure you are copying the Entitlement Key in the docker-password field within double quotation marks.
  5. Take a note of the secret and the server values so that you can set them to the "pullSecrets" and "repository" parameters when you update the operator for your containers.
Option 2: Download the packages from Fix Central
  1. Download the images per the instructions in the Download location section, and make a note of the file names.
  2. Log in to your Kubernetes cluster and set the context to the project/namespace for your existing deployment.
  3. Check that you can run a Docker or Podman command.
    For OpenShift 3.11:
    $ docker ps
    For OpenShift 4.3+:
    $ podman ps
  4. Log in to the Docker registry with a token.
    For OpenShift 3.11:
    $ docker login $(oc registry info) -u <ADMINISTRATOR> -p $(oc whoami -t)
    You can also log in to an external Docker registry by using the following command:
    $ docker login <registry_url> -u <your_account>
    For OpenShift 4.3+:
    $ podman login $(oc registry info) -u <ADMINISTRATOR> -p $(oc whoami -t) –tls-verify=false
  5. Run a kubectl command to make sure that you have access to Kubernetes.
    $ kubectl cluster-info
  6. Change the permissions of the scripts/loadimages.sh script so that you can run it.
    $ cd scripts
    $ chmod +x loadimages.sh
  7. Run the loadimages.sh script to load the images into your image registry. The following example shows the input values in the command line.
    ./loadimages.sh -p <ARCHIVE> -r $(oc registry info)/<project-name>
    Where:
    -p  The archive files location or archive file name
    -r  Target image registry and namespace
  8. Check that the images are pushed correctly to the registry.
    $ oc get is
  9. If you want to use an external registry, create a registry secret:
    $ oc create secret docker-registry admin.registrykey --docker-server=<registry_url> --docker-username=<your_account> --docker-password=<your_password> --docker-email=<your_email>
    Take a note of the secret and the server values so that you can set them to the "pullSecrets" and "repository" parameters when you update the operator for your containers.
Step 2: Update the installed operator
  1. Log in to your Kubernetes cluster and set the context to the project for your existing deployment.
    $ oc login https://<CLUSTERIP>:<port> -u <ADMINISTRATOR>
  2. If the persistent volume (PV) for the operator is defined by a hostPath, provide group write permission according to the PV hostPath.path definition (/root/operator).
    $ chmod -R g=u /root/operator
    $ chmod g+rw /root/operator
    Note: If you are using dynamic provisioning, this step is not needed as the PV is created automatically as per the Storage Class definition.
  3. Remove the .OPERATOR_TYPE file in case it exists from a previous deployment.
    $ rm -f /<hostPath>/.OPERATOR_TYPE
    Where hostPath is the value in your PV (root/operator).
  4. Go to the downloaded cert-kubernetes.git for the IF002 interim fix.
  5. Upgrade the operator in your project by running the following command.
    $ ./scripts/upgradeOperator.sh -i <registry_url>/icp4a-operator:20.0.2-IF001 -p '<my_secret_name>' -a accept
     
    Where registry_url is the value for your internal registry or cp.icr.io/cp/cp4a for the IBM Cloud Entitled Registry. The my_secret_name is the secret that is created to access the registry, and accept means that you accept the license.
    Note: use 20.0.2-IF001 operator image.
    Note: If you plan to use a non-admin user to install the operator, you must add the user to the "ibm-cp4a-operator" role.
    $ oc adm policy add-role-to-user ibm-cp4a-operator <user_name>
  6. Monitor the pod until it shows a STATUS of Running:
    $ oc get pods -w
    Note: When started, you can monitor the operator logs with the following command:
    $ oc logs -f deployment/ibm-cp4a-operator -c operator
Step 3: Update the custom resource YAML file for your deployment
Get the custom resource YAML file that you previously deployed (e.g., ../scripts/generated-cr/ibm_cp4a_cr_final.yaml) and edit it to update each component:
  1. If you are using the fully customizable CRs (e.g., ibm_cp4a_cr_demo_decisions_ads.yaml), then in the sections for each of the components that are included in your deployment, modify the component.image.tag configuration parameter to reflect the value for the new images. For example, to update the images for ADS use the following tag:
    images:
          keytool_job_container:
            repository: cp.icr.io/cp/cp4a/ums/dba-keytool-jobcontainer
            tag: 20.0.2-IF002
          dbcompatibility_init_container:
            repository: cp.icr.io/cp/cp4a/aae/dba-dbcompatibility-initcontainer
            tag: 20.0.2-IF002
          ...
    Tip: The values of the tags for a given interim fix can be found in the readme file that is provided with that interim fix. Verify that the secret named in the CR YAML file as the imagePullSecrets is valid. Note that the secret might be expired, in which case you must re-create the secret.
    Repeat this step for each component that you want to update.
Step 4: Apply the updated custom resource YAML file
  1. Check that all the components that you want to upgrade are configured with interim fix image tag values.
    $ cat ../scripts/generated-cr/ibm_cp4a_cr_final.yaml
  2. Update the configured components by applying the custom resource.
    $ kubectl apply -f ../scripts/generated-cr/ibm_cp4a_cr_final.yaml
Step 5: Verify the updated automation containers
The operator reconciliation loop might take several minutes. When all of the pods are Running, you can access the status of your containers by running the following commands:
$ oc status
$ oc get pods -w
$ oc logs <operatorPodName> -f -c operator
 

