Decision Management & Intelligence (ODM, DI)

Decision Management & Intelligence (ODM, DI)

Connect with experts and peers to elevate technical expertise, solve problems and share insights


#Data
#Data
#Businessautomation
#DecisionManagement
 View Only

How do I install ODM Bronze topology with CP4BA 26.0.0

By Said Moutaa posted 08/04/26 12:30 PM

  

IBM Operational Decision Manager

How do I install ODM Bronze topology with CP4BA 26.0.0?

A practical installation guide for deploying an ODM Bronze topology on OpenShift as part of IBM Cloud Pak for Business Automation 26.0.0.

Target audience

ODM user with ODM Administrator role

Estimated duration

120 minutes


This article is part of an article series around Operational Decision Manager (ODM) topologies in context of Cloud Pak for Business Automation (CP4BA). For more information about ODM environments and the topologies, see CP4BA ODM topologies on OpenShift.

1. Introduction

This document aims to describe how to make an ODM Bronze topology deployment on OpenShift as a component of CP4BA 26.0.0.

ODM Bronze topology is an enterprise deployment of ODM in a single namespace of a cluster. It corresponds to the default production pattern deployment.

image

Schema of an ODM Bronze topology (fig. 1)

Bronze topology is best suited for prototypes or applications with low production constraints (Small, no HA). It can also be seen as the baseline for Silver and Gold topologies and will be referenced as such in other articles.

2. Installation

Before you start
Prior to installation, go through Planning for a CP4BA multi-pattern production deployment guide to understand what you need, what options you have, storage classes, security, permissions, high availability, license entitlements, and how you can measure the usage of your deployments.

Deploying ODM production pattern comes with some choices which can lead to different installation instructions. In Review your deployment options, there are several production deployment guides for CP4BA 26.0.0. In this article, we focus on CP4BA single-pattern production deployment on ROKS classic and OCP by following installation guides in PDF to guide you in implementing your deployment in an OpenShift cluster.

As a prerequisite, follow the various topics in Option 1: Preparing your cluster for an online deployment to set up your cluster before you create the ODM deployment in a specified namespace. The next section helps you to go through this preparation.

2.1 Cluster preparation steps

The cluster preparation (online or offline) procedure is summarized in PDF file: Setting up CP4BA on an online cluster and Setting up CP4BA on an offline cluster.

The table below goes through the online preparation procedure step-by-step.

Topic Awaited action and results
Preparing a client to connect to the cluster This is an action.
You must make sure that the client that you intend to use to connect to the OpenShift cluster has all the necessary tools. If necessary, please proceed to the installation.
Preparing your cluster This is an action.
Before you install any of the automation containers, you must prepare a cluster for the patterns that you want to use.
Preparing a namespace for the Cloud Pak operator This is an action.
All instances of an operator need a namespace whether it is on a private cloud (OCP) or on IBM Cloud® Public (ROKS). Depending on your platform type, either prepare the namespace on OCP or on ROKS.

Example:
oc new-project bronze
Getting access to container images This is a decision to be made.
To get access to the container images from the IBM entitled registry, you must have a key to pull the images from the IBM registry.

Get your access key to the Cloud Pak container images here: My IBM Container Software Library.
  • Global pull secret
  • Cluster scope pull secret
  • Namespace pull secret
Setting up the cluster This is an action.
If you plan to use the Form view in Operator Hub, then set up the cluster with the OpenShift console.

You can also follow the procedure described in this section to set up the cluster by running Shell scripts:
  1. Install IBM License Service and IBM Certificate Manager by running a script.
  2. Set up cluster:
cd cert-kubernetes/scripts
./cp4a-clusteradmin-setup.sh

Note: The script above comes from CASE package.
Expected result
At this stage, you have been through the checklist to prepare your cluster. All the available storage class names are displayed along with the infrastructure node name.

Sample output of the ./cp4a-clusteradmin-setup.sh script execution with default values and an Entitlement Key:

./cp4a-clusteradmin-setup.sh


 


[INFO] Setting up the cluster for IBM Cloud Pak for Business Automation


 


 


Do you wish setup your cluster for a online based CP4BA deployment or for a airgap/offline based CP4BA deployment:


1) Online


2) Offline/Airgap


Enter a valid option [1 to 2]: 1


 


 


Select the cloud platform to deploy:


1) RedHat OpenShift Kubernetes Service (ROKS) - Public Cloud


2) OpenShift Container Platform (OCP) - Private Cloud


3) Other (Certified Kubernetes Cloud Platform / CNCF)


Enter a valid option [1 to 3]: 2


 


 


What type of deployment is being performed?


