Prerequisite

You have successfully deployed the IBM Cloud Pak for Automation operator following the User Management Services Deployment Guide for IBM Cloud Pak for Automation Beginners - Part 1

Provide configuration in the Custom Resource file

In Part 1 a Custom Resource Definition (CDR) has been added to the cluster and the operator has been deployed.
Now capabilities such as the User Management Services can be installed.
Capabilities are installed using the command line interface by leveraging a custom resource file.

A custom resource file defines the configuration that is shared across capabilities, as as the LDAP and datasource configuraiton.
A custom resource also has configuration sections dedicated to each of the capabilities.
The UMS section in the Custom Resource file starts with the key ums_configuration. If this key is available in the custom resource file, the operator detects the configuration and deploys UMS.

In addition, IBM Cloud Pak for Automation capabilities can be deployed using patterns. UMS is part of many patterns including content, workflow or decisions. UMS is "pattern-aware" of these patterns. By configuring a pattern in the custom resource file, UMS is automatically deployed without any configuration in the custom resouce file.

As we want to install UMS stand-alone, we will not be using a configuration pattern. Instead, we will adjust a custom resource template.

In IBM Cloud Pak for Automation a set of templates is provided that can be used to manually create a custom resource file. In IBM Cloud Pak for Automation, UMS is part of the foundation pattern. The foundation pattern is defined in ibm_cp4a_cr_enterprise_FC_foundation.yaml. Copy the file from descriptors/patterns directory of the cloned repository to your working directory.

Shared Configuration

Provide or adjust the shared configuration in the Custom Resource file.

1. Accept the license

Accept the license:
  ## MUST exist, used to accept ibm license, valid value only can be "accept"
  ibm_license: "accept"

    ## All CP4A components must use/share the image_pull_secrets to pull images
    image_pull_secrets:
    - admin.registrykey

  images
    keytool_job_container:
      repository: cp.icr.io/cp/cp4a/ums/dba-keytool-jobcontainer
      tag: 20.0.3

 # sc_deployment_patterns: foundation

 sc_deployment_platform: OCP

 ## For OCP, this is used to create route, you should input a valid hostname in the required field.
 sc_deployment_hostname_suffix: "{{ meta.namespace }}.<Required>"

oc get route console -n openshift-console -o yaml|grep routerCanonicalHostname

oc get storageclass

storage_configuration:
  sc_slow_file_storage_classname: "<storage-class>"
  sc_medium_file_storage_classname: "<storage-class>"
  sc_fast_file_storage_classname: "<storage-class>"

  ## The beginning section of LDAP configuration for CP4A
  ldap_configuration:

  datasource_configuration:
    dc_ums_datasource:
      dc_ums_oauth_type: derby
      dc_ums_teamserver_type: derby

UMS Configuration

Create UMS secrets

Before you deploy UMS you must manually create a secret to avoid passing sensitive information in configuration files. Create the secret configuration in a file, for instance ums-secrets.yaml, with the following content. Replace the content for the adminUser and adminPassword:

apiVersion: v1
kind: Secret
metadata:
  name: ibm-dba-ums-secret
type: Opaque
stringData:
  adminUser: "<umsadmin>"
  adminPassword: "<my-secret-passw0rd>"

If you use configure UMS to use a database other than the built-in derby, additionally specify secrets for the oauth and the teamserver database in the stringData section:

  oauthDBUser: "<dbuser>"
  oauthDBPassword: "<dbuser-password>"
  tsDBUser: "<dbuser>"
  tsDBPassword: "<dbuser-password>"

Create the secret

oc create -f ums-secrets.yaml

Provide or adjust the UMS configuration in the Custom Resource file

Edit my-ums-cr.yaml.

1. Verify the configuration for the image repository

    images:
      ums:
        repository: cp.icr.io/cp/cp4a/ums/ums
        tag: 20.0.3

2.Verify the name of the secret that you previously created. It must be the value of the parameter admin_secret_name:

admin_secret_name: ibm-dba-ums-secret

3. For any of the UMS pods – sso, scim, teamserver – you can use the default configuration for now. However, if you use the built-in derby database, only replica_count: 1 makes sense, as with the built-in derby database the data is not shared across the pods. And: if you restart a pod, all configuration will be lost, as the data in the built-in database will disappear with the pod. You can also disable autoscaling when using the built-in derby database.

    # Configuration for sso pods
    sso:
      replica_count: 1
      resources:
        limits:
          cpu: 500m
          memory: 512Mi
        requests:
          cpu: 200m
          memory: 256Mi
      autoscaling:
        enabled: false
        minReplicas: 2
        maxReplicas: 5
        targetAverageUtilization: 98
      custom_xml:
      logs:
        traceSpecification: "*=info"

Save the changes.

Deploy UMS

Deploy UMS by applying the CR

oc create -f my-ums-cr.yaml

oc get pods