Introducing Db2U Next Gen - Modernizing Db2 for OpenShift and Kubernetes
By Austin Clifford, Janpreet Singh Chandhok, Aruna De Silva
The current Db2 Operator has served us well, but the future demands more agility, security, and simplicity. Enter Db2U Next Gen—a modern operator designed for Kubernetes-native deployments of Db2 and Db2 Warehouse. This evolution replaces the legacy Operator Lifecycle Manager (OLM) with a Helm-based, GitOps-compatible installation model, making deployments faster and more aligned with cloud-native best practices.
This is the first in a series of blogs for Db2U Next Gen, that will cover topics including:
- Helm and GitOps
- Db2U Next Gen and the Kubernetes ecosystem
- User Management
- Certificate Management
If you are new to Db2 containerization, check out this IDUG blog which gives a comprehensive overview of the current gen Db2U operator and the underpinning Kubernetes concepts.
Why Next Gen Matters
Next Gen isn’t just an upgrade—it’s a smarter way to manage Db2 for Kubernetes and OpenShift. It offers:
- Independent resource updates for flexibility
- Clear visibility into resource status
- Improved performance and serviceability for a better user experience
What’s at the Core?
At the heart of the operator is the reconciler—a component that continuously monitors your application state and ensures everything stays in sync. If something drifts, for example a manual change is applied to the deployment directly and not through the Db2uInstance custom resource, the reconciler steps in to correct it. Another example is if the operator detects the certificate used for SSL connections to Db2 is about to expire, then it automatically intervenes to rotate the certificate, without incurring any outage. The result? A consistent, reliable environment without manual intervention.
7 Key Improvements Over the Current Operator
1. Security First
- Reduced ClusterRole privileges means the operator now requests fewer and more restrictive permissions, following the principle of least privilege to improve cluster security. Support for Kubernetes custom Security Context Constraints (SCCs), which define security settings for pods such as user IDs, volume types, and privilege levels; service accounts, which provide identities for pods to interact with the cluster; and Role Based Access Control (RBAC), a mechanism that restricts user and service account permissions based on defined roles and bindings.
- Fewer images, reducing the attack surface
- Integration with Kubernetes certificate managers and identity providers
2. Resource Efficiency
- Faster deployments with lower resource consumption
- Default Db2 configurations embedded in the image
- Simplified operator model with fewer intermediary resources
- No external dependencies such as key-value stores (e.g., etcd), eliminating the associated administrative overhead.
3. Validation & Mutating Webhooks
The validation webhook acts as a gatekeeper, intercepting API requests before they hit the cluster. The mutation webhook modifies the resource kind to set default values for example. These enforce policies such as:
- Validating image versions and registry sources
- Restricting downtime-causing changes unless annotated
- Ensuring SSL configurations and certificate integrity
- Mutate, i.e. modify the
Db2uInstance Custom Resource (CR) during creation or update, to inject predefined default configuration values such as database name, storage settings, and security parameters to facilitate a streamlined deployment
4. Streamlined Installation
Next Gen uses Helm, a widely adopted Kubernetes package manager, instead of Operator Lifecycle Manager (OLM). Helm simplifies application deployment and management by packaging Kubernetes resources into reusable charts, enabling version control, easy upgrades, and rollback capabilities:
- Reduced reliance on cluster-admin permissions
- No global pull secrets or ICSPs (ImageContentSourcePolicies, which redirect image pulls to mirrored sources). This enhances security by limiting registry credentials to specific namespaces and deployments, reducing the risk of cluster-wide exposure
- Support for Declarative GitOps toolchains like Argo CD
- Flexible RBAC options
5. Independent Updates & Semantic Versioning
Db2 images and the operator can now be updated independently. Images follow a clear semantic versioning scheme for predictable upgrades:
spec.image: icr.io/db2u/db2u.<DBTYPE>:VRMF-CSB
Example: icr.io/db2u/db2u.db2wh:12.1.3.0
6. High Availability (HA) Reimagined
Next Gen replaces built-in HA (a.k.a. Wolverine) which uses etcd for state, with a new HA framework which relies on runit (a lightweight process manager) and Kubernetes-native lifecycle probes. This design improves resiliency, recovery times as well as decentralizing failure detection, allowing pods to self-heal.
7. Storage Pre-checker
Avoid surprises during deployment with the storage pre-checker Init Container, which validates storage configurations before workloads start. Validation results are posted into the Db2uInstance CR status as well as into a log file on disk, helping you to understand any issues in your environment while deploying Db2.
Ready to Try It?
Db2U Next Gen is available as a technical preview supporting Db2 version 12.1.3 for non-production deployments. Contact IBM Technical Support to request access to the Helm chart and experience Next Gen for yourself.
Also, checkout this demo of Next Gen which shows how we've transformed the containerized database experience with improved install, deployment, usability, security and reliability.
About the Authors
Austin Clifford is a Senior Technical Staff Member in Hybrid Data Management based in the Ireland Lab. He has worked with database, data lake and warehousing technologies for more than two decades. In 2012, Austin led the team to achieve a Guinness World Record for the Largest Data Warehouse, a record that IBM held for two years. Austin has authored numerous papers and patents, advises clients on data warehouse, analytics and containerization best practices and is a regular speaker at technical conferences. He can be reached at acliffor@ie.ibm.com
Janpreet Singh Chandhok is a software engineer working in the Db2 containerization offering with special focus on hybrid cloud technologies. He can be reached at janpreet.chandhok@ibm.com
Aruna De Silva is the architect for Db2/Db2 Warehouse containerized offerings on IBM Cloud Pack for Data, OpenShift and Kubernetes. He has nearly two decades of database technology experience and is based off IBM Toronto software laboratory. Since 2015, he has been actively involved with modernizing Db2, bringing Db2 Warehouse – Common Container, the first containerized Db2 solution out into production in 2016. Since 2019, he has been primarily focused on bringing the success of Db2 Warehouse into cloud native platforms such as OpenShift and Kubernetes while embracing micro service architecture and deployment patterns. He can be reached at adesilva@ca.ibm.com
References
https://www.ibm.com/support/pages/db2u-next-generation