Hi everyone, I have installed IBM Cloud Pak for Multicloud Management with the Monitoring Module(ICAM), everything is installed ok, but when I try to see the resources affected by an incident I show this error on the resource page:

"Error:

------------------------------
Fabian Andres Burgos Rojas

BPS
IBM Partner
------------------------------

This can be normal if you are using admin user. You should use a user belonging to the account you create during the installation process.
The idea is to use "admin" user just for installing the software and then create an account, import users from LDAP, create a team and then assign those users to the team with the appropriate roles.
When you log in using any of these users you will be able to see the resources normally.

------------------------------
Javier Llorente
Technical Sales
IBM
Madrid
------------------------------

Hi Javier, thank you in advance.

I installed openldap on the same cluster where ICP for Multicloud is installed(Openshift on AWS) and create two users. I tried to onboarding the two users following this indications(https://www.ibm.com/support/knowledgecenter/en/SSFC4F_1.3.0/icam/install_mcm_ldap.html)  and I got the same error. 

I have reinstalled the solution and I will go to install openldad and I will check if I got the same error.

Are there a way that the admin user of ICP4MCM can view the resources from Monitoring Module or always have I to onboard the users from a ldap?

thank you


------------------------------
Fabian Andres Burgos Rojas
------------------------------

Original Message:
Sent: Tue June 23, 2020 03:05 AM
From: Javier Llorente
Subject: Monitoring Module NO show Resources

This can be normal if you are using admin user. You should use a user belonging to the account you create during the installation process.
The idea is to use "admin" user just for installing the software and then create an account, import users from LDAP, create a team and then assign those users to the team with the appropriate roles.
When you log in using any of these users you will be able to see the resources normally.

------------------------------
Javier Llorente
Technical Sales
IBM
Madrid
------------------------------

Let's review the steps for user configuration:

1. A LDAP configuration is created (both using command line or web interface). Once this is created, we can get the connection ID with (values are just an example):
   

   cloudctl iam ldaps
   ID                                     Name       Server Type   Base DN                 URL   
   8737b370-4be5-11ea-b383-030b6c3f60ef   ldapserver Custom        dc=xxxx,dc=yyy,dc=com   ldap://ldapserver.xxxx.yyy.com:389

2. Users are imported from the LDAP server:
   

   cloudctl iam user-import -c 8737b370-4be5-11ea-b383-030b6c3f60ef -u "*"
   Found 5 user(s). Do you want to import them? [y/N]> y
   User tuser1 imported
   User tuser2 imported
   User tuser3 imported
   User tuser4 imported​

3. An account (or tenant) is created with its corresponding admin user (not required to be one of those imported from LDAP server):
   

   cloudctl iam account-create icamadmin -d "ICAM administrator"
                    
   Name          icamadmin   
   Description   ICAM administrator   
   ID            8ff5-a49a   ​

4. We assign roles to any of LDAP users in this new account:
   

   cloudctl iam user-onboard 8ff5-a49a -r PRIMARY_OWNER -u tuser1
   OK

5. We can review the teams created automatically with this:
   

   cloudctl iam teams
   ID                                                                 Name                                                                       Groups   Users 
   82f1cb138c590140a689b60b7711b3165e280a41ca8486f2c241362b21355b5d   82f1cb138c590140a689b60b7711b3165e280a41ca8486f2c241362b21355b5d-default   0        1
   e14d44bb4d07a52bb4fad018b92295ced0992af31b53e7cc7a6d41dabd1a6586   e14d44bb4d07a52bb4fad018b92295ced0992af31b53e7cc7a6d41dabd1a6586-default   0        0

6. Now we get the correct specification of, for example, kube-system namespace using this command:
   

   cloudctl iam resources | grep kube-system 
   crn:v1:icp:private:k8:mycluster:n/kube-system:::​

7. With the last two pieces of information, we can now assign permissions to the first team (having 1 user) to kube-system namespace:
   

   cloudctl iam resource-add 82f1cb138c590140a689b60b7711b3165e280a41ca8486f2c241362b21355b5d -r crn:v1:icp:private:k8:mycluster:n/kube-system:::
   Resource crn:v1:icp:private:k8:mycluster:n/kube-system::: added
   OK​

8. Now we can log in using the admin user who now has permissions to kube-system namespace:
   

   cloudctl login -a https://icp-console.xxxx.yyy.com -n kube-system -u tuser1 -p xxxxxx​

9. With this user, we now create a new team:
   

   cloudctl iam team-create team1
   OK​

10. This user is now the "Account administrator". We can now assign roles to other users:
    

    cloudctl iam team-add-users team1 Administrator -u tuser2
    OK
    
    cloudctl iam team-add-users team1 Operator -u tuser3,tuser4
    OK​

11. This is what we have so far:
    

    cloudctl iam teams
    ID      Name    Groups   Users   
    team1   team1   0        4   
    
    cloudctl iam team-get team1
    Name: team1
    ID: team1
    
    ID           Type   Name         Email   Roles   
    tuser1       user   tuser1      -       AccountAdministrator   
    tuser2       user   tuser2      -       Administrator   
    tuser3       user   tuser3      -       Operator   
    tuser4       user   tuser4      -       Operator  ​

12. Now we can log into the web console using any administrator user (for example tuser1) and open the monitoring interface (using "Monitor health" - "Infrastructure monitoring" for example). It is important to check that "Account" field, on the upper right corner, is the one we created earlier (8ff5-a49a in my example)
13. Now, using "Administration" - "Integrations" we create the corresponding integration documents that will be used for configuring agents to be connected to this account.
    This is very important. If we use a configuration from a previous account to install agents, we will never see those agents on our resource list as they belong to a different account.
    I guess this is the main problem you may be experimenting.
    Everytime the account id changes, we need to create the integration documents and use those new configuration packages for agent installation.

I hope this can help a bit.

------------------------------
Javier Llorente
Technical Sales
IBM
Madrid
------------------------------

Original Message:
Sent: Tue June 23, 2020 03:43 PM
From: Fabian Andres Burgos Rojas
Subject: Monitoring Module NO show Resources

Hi Javier, thank you in advance.

I installed openldap on the same cluster where ICP for Multicloud is installed(Openshift on AWS) and create two users. I tried to onboarding the two users following this indications(https://www.ibm.com/support/knowledgecenter/en/SSFC4F_1.3.0/icam/install_mcm_ldap.html)  and I got the same error. 

I have reinstalled the solution and I will go to install openldad and I will check if I got the same error.

Are there a way that the admin user of ICP4MCM can view the resources from Monitoring Module or always have I to onboard the users from a ldap?

thank you


------------------------------
Fabian Andres Burgos Rojas
------------------------------


Original Message:
Sent: Tue June 23, 2020 03:05 AM
From: Javier Llorente
Subject: Monitoring Module NO show Resources

This can be normal if you are using admin user. You should use a user belonging to the account you create during the installation process.
The idea is to use "admin" user just for installing the software and then create an account, import users from LDAP, create a team and then assign those users to the team with the appropriate roles.
When you log in using any of these users you will be able to see the resources normally.

------------------------------
Javier Llorente
Technical Sales
IBM
Madrid