ATTENTION: The BAI standalone only supports "Production" deployment type.


1) Starter


2) Production


Enter a valid option [1 to 2]: 2


 


 


[NOTES] If you are planning to enable FIPS for CP4BA deployment, this script can perform a check on the OCP cluster to ensure the compute nodes have FIPS enabled.


Do you want to proceed with this check? (Yes/No, default: No): No


 


 


[NOTES] You can install the CP4BA deployment as either a private catalog (namespace scope) or the global catalog namespace (GCN). The private option uses the same target namespace of the CP4BA deployment, the GCN uses the openshift-marketplace namespace.


Do you want to deploy CP4BA using private catalog (recommended)? (Yes/No, default: Yes): Yes


 


 


[NOTES] CP4BA deployment supports separation of operators and operands, the script can deploy CP4BA operators and it's capabilities in different projects.


Do you want to deploy CP4BA as separation of operators and operands? (Yes/No, default: No): No


 


 


Where do you want to deploy Cloud Pak for Business Automation?


Enter the name for a new project or an existing project (namespace): bronze


 


 


The Cloud Pak for Business Automation Operator (Pod, CSV, Subscription) not found in cluster


Continue....


 


Project "bronze" already exists! Continue...


 


[INFO] Creating project "ibm-cert-manager" for IBM Cert Manager operator catalog.


Project "ibm-cert-manager" already exists! Continue...


 


[✔] Created project "ibm-cert-manager" for IBM Cert Manager operator catalog.


 


[INFO] Creating project "ibm-licensing" for IBM Licensing operator catalog.


Project "ibm-licensing" already exists! Continue...


 


[✔] Created project "ibm-licensing" for IBM Licensing operator catalog.


 


[INFO] Creating ibm-cp4ba-common-config configMap for this CP4BA deployment in the project "bronze"


 


[✔] Created ibm-cp4ba-common-config configMap for this CP4BA deployment in the project "bronze".


 


This script prepares the OLM for the deployment of some Cloud Pak for Business Automation capabilities


 


Here are the existing users on this cluster:


1) Cluster Admin


2) ocadmin


Enter an existing username in your cluster, valid option [1 to 2], non-admin is suggested: 2


 


[INFO] Creating cp4ba-fips-status configMap in the project "bronze"


 


[✔] Created cp4ba-fips-status configMap in the project "bronze".


 


Follow the instructions on how to get your Entitlement Key:


https://www.ibm.com/docs/en/cloud-paks/cp-biz-automation/26.0.0?topic=deployment-getting-access-images-from-public-entitled-registry


 


Do you have a Cloud Pak for Business Automation Entitlement Registry key (Yes/No, default: No): Yes


 


Enter your Entitlement Registry key:


Verifying the Entitlement Registry key...


Login Succeeded!


Entitlement Registry key is valid.


 


The existing storage classes in the cluster:


NAME                              PROVISIONER                                      RECLAIMPOLICY   VOLUMEBINDINGMODE      ALLOWVOLUMEEXPANSION   AGE


managed-nfs-storage (default)     redhat-emea-ssa-team/hetzner-ocp4                Delete          Immediate              false                  3y354d


ocs-storagecluster-ceph-rbd       openshift-storage.rbd.csi.ceph.com               Delete          Immediate              true                   3y275d


ocs-storagecluster-cephfs         openshift-storage.cephfs.csi.ceph.com            Delete          Immediate              true                   3y354d


ocs-storagecluster-ceph-rgw       openshift-storage.ceph.rook.io/bucket            Delete          Immediate              false                  3y354d


openshift-storage.noobaa.io       openshift-storage.noobaa.io/obc                  Delete          Immediate              false                  3y354d


local-volume                      kubernetes.io/no-provisioner                     Delete          WaitForFirstConsumer   false                  3y354d


 


Creating docker-registry secret for Entitlement Registry key in project bronze...


secret/ibm-entitlement-key created


Done


 


[INFO] Applying the latest IBM CP4BA Operator catalog source...


