Shared configuration

You must set the parameters in the custom resource file to access the Docker images in your environment.

The following tables list the configurable parameters. The parameters are either mandatory <Required> or optional in a custom resource file. If a parameter is absent or has no value, it means that the operator refers to the default value. You can overwrite the default value by entering a new value in your custom resource. Parameters that are mandatory must always be present and you must enter a valid value.

Table 1. Spec configuration parameters
Parameter Description Example value Required
appVersion The version of the current release. 23.0.2 Yes
ibm_license Must exist to accept the IBM license. The only valid value is "accept". accept Yes
Table 2. Shared configuration parameters
Parameter Description Default/Example value Required
enable_fips Enable/disable FIPS mode for the deployment. false No
encryption_key_secret The name of the shared encryption key secret. The secret is used to store a password that is used to encrypt various encryption keys generated by the product. The secret is generated if it does not exist. The encryption_key_secret parameter is shared by IBM Business Automation Workflow, IBM Business Automation Studio, Application Engine, and IBM Process Federation Server.

If your installation includes Business Automation Studio and Application Engine and you want to compress and export an application project to Business Automation Studio or import an application project in Application Engine, you can specify the encryption key (aeEncryptionKey) and the encryption salt value (aeEncryptionSalt) of this secret. These values are used to encrypt sensitive information of the exported file. This is an optional step.

 ibm-iaws-shared-key-secret No
external_tls_certificate_secret This parameter is used to replace the TLS certificates for all routes managed by the CP4BA operator. The certificate can use a wildcard SAN or multiple hostname SANs that can work for all of the routes. If defined, the certificate is used for all external routes. If it is not defined, certificates for all external routes are signed with the certificate in the root_ca_secret parameter. my-ext-tls-secret No
image_pull_secrets Shared image pull secrets. [] Not present
images.dbcompatibility_init_container.repository Image name for database compatibility init container. dba-dbcompatibility-initcontainer No
images.dbcompatibility_init_container.tag Image tag for database compatibility init container.

23.0.2

 No
images.keytool_job_container.repository Image name for Transport Layer Security (TLS) job container. dba-keytool-jobcontainer No
images.keytool_job_container.tag Image tag for TLS job container

23.0.2

 No
images.keytool_init_container.repository Image name for TLS init container. dba-keytool-initcontainer No
images.keytool_init_container.tag Image tag for TLS init container.

23.0.2

 No
images.pull_policy Pull policy for all containers. IfNotPresent No
images.umsregistration_initjob.repository Image name for OpenID Connect (OIDC) registration job container. dba-umsregistration-initjob No
images.umsregistration_initjob.tag Image tag for OIDC registration job container.

23.0.2

 No
root_ca_secret Root certificate authority (CA) secret name to store the root CA TLS key and certificate. The default value when it is not set, is icp4a-root-ca. If the secret does not exist, it is created and a self-signed root CA certificate is generated. To assign an existing secret, it must be a TLS secret with the CA certificates. For more information, see TLS Secrets. icp4a-root-ca No
sc_cpe_limited_storage When set to "true", the Content Platform Engine (CPE) component is deployed for Automation Document Processing capability as non-chargeable. true, false (default is false) No
sc_deployment_baw_license Use only when you want to install a deployment license for Business Automation Workflow. The only valid values are user, non-production, and production. If no value is set and the parameter is used, then the default is production. production

No

Yes, if you want to install Business Automation Workflow.
sc_deployment_fncm_license Use only when you want to install a deployment with a license for FileNet Content Manager. The only valid values are user, non-production, and production. If no value is set and the parameter is used, then the default is production. production

No

Yes, if you want to install FileNet Content Manager.
sc_deployment_hostname_suffix If you do not want to use a generated routing subdomain, you can customize the suffix that is used as the routing subdomain to create your routes.
If sc_deployment_platform is set to "OCP" or "ROKS", routes are created automatically. The routes are generated in the form:
<route-name>[-<namespace>].<hostname_suffix>
If you customize the hostname, you must ensure that the hostname suffix is the same as the default OpenShift router canonical hostname, otherwise you might get an error when you use Business Automation Studio.		 None No
sc_deployment_license Valid values are non-production and production. production Yes
sc_deployment_patterns The patterns or capabilities to be deployed. Names of the patterns are separated by a comma. foundation Yes
sc_deployment_platform Valid options are "OCP" and "ROKS".
  • Use "OCP" for Red Hat OpenShift Container Platform.
  • Use "ROKS" if the platform is Red Hat OpenShift on IBM Cloud®.
 OCP Yes
sc_deployment_profile_size For a starter deployment type, the starter profile must be used.

