IBM Sterling B2B Integrator (B2BI) is a powerful platform for managing complex B2B integrations, EDI processing, and secure data exchange. Deploying B2BI on Red Hat OpenShift on IBM Cloud (ROKS) enables scalability, high availability, and better resource management.
In this guide, we’ll walk through a complete, end-to-end installation of B2BI on ROKS, including cluster setup, Db2 configuration, networking, and deployment using Helm.
This tutorial is based on a real-world setup and focuses on practical steps, common pitfalls, and best practices.
To begin the installation, first create a Red Hat OpenShift cluster on IBM Cloud.
This improves availability and resilience.
This allows access from both internal and external networks.
Cluster creation may take several minutes.
This is required for persistent volumes.
This supports production workloads.
Step 4: Get IBM Entitlement Key
IBM container images (including Sterling B2B Integrator) are hosted in the IBM container registry (cp.icr.io). To pull these images, you need an entitlement key.
Steps:
- Navigate to:
IBM Container Library → Entitlement Keys
- Copy your entitlement key
- (Optional) Verify locally:
docker login cp.icr.io \
--username cp \
--password <YOUR_ENTITLEMENT_KEY>
This key will be used later when creating Kubernetes secrets.
Step 5: Connect CLI to Your ROKS Cluster
Before deploying, connect your local CLI to the cluster.
# Login to IBM Cloud
ibmcloud login --sso
# Set resource group
ibmcloud target -g rg-b2bi
# Configure cluster access
ibmcloud oc cluster config --cluster <cluster-name>
# Open OpenShift Cluster Console (UI step)
# - Go to your OpenShift cluster in IBM Cloud
# - Click "OpenShift Web Console"
# - In the top-right corner, click your profile name
# - Select "Copy Login Command"
# - It will open a new page
# - Click "Display Token"
# - Copy the oc login command
# Login to cluster using copied command
# (Paste the copied oc login command in terminal)
oc login --token=<your-token> --server=<your-server-url>
# Verify connection
oc get nodes
You should see all worker nodes in Ready state.
Step 6: Create Namespace and Persistent Storage
Sterling B2B Integrator requires persistent storage for logs, resources, and documents.
Create Namespace
Create PVCs
Create a file b2bi-pvcs.yaml:
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: b2b-psts-resources
namespace: b2b-psts
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 20Gi
storageClassName: ibmc-vpc-file-1000-iops
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: b2b-psts-logs
namespace: b2b-psts
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 50Gi
storageClassName: ibmc-vpc-file-1000-iops
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: b2b-psts-documents
namespace: b2b-psts
spec:
accessModes:
- ReadWriteMany
resources:
requests:
storage: 100Gi
storageClassName: ibmc-vpc-file-1000-iops
Apply:
oc apply -f b2bi-pvcs.yaml
oc get pvc -n b2b-psts
Step 7: Create Kubernetes Secrets
7.1 IBM Registry Secret
oc create secret docker-registry ibm-entitlement-key \
--docker-server=cp.icr.io \
--docker-username=cp \
--docker-password=<YOUR_ENTITLEMENT_KEY>
7.2 Db2 Credentials
oc create secret generic b2b-psts-db-secret \
--from-literal=DB_USER=<username> \
--from-literal=DB_PASSWORD=<password>
7.3 System Passphrase
oc create secret generic b2b-psts-system-passphrase \
--from-literal=SYSTEM_PASSPHRASE=<secure-password>
Step 8: Create Service Account and Permissions
# 1. Create dedicated service account
oc create serviceaccount b2b-psts-sa -n b2b-psts
# 2. Create a role with required permissions
oc create role b2b-psts-role \
--verb=get,list,watch,create,update,patch,delete \
--resource=pods,configmaps,secrets,services,routes,persistentvolumeclaims,endpoints \
-n b2b-psts
# 3. Bind the role to the service account
oc create rolebinding b2b-psts-binding \
--role=b2b-psts-role \
--serviceaccount=b2b-psts:b2b-psts-sa \
-n b2b-psts# 4. Link the registry pull secret to the service account
oc secrets link b2b-psts-sa ibm-entitlement-key \
--for=pull -n b2b-psts
# 5. Grant anyuid SCC — allows B2BI to run as its required UID (1010)
# Without this, OpenShift rejects the pod with "permission denied"
oc adm policy add-scc-to-user anyuid \
-z b2b-psts-sa -n b2b-psts
This allows B2BI pods to run with the required user permissions.