 


[✔] IBM CP4BA Operator catalog source Updated!


 


[INFO] Starting to install IBM Cert Manager and IBM Licensing Operator ...


 


[✔] ibm-licensing-catalog/ibm-cert-manager-catalog pod ready!


All arguments passed into the setup_singleton.sh: --enable-licensing --license-accept --enable-private-catalog --yq ./cert-kubernetes/scripts/cpfs/yq/amd64/yq -c v4.2


[✔] oc command available


[✔] ./cert-kubernetes/scripts/cpfs/yq/amd64/yq command available


[✔] oc command logged in as ocadmin


[✔] Channel v4.2 is valid


[INFO] No ibm-common-service-operator found on the cluster, skipping delegation check


[✗] Flag --enable-private-catalog is enabled, please make sure the CatalogSource is deployed in the same namespace as operator


 


# Check migrating LTSR ibm-licensing-operator


[INFO] There is no LTSR ibm-licensing-operator to migrate, skipping


# Check migrating and deactivating LTSR ibm-cert-manager-operator


[INFO] LTSR ibm-cert-manager-operator already deactivated, skipping


# Installing cert-manager


 


[✗] There is a cert-manager Subscription already


 


[✗] There is a cert-manager-webhook pod Running, so most likely another cert-manager is already installed


 


[INFO] Continue to upgrade check


 


[✗] Cluster has a RedHat cert-manager or Helm cert-manager, skipping


# Validate CatalogSource for operator ibm-licensing-operator-app in ibm-licensing namespace


[✔] CatalogSource ibm-licensing-catalog from ibm-licensing CatalogSourceNamespace is available for ibm-licensing-operator-app in ibm-licensing namespace


# Installing licensing


 


[✗] There is an ibm-licensing-operator-app Subscription already, so will upgrade it


 


# Checking whether Namespace ibm-licensing exist...


[✔] Namespace ibm-licensing already exists. Skip creating


 


# Checking whether OperatorGroup in ibm-licensing exist...


[✔] OperatorGroup already exists in ibm-licensing. Skip creating


 


# Updating ibm-licensing-operator-app in namesapce ibm-licensing...


[INFO] v4.2 is equal to v4.2


[INFO] catalogsource ibm-licensing-catalog is the same as ibm-licensing-catalog


[INFO] ibm-licensing-operator-app has already updated channel v4.2 and catalogsource ibm-licensing-catalog in the subscription.


subscription.operators.coreos.com/ibm-licensing-operator-app configured


[✔] Successfully patched subscription ibm-licensing-operator-app in ibm-licensing


[INFO] Waiting for operator ibm-licensing-operator-app to be upgraded


[✔] Operator ibm-licensing-operator-app is upgraded to latest version in channel v4.2


 


[INFO] Waiting for operator ibm-licensing-operator-app CSV in namespace ibm-licensing to be bound to Subscription


[✔] Operator ibm-licensing-operator-app CSV in namespace ibm-licensing is bound to Subscription


 


[INFO] Waiting for operator ibm-licensing-operator in namespace ibm-licensing to be made available


[✔] Operator ibm-licensing-operator in namespace ibm-licensing is available


 


[INFO] Waiting for ibmlicensing instance to be present.


[✔] ibmlicensing instance present


 


# Accepting license for ibmlicensing instance in namespace ...


[✔] License accepted for ibmlicensing instance


 


[INFO] Checking cert manager readiness.


[INFO] Waiting for pod cert-manager-webhook to be running ...


[✔] Pod cert-manager-webhook is running.


 


#  Smoke test for Cert Manager existence...


[INFO] Creating following issuer:


 


apiVersion: cert-manager.io/v1


kind: Issuer


metadata:


  name: test-issuer


  namespace: cert-manager


spec:


  selfSigned: {}


 


issuer.cert-manager.io/test-issuer created


[INFO] Creating following certificate:


 


apiVersion: cert-manager.io/v1


kind: Certificate


metadata:


  name: test-certificate


  namespace: cert-manager


spec:


  commonName: test-certificate


  issuerRef:


    kind: Issuer


    name: test-issuer


  secretName: test-certificate-secret


 


certificate.cert-manager.io/test-certificate created


[INFO] Waiting for Issuer test-issuer in namespace cert-manager to be Ready


[✔] Issuer test-issuer in namespace cert-manager is Ready


 


[INFO] Waiting for Certificate test-certificate in namespace cert-manager to be Ready


[✔] Certificate test-certificate in namespace cert-manager is Ready


 


[INFO] Deleting test-issuer Issuer ...


issuer.cert-manager.io "test-issuer" deleted


 


[INFO] Deleting test-certificate Certificate ...


certificate.cert-manager.io "test-certificate" deleted


 


[INFO] Deleting test-certificate-secret Secret ...


secret "test-certificate-secret" deleted


 


[✔] Cert manager is ready.