Performing the necessary tasks after installation

For more information, see IBM Cloud Pak for Automation 20.0.x.

Uninstalling

For more information, see IBM Cloud Pak for Automation 20.0.x.

List of Fixes

APARs are listed in tables, columns are defined as follow: 
Colunm title Column description
APAR The defect number
Title A short description of the defect
Sec. A mark indicates a defect related to security
Cont. A mark indicates a defect specific to the cloud pak integration of the component
B.I. A mark indicates the fix has a business impact. Details is found in the title column or the APAR document
General
APAR Title Sec. Cont. B.I.
JR63106
IBM CLOUD PAK AUTOMATION UTILITY IMAGES 20.0.2-IF001 HAVE VULNERABILITIES
 X
APAR Title Sec. Cont. B.I.
JR62823

THE RADIO BUTTON GROUP SHOWS A LIST OF "UNDEFINED"S WHEN "ITEM INPUT DATA" REFERS TO A STRING LIST
JR62855

DATE TIME PICKER WORKS INCORRECTLY FOR NON-ENGLISH LANGUAGES
JR62922

SECURITY APAR - CVE-2020-5258, CVE-2020-5259, AND CVE-2019-10785 AFFECTS IBM BUSINESS AUTOMATION APPLICATION

 X
JR62923

SECURITY APAR - CVE-2020-13822, CVE-2020-8244 AND CVE-2020-15168 AFFECTS IBM BUSINESS AUTOMATION APPLICATION

 X

Back to top

Business Automation Navigator
APAR Title Sec. Cont. B.I.
IO28127

Multiple security issues in third party libraries of BAN

 x x

Back to top

Automation Decision Services
APAR Title Sec. Cont. B.I.
JR62959

Multiple security issues in third party libraries of ADS

 X X
Business Automation Studio
APAR Title Sec. Cont. B.I.
JR62851

SECURITY APAR - CVE-2020-5258 AFFECTS IBM BUSINESS AUTOMATION STUDIO

 X
JR62922

SECURITY APAR - CVE-2020-5258, CVE-2020-5259, AND CVE-2019-10785 AFFECTS IBM BUSINESS AUTOMATION APPLICATION

 X
JR62923

SECURITY APAR - CVE-2020-13822, CVE-2020-8244 AND CVE-2020-15168 AFFECTS IBM BUSINESS AUTOMATION APPLICATION

 X
JR62956

SECURITY APAR - CVE-2020-5259 AFFECTS IBM BUSINESS AUTOMATION STUDIO

 X
JR62957

SECURITY APAR - CVE-2020-10785 AFFECTS IBM BUSINESS AUTOMATION STUDIO

 X
JR62961

SECURITY APAR - CVE-2020-4051 AFFECTS IBM BUSINESS AUTOMATION STUDIO

 X

Operational Decision Management
APAR Title Sec. Cont. B.I.
JR62960

Security issue in ODM for CP4A (CVE-2020-14352)

 X X

 

Back to top

Document change history

  • 30 Oct 2020: first publish.

    • [{"Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS2JQC","label":"IBM Cloud Pak for Automation"},"ARM Category":[{"code":"a8m0z0000001gWWAAY","label":"CloudPak4Automation Platform"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"20.0.2"}]

    Document Information

    Modified date:
    17 December 2020

    UID

    ibm16353451

    Page Feedback