Installing the capabilities in the Red Hat OpenShift console

A ConfigMap is created in the namespace to provide the cluster-specific details to access the services and applications. Components that are successfully deployed have URLs in the ConfigMap. If any components failed, the URLs and credentials are not included. The ConfigMap name is prefixed with the deployment name (default is icp4adeploy). You can find the ConfigMap containing the routes information by clicking Workloads > ConfigMaps and then searching for the string "cp4ba-access-info".

The contents of the ConfigMap depends on the components that are included. Each component has one or more URLs, and if needed a username and password.

<component1> URL: <RouteUrlToAccessComponent1>
<component1> Credentials: <UserName>/<Password> (optional) 
<component2> URL: <RouteUrlToAccessComponent2>
<component2> Credentials: <UserName>/<Password> (optional) 

You can also click the YAML tab in the CP4BA deployment (icp4adeploy) to view the endpoints uri of the installed capabilities.

After you have the routes and admin user information, check whether you need to do the following tasks.

oc get route | grep "^cpd"

Three authentication types are displayed in the login page: Enterprise LDAP, Red Hat OpenShift authentication, and IBM provided credentials (admin only). Click Enterprise LDAP and enter the cp4admin user and the password in the cp4ba-access-info ConfigMap. The cp4admin user has access to Business Automation Studio features. You can get the details for the IBM-provided admin user by getting the contents of the platform-auth-idp-credentials secret.

oc -n <namespace> get secret platform-auth-idp-credentials -o jsonpath='{.data.admin_password}' | base64 -d

You must use the IBM provided credentials (admin only) option to log in with the internal admin user.

When logged in, you can add users to the Automation Developer role to enable users and user groups to access Business Automation Studio and work with business applications and business automations.

If you want to add more users, you need to log in with the Zen UI administrator. The kubeadmin user in the Red Hat OpenShift authentication and the IBM-provided admin user have the Zen UI administrator role. When logged in, you can add users to the Automation Developer role to enable users and user groups to access Business Automation Studio and work with business applications and business automations. For more information about adding users, see Completing post-deployment tasks for Business Automation Studio. For more information about the Automation Developer role, see Roles and permissions.

• To provide a user for Task Manager, the following LDAP users and groups are created by the deployment.
  • In the OCP console, select the project in which you deployed the Cloud Pak, and then click Workloads > Secrets > <deployment-name>-openldap-customldif > Data > Reveal Values.
  • User names: cp4admin, user1, user2, up to and including user10.
  • Group names: TaskAdmins, TaskUsers, and TaskAuditors.

  The cp4admin user is assigned to TaskAdmins. The LDAP users user1 - user5 are assigned to TaskUsers, and the users user6 - user10 are assigned to TaskAuditors.

• To modify an existing user's password:
  Note: Do not change the password of the cp4admin user after the Content Platform Engine (CPE) is initialized. Changing the password of the Domain admin user needs extra steps. For more information, see Update System User credentials.
  1. In the Red Hat OpenShift console, go to Workloads > Secrets, and select the icp4adeploy-openldap-customldif secret.
  2. Click Actions > Edit Secret.
  3. Change the password for a specified user and click Save.
  4. Go to Workloads > Pods, search for the openldap pod.
  5. In the overflow menu for the pod, click Delete Pod to restart it.
• To add a user:
  1. In the Red Hat OpenShift console, go to Workloads > Secrets, and select the icp4adeploy-openldap-customldif secret.
  2. Click Actions > Edit Secret.
  3. Copy and paste the attributes from an existing user, take out the unnecessary attributes, put the information for the new user, and click Save. The following example is for the user, newuser:

     dn: uid=newuser,dc=example,dc=org
     uid: newuser
     cn: newuser
     sn: newuser
     userPassword: <password>
     objectClass: top
     objectClass: posixAccount
     objectClass: organizationalPerson
     objectClass: inetOrgPerson
     objectClass: person
     uidNumber: 14583345
     gidNumber: 1456456
     homeDirectory: /home/newuser/
     mail: newuser@example.org 

     The uidNumber must be a unique and different number from the existing uidNumbers.

  4. Go to Workloads > Pods, search for the openldap pod.
  5. In the overflow menu for the pod, click Delete Pod to restart it.
  6. Sign in to the Common Web UI by following the steps in Accessing your cluster by using the console.
  7. Follow the steps in Managing console access to add the user to the Cloud Pak Platform UI (Zen).

1. Create a storage policy and associate the storage policy with the existing advanced storage area. See Storage policies for more information.
2. Assign the newly created storage policy to existing document class.

1. Click Actions > Edit ICP4ACluster, then click YAML to go into the YAML view.
2. Add the following parameter to the file:

   graphql:
         graphql_production_setting:
           enable_graph_iql: true

3. Apply the updated custom resource YAML file.

   In the next reconciliation loop, the operator picks up the change and includes GraphQL with your deployment.

1. Create a secret with your Kafka certificate, for example:

   oc create secret generic eventstreamsecret --from-file=tls.crt=eventstream.crt

2. Find the generated YAML file in the directory where you ran the deployment script. For example, generated-cr/ibm_cp4a_cr_final.yaml.
3. Update the trusted_certificate_list parameter to include the secret that you created.

   shared_configuration:
         trusted_certificate_list: ['eventstreamsecret']

   If other certificates are in the list, use a comma to separate your new entry.

4. Apply the updated custom resource YAML file.

/ # ls -l /data/git/repositories/content-designer/

• If the output shows cdd.git, then the content-designer directory exists and the Git repository is created successfully.

  drwxr-xr-x 7 git git 147 May 5 15:58 cdd.git

• If the output does not show the CDD repository, go to the operator logs to understand why the deployment failed.