 


[INFO] SETUP_SINGLETON_STATUS : 0


 


[INFO] setup_singleton.sh script executed successfully; hence there is a cert-manager present on the cluster


 


Waiting for the Cloud Pak for Business Automation operator to be ready. This might take a few minutes...


 


ibm-cp4a-operator-catalog         ibm-cp4a-operator                       grpc   IBM         3m15s


Found existing ibm operator catalog source, updating it


catalogsource.operators.coreos.com/ibm-cp4a-operator-catalog unchanged


catalogsource.operators.coreos.com/ibm-opencontent-flink unchanged


catalogsource.operators.coreos.com/ibm-opensearch-operator-catalog unchanged


catalogsource.operators.coreos.com/ibm-cert-manager-catalog unchanged


catalogsource.operators.coreos.com/ibm-licensing-catalog unchanged


catalogsource.operators.coreos.com/ibm-cs-install-catalog-v4-19-0 unchanged


catalogsource.operators.coreos.com/ibm-bts-operator-catalog-v3-35 unchanged


catalogsource.operators.coreos.com/ibm-iam-operator-catalog-4-18-0 unchanged


catalogsource.operators.coreos.com/ibm-zen-operator-catalog-6-10-0 unchanged


catalogsource.operators.coreos.com/ibm-events-operator-catalog-v5-2-1 unchanged


catalogsource.operators.coreos.com/ibm-pg-operator-catalog unchanged


catalogsource.operators.coreos.com/ibm-content-cortex-operator-catalog unchanged


catalogsource.operators.coreos.com/ibm-redis-cp-operator-catalog unchanged


catalogsource.operators.coreos.com/ibm-usage-metering-catalog unchanged


IBM Operator Catalog source updated!


 


[INFO] Waiting for CP4BA Operator Catalog pod initialization


 


[INFO] CP4BA Operator Catalog is running...


ibm-cp4a-operator-catalog-6kcdq


operatorgroup.operators.coreos.com/ibm-cp4a-operator-catalog-group created


CP4BA Operator Group Created!


subscription.operators.coreos.com/ibm-cp4a-operator-catalog-subscription created


CP4BA Operator Subscription Created!


 


[INFO] Waiting for CP4BA operator pod initialization


..............................


CP4BA operator is running...


ibm-cp4a-operator-6b67dd4f5-ptf2q


 


[INFO] Waiting for CP4BA Content operator pod initialization


..............................


CP4BA Content operator is running...


ibm-content-operator-57b5664877-k5vs9


 


Adding the user ocadmin to the ibm-cp4a-operator role...Done!


 


Label the default namespace to allow network policies to open traffic to the ingress controller using a namespaceSelector...namespace/default labeled


Done


 


Storage classes are needed to run the deployment script. For the Starter deployment scenario, you may use one (1) storage class. For a Production deployment, the deployment script will ask for three (3) storage classes to meet the slow, medium, and fast storage for the configuration of CP4BA components. If you don't have three (3) storage classes, you can use the same one for slow, medium, or fast. Note that you can get the existing storage class(es) in the environment by running the following command: oc get storageclass. Take note of the storage classes that you want to use for deployment.


NAME                            PROVISIONER                         RECLAIMPOLICY   VOLUMEBINDINGMODE   ALLOWVOLUMEEXPANSION   AGE 

<my-storage> (default)   redhat-emea-ssa-team/hetzner-ocp4   Delete          Immediate           false                  119m
Cluster preparation completed
At this stage, you have a cluster and a project namespace bronze ready for your ODM deployment with all operators up and running.
image

OCP administration console view of the installed operators in namespace bronze (fig. 2)

2.2 Following the installation guide for CP4BA 26.0.0 ODM

The next stage is fully explained in the installation PDF guide: CP4BA single-pattern production deployment on ROKS classic and OCP by following installation guides in PDF.