Step 9: Upload Required Files to PVC
You must upload:
db2jcc4.jardb2TrustStore.jks
Create temporary pod:
# Run on your local machine where you downloaded the Db2 SSL cert
keytool -import -alias db2cert \
-file db2-cert.pem \
-keystore db2TrustStore.jks \
-storepass changeit \
-noprompt
# Verify it was created
ls -lh db2TrustStore.jks
-------------------------------------------------------
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Pod
metadata:
name: pvc-uploader
namespace: b2b-psts
spec:
containers:
- name: uploader
image: image-registry.openshift-image-registry.svc:5000/openshift/tools:latest
command: ["sleep", "3600"]
volumeMounts:
- name: resources
mountPath: /ibm/resources
securityContext:
runAsNonRoot: false
volumes:
- name: resources
persistentVolumeClaim:
claimName: b2b-psts-resources
serviceAccountName: b2b-psts-sa
EOF# Wait for pod to be Running
oc get pod pvc-uploader -n b2b-psts -w
Upload the Files:
# Create the resources directory
oc exec -n b2b-psts pvc-uploader -- mkdir -p /ibm/resources
# Upload JDBC driver
oc cp ./db2jcc4.jar b2b-psts/pvc-uploader:/ibm/resources/db2jcc4.jar
# Upload SSL truststore
oc cp ./db2TrustStore.jks b2b-psts/pvc-uploader:/ibm/resources/db2TrustStore.jks
# Verify both files are present
oc exec -n b2b-psts pvc-uploader -- ls -lh /ibm/resources/
# Expected:
# -rw-r--r-- 1 root root 3.8M db2jcc4.jar
# -rw-r--r-- 1 root root 1.2K db2TrustStore.jks
# Clean up the temporary pod
oc delete pod pvc-uploader -n b2b-psts
Step 10: Add IBM Helm Repository
# Add IBM Helm repository
helm repo add ibm-helm \
https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm
helm repo update
# Search available versions
helm search repo ibm-helm/ibm-b2bi-prod --versions
# Latest as of 2026: 3.2.1 (App: 6.2.2.0_1)
# Used in this guide: 3.1.3 (App: 6.2.1.1_2)
# Pull and unpack the chart
helm pull ibm-helm/ibm-b2bi-prod --version 3.1.3 --untar
cd ibm-b2bi-prod
ls
Step 11: Create values-override.yaml
Create a custom configuration file:
# =============================================================
# IBM Sterling B2B Integrator — values-override.yaml
# Chart: ibm-b2bi-prod 3.1.3 (App: 6.2.1.1_2)
# =============================================================
# ── 1. LICENSE ────────────────────────────────────────────────
global:
license: true
licenseType: "non-prod" # "prod" for customer production license
image:
pullSecret: "ibm-entitlement-key"
documentService:
enabled: false
# ── 2. SERVICE ACCOUNT ───────────────────────────────────────
serviceAccount:
name: "b2b-psts-sa"
# ── 3. DATABASE CONFIGURATION ────────────────────────────────
setupCfg:
dbVendor: "DB2"
dbHost: "<your-db2-hostname>"
# Use the hostname from your Db2 service credentials JSON
# If using public endpoint: cbd4eb2a-xxxx-ussouth.bt1ibm.db2.ibmappdomain.cloud
# If using private endpoint: cbd4eb2a-xxxx-ussouth-private.bt1ibm.db2.ibmappdomain.cloud
dbPort: 30413
# Must be an integer (no quotes) — the chart schema enforces integer type
dbData: "BLUDB" # Db2 on Cloud always uses BLUDB