It helps you to architecture, execute and validate an ODM Bronze topology deployment. The following topics provide you with an overview of the instructions to prepare and install the deployment.

Topic Awaited action and results
Preparing databases and secrets for your chosen capabilities by running a script This is an action.
Use the cert-kubernetes/scripts/cp4a-prerequisites.sh script to:

[Run script] Create the property files (DB/LDAP/user)

./cp4a-prerequisites.sh -m property -n bronze

[Manual Action] Modify the property files by replacing <Required> values in the property files under <my_path>/cert-kubernetes/scripts/cp4ba-prerequisites/project/bronze/propertyfile.

[Run script] If you chose an external DB, generate the DB SQL statement file, and the YAML template for the secrets of your chosen capability (ODM).

./cp4a-prerequisites.sh -m generate -n bronze

[Manual Action][Optional] If you chose an external DB, run the DB scripts against your database servers.

[Manual Action] Create the secrets in your project namespace.

./cp4ba-prerequisites/project/bronze/create_secret.sh

[Run script] Validate your storage, optional DB / LDAP connections, and secrets.

./cp4a-prerequisites.sh -m validate -n bronze
Preparing to install Operational Decision Manager This is a decision to be made.
For a Bronze installation, we recommend to include all ODM components in the same project namespace.
Creating a production deployment This is an action.
You follow the instructions to generate an ODM Bronze topology CR YAML file by running the deployment script: 
cd cert-kubernetes/scripts
./cp4a-deployment.sh -n bronze
A custom resource file is created: <my_path>/cert-kubernetes/scripts/generated-cr/project/bronze/ibm_cp4a_cr_final.yaml.

In the generated CR YAML file, check the custom resource parameter values which have been filled in for you by the script:

  • Check the data source.
  • Check the LDAP configuration.
  • Check the ODM configuration.

Some modifications can be done to the generated CR YAML file. Use the following table to help you identify the customizable parameters.

Action Parameter New value
Replace metadata.name Add a meaningful name which will is the name of your ICP4Cluster instance, e.g. bronze.
Delete spec.shared_configuration.sc_iam.default_admin_username  
Delete spec.shared_configuration.sc_drivers_url  

Having modified the custom resource parameters, proceed with the deployment as explained in “Deploying the custom resource you created with the deployment script”. At this stage, the ICP4Cluster instance that you named bronze is created. After a couple of reconcile loops of the CP4BA operator, you can verify the deployment.

Foundation tuning

Some basic tuning can be done on the foundation layer to maximize ODM capabilities. Follow the instruction below.

Update the IBM Cloud Platform UI (Zen) scale
oc patch zenservice iaf-zen-cpdservice --type=json -p '[{ "op": "replace", "path": "/spec/scaleConfig", "value": "<size>" }]'

It is recommended that you set the IBM Cloud Platform UI (Zen) service to the same size as Cloud Pak for Business Automation. The possible values are small, medium, and large.

Update IBM Common Services
oc patch CommonService common-service -n $NAMESPACE --type=json -p '[{ "op": "replace", "path": "/spec/size", "value": "small" }]'

It is recommended that you set the IBM Common Services to small as it has no impacts on ODM capabilities.

3. Validation

To ensure that the environment works correctly at CP4BA level, follow the steps in Validating your production deployment. Additional validations can be done at ODM level using Validate your ODM topology - 26.0.0. To review the installed ODM services and also install Rule Designer, see Completing post-installation tasks for Operational Decision Manager.

Expected result
The ODM Bronze topology is deployed in the bronze namespace, the expected ODM services are available, and the environment is ready for ODM-level validation.

4. Sample ODM Bronze topology CR

Lastly, here is a sample of CR YAML file allowing an ODM Bronze topology with EDB PostGres internal database and Active Directory LDAP:

apiVersion: icp4a.ibm.com/v1 

kind: ICP4ACluster 

metadata: 

  name: bronze 

  labels: 

    app.kubernetes.io/instance: ibm-dba 

    app.kubernetes.io/managed-by: ibm-dba 

    app.kubernetes.io/name: ibm-dba 

    release: 26.0.0 

  namespace: bronze 

spec: 

  appVersion: 26.0.0 

  ibm_license: accept 

  shared_configuration: 

    sc_deployment_license: "production" 

    sc_deployment_context: "CP4A" 

    sc_image_repository: cp.icr.io 

    root_ca_secret: icp4a-root-ca 

    sc_deployment_patterns: "foundation,decisions" 

    sc_optional_components: "decisionCenter,decisionRunner,decisionServerRuntime" 

    sc_deployment_type: "Production" 

    sc_deployment_platform: "OCP" 

    sc_deployment_profile_size: "small" 

    sc_ingress_enable: false 

    trusted_certificate_list: [] 

    storage_configuration: 

      sc_slow_file_storage_classname: "<my-storage>" 

      sc_medium_file_storage_classname: "<my-storage>" 

      sc_fast_file_storage_classname: "<my-storage>" 

      sc_block_storage_classname: "<my-storage>" 

    enable_fips: false 

    sc_is_multiple_az: false 

    sc_egress_configuration: 

      sc_restricted_internet_access: false 

    image_pull_secrets: 

    - ibm-entitlement-key     

  ## The beginning section of LDAP configuration for CP4A 

  ldap_configuration: 

    lc_selected_ldap_type: Microsoft Active Directory 

    lc_ldap_server: ***** 

    lc_ldap_port: '***' 

    lc_bind_secret: topology-ad-ldap-bind-secret 

    lc_ldap_base_dn: ***** 

    lc_ldap_ssl_enabled: true 

    lc_ldap_ssl_secret_name: topology-ad-ldap-ssl-cert 

    lc_ldap_user_name_attribute: ***** 

    lc_ldap_user_display_name_attr: cn 

    lc_ldap_group_base_dn: ***** 

    lc_ldap_group_name_attribute: *:cn 

    lc_ldap_group_display_name_attr: cn 

    lc_ldap_group_membership_search_filter: ***** 

    lc_ldap_group_member_id_map: ***** 

    ad: 

      lc_ad_gc_host: ***** 

      lc_ad_gc_port: '***' 

    tds: 

      lc_user_filter: "(&(cn=%v)(objectclass=person))" 

      lc_group_filter: "(&(cn=%v)(|(objectclass=groupofnames)(objectclass=groupofuniquenames)(objectclass=groupofurls)))" 

## The beginning section of database configuration for CP4A 

  datasource_configuration: 

    dc_ssl_enabled: false 

    dc_icn_datasource: 

      dc_use_postgres: true 

      dc_database_type: postgresql 

      dc_common_icn_datasource_name: "ECMClientDS" 

      database_servername: "postgres-cp4ba-rw.{{ meta.namespace }}.svc" 

      database_port: "5432" 

      database_name: icndb 

      database_ssl_secret_name: "{{ meta.name }}-pg-client-cert-secret" 

      dc_oracle_icn_jdbc_url: "" 

      dc_hadr_validation_timeout: 15 

      dc_hadr_standby_servername: "" 

      dc_hadr_standby_port: "" 

      dc_hadr_retry_interval_for_client_reroute: 15 

      dc_hadr_max_retries_for_client_reroute: 3 

    dc_odm_datasource: 

      dc_database_type: postgresql 

      database_servername: "postgres-cp4ba-rw.{{ meta.namespace }}.svc" 

      dc_common_database_port: "5432" 

      dc_common_database_name: "odmdb" 

      dc_common_database_instance_secret: "ibm-odm-db-secret" 

      dc_common_ssl_enabled: false 

      dc_ssl_secret_name: "" 

      dc_use_postgres: true 

      ######################################################################## 

      ########      IBM Operational Decision Manager configuration    ######## 

      ######################################################################## 

  odm_configuration: 

    decisionCenter: 

      enabled: true 

    decisionServerRuntime: 

      enabled: true 

    decisionRunner: 

      enabled: true

ODM Bronze topology installation completed

You can now proceed with the ODM topology validation, post-installation activities, and functional testing.

#OperationalDecisionManager #topology #businessrules #CloudPakforBusinessAutomation

0 comments
13 views

Permalink

https://community.ibm.com/community/user/blogs/said-moutaa/2026/08/04/how-do-i-install-odm-bronze-topology-with-cp4ba-26