dbDrivers: "db2jcc4.jar" # Filename only — B2BI looks in /ibm/resources/
dbCreateSchema: true # true = fresh install | false = upgrade
usessl: true
dbTruststore: "db2TrustStore.jks" # Filename only — in /ibm/resources/
dbTruststorePassword: "changeit" # Password used when creating the JKS
dbTruststoreSecret: ""
dbSecret: "b2b-psts-db-secret"
systemPassphraseSecret: "b2b-psts-system-passphrase"
adminEmailAddress: "admin@yourdomain.com"
smtpHost: "smtp.example.com"
libertyKeystoreSecret: ""
basePort: 50000
defaultDocumentStorageType: DB
licenseAcceptEnableSfg: false
licenseAcceptEnableEbics: false
licenseAcceptEnableFinancialServices: false
licenseAcceptEnableFileOperation: false
enableFipsMode: false
nistComplianceMode: "off"
restartCluster: false
useSslForRmi: true
connectionpoolFailoverEnable: false
# ── 4. PERSISTENT VOLUME CLAIMS ──────────────────────────────
appResourcesPVC:
enabled: true
storageClassName: "ibmc-vpc-file-1000-iops"
accessMode: ReadOnlyMany
size: 100Mi
preDefinedResourcePVCName: "b2b-psts-resources"
appLogsPVC:
enabled: true
storageClassName: "ibmc-vpc-file-1000-iops"
accessMode: ReadWriteMany
size: 50Gi
preDefinedLogsPVCName: "b2b-psts-logs"
appDocumentsPVC:
enabled: true
storageClassName: "ibmc-vpc-file-1000-iops"
accessMode: ReadWriteMany
size: 100Gi
enableVolumeClaimPerPod: false
preDefinedDocumentPVCName: "b2b-psts-documents"
persistence:
enabled: true
useDynamicProvisioning: false
# ── 5. DATABASE SETUP JOB ────────────────────────────────────
dataSetup:
enabled: true # true = fresh install (creates DB schema and 780+ tables)
# false = skip DB setup (use after first successful install)
upgrade: false
# ── 6. ASI POD (Application Server Instance) ─────────────────
asi:
replicaCount: 1
resources:
limits:
cpu: 4000m
memory: 8Gi
ephemeral-storage: "4Gi"
requests:
cpu: 2000m
memory: 4Gi
ephemeral-storage: "2Gi"
startupProbe:
initialDelaySeconds: 300
timeoutSeconds: 30
periodSeconds: 60
failureThreshold: 10
livenessProbe:
initialDelaySeconds: 60
timeoutSeconds: 30
periodSeconds: 60
readinessProbe:
initialDelaySeconds: 30
timeoutSeconds: 5
periodSeconds: 60
internalAccess:
enableHttps: false
httpsPort: 30202
tlsSecretName: ""
ingress:
internal:
host: "b2b-psts-asi-internal.<YOUR-INGRESS-DOMAIN>"
tls:
enabled: true
secretName: ""
external:
host: "b2b-psts-asi-external.<YOUR-INGRESS-DOMAIN>"
tls:
enabled: true
secretName: ""
externalAccess:
protocol: http
address:
port:
# ── 7. AC POD (Adapter Container) ────────────────────────────
ac:
replicaCount: 1
resources:
limits:
cpu: 4000m
memory: 8Gi
ephemeral-storage: "4Gi"
requests:
cpu: 2000m
memory: 4Gi
ephemeral-storage: "2Gi"
livenessProbe:
initialDelaySeconds: 60
timeoutSeconds: 5
periodSeconds: 60
readinessProbe:
initialDelaySeconds: 60
timeoutSeconds: 5
periodSeconds: 60
internalAccess:
enableHttps: false
tlsSecretName: ""
ingress:
internal:
host: "b2b-psts-ac-internal.<YOUR-INGRESS-DOMAIN>"
tls:
enabled: true
secretName: ""
external:
host: "b2b-psts-ac-external.<YOUR-INGRESS-DOMAIN>"
tls:
enabled: true
secretName: ""
# ── 8. API POD (REST API Server) ─────────────────────────────
api:
replicaCount: 1
resources:
limits:
cpu: 4000m
memory: 4Gi
ephemeral-storage: "4Gi"
requests:
cpu: 2000m
memory: 2Gi
ephemeral-storage: "2Gi"
livenessProbe:
initialDelaySeconds: 60
timeoutSeconds: 5
periodSeconds: 60
readinessProbe:
initialDelaySeconds: 60
timeoutSeconds: 5
periodSeconds: 60
internalAccess:
enableHttps: false
tlsSecretName: ""
ingress:
internal:
host: "b2b-psts-api-internal.<YOUR-INGRESS-DOMAIN>"
tls:
enabled: true
secretName: ""
# ── 9. INGRESS CONTROLLER ────────────────────────────────────
ingress:
enabled: true
controller: "ibm" # "ibm" = use OpenShift Routes (correct for ROKS)
annotations:
route.openshift.io/termination: "edge"
port:
# ── 10. ENVIRONMENT ──────────────────────────────────────────
env:
tz: "America/New_York" # Set your timezone
upgradeCompatibilityVerified: false
debugMode: false
# ── 11. LOGS ─────────────────────────────────────────────────
logs:
enableAppLogOnConsole: false
# false = logs written to PVC (persistent, survives pod restart)
# true = logs to stdout only (lost on pod restart)
# ── 12. SECURITY CONTEXT ─────────────────────────────────────
security:
supplementalGroups: [65534]
fsGroup:
fsGroupChangePolicy: "OnRootMismatch"
runAsUser:
runAsGroup:
# ── 13. DISABLE UNUSED INTEGRATIONS ─────────────────────────
integrations:
seasIntegration:
isEnabled: false
itxIntegration:
enabled: false
itxaIntegration:
enabled: false
as4Service:
enabled: false
# ── 14. PURGE JOB ────────────────────────────────────────────
purge:
enabled: true
schedule: "0 0 * * 0" # Weekly Sunday midnight
suspend: false
# ── 15. ARCHITECTURE ─────────────────────────────────────────
arch:
amd64: "2 - No Preference"
ppc64le: "0 - Do not use"
s390x: "0 - Do not use"
- DB hostname (private endpoint recommended)
- Secrets names
Step 12: Install Sterling B2B Integrator
helm install b2b-psts ibm-helm/ibm-b2bi-prod \
--version 3.1.3 \
--namespace b2b-psts \
--values values-override.yaml \
--timeout 120m \
--wait
This step may take 60–90 minutes due to database initialization.
Step 13: Verify Deployment
oc get pods -n b2b-psts -w
Expected pods:
All should be in Running state.
Step 14: Access B2BI Dashboard
oc get routes -n b2b-psts
Open:
http://<asi-route>/dashboard
Default login:
- Username:
admin
- Password:
password
Change your password immediately after login.
Common Issues and Fixes
- PVC Pending → Check storage class
- Db2 timeout → Verify VPE gateway
- ImagePullBackOff → Check entitlement key
- Helm timeout → Increase timeout value
Conclusion
In this guide, we covered the complete setup of IBM Sterling B2B Integrator on ROKS, including:
- Cluster setup and networking
- Db2 configuration
- Private connectivity using VPE
- Kubernetes resource preparation
- Helm-based deployment
By following these steps, you can successfully deploy a scalable and production-ready B2B integration platform on OpenShift.