For a production deployment type, the default is small. You can change the profile to medium or large, as required. For more information, see System requirements.

 small No
sc_deployment_type Digital Business Automation can be installed for evaluation or production purposes.

Set the value to starter for an evaluation deployment, and production for all other deployment types.

Note: If you set the value to "starter", Db2® Universal Container and OpenLDAP instances are created as part of the installation. If the value is set to "starter", you must also set the sc_dynamic_storage_classname parameter.
 None Yes
sc_drivers_url

Necessary if you want to use your own JDBC drivers and/or need to provide ICCSAP drivers. If you are providing multiple JDBC drivers and ICCSAP drivers, all the files must be compressed in a single file.

You must put the compressed file on an accessible web server and enter the URL as the value. For example, http://hostname:8888/jdbc.zip.

 None No
sc_egress_configuration
  • sc_restricted_internet_access
  • sc_api_namespace
  • sc_api_port
  • sc_dns_namespace
  • sc_dns_port

To enable or disable egress access to external systems. The default is to restrict access to external systems.

Set the value of sc_restricted_internet_access to false to provide all CP4BA pods access to external systems. You can customize your network policy or use specific policies with 'matchLabels' to set exceptions. For more information, see Configuring cluster security.

If set to false, all the CP4A pods have unrestricted network access to external systems.

Important: When the value of sc_restricted_internet_access is set to true, none of the CP4BA capabilities (excluding Operational Decision Manager) can access external systems other than the known addresses for databases, LDAPs, and federated systems. For more information, see Configuring cluster security.
  • The default for sc_restricted_internet_access is true, if not defined.
  • The default for sc_api_namespace is "openshift-kube-apiserver", "openshift-apiserver". Use a comma separated list of namespaces or "{}" can also be used as a value when you see "(\"dial tcp XXX.XX.X.X:443: i/o timeout\")" error in the operator log. It is equivalent to all namespaces (namespaceSelector:{}).
  • The default for sc_api_port is 443,6443.
  • The default for sc_dns_namespace is "openshift-dns". It can be a comma separated list of namespaces or "{}" can also be used as a value. It is equivalent to all namespaces (namespaceSelector:{}).
  • The default for sc_dns_port is 53,5353.
 No
sc_iam
  • default_admin_username
 The name of the admin user for the IBM Identity Management (IM) foundational service. cpadmin No
sc_image_repository By default the IBM Entitled Registry is used, and the value is set to "cp.icr.io". When a private image registry is used, the value for sc_image_repository must be set to the URL for that location. For example: myimageregistry.com/project_name. For an air gap installation, make sure that the parameter is set to the default value. cp.icr.io No
sc_image_tag A tag value that is applied to all container images.

Digests are used instead of the image tag, but it is useful to keep the tag up to date with the corresponding version. The list of digests that are used in each version can be found in the resources.yaml file under the ${CASE_LOCAL_PATH}/ibm-cp-automation/inventory/cp4aOperatorSdk directory of the CASE package. For more information, see Preparing a client to connect to the cluster.

 None No
sc_ingress_enable For ROKS, set this parameter to true to enable Ingress. The default value is false, which creates routes instead of Ingress. false

No

Yes on ROKS.
sc_ingress_tls_secret_name Must be set if you enable ingress on ROKS. This secret provides TLS for the ingress controller.

To get the secret when Ingress is enabled with TLS, run the following command.

ibmcloud oc cluster get --cluster <clusterID> | grep Ingress
None

No

Yes if ingress is enabled.
sc_install_automation_base By default the value is set to true. The default value installs Kafka and Elasticsearch for Business Automation Insights. If you want to use a pre-installed AutomationBase instance in the Cloud Pak, then set the value to false to prevent the Cloud Pak installing a new instance. You can also change the value after an installation if you want to customize the AutomationBase instance. Setting the value to false after the installation prevents the Cloud Pak operator from overriding the customized instance with the default configuration. true No
sc_optional_components The optional components to be installed. The optional components are:
  • ums
  • bas
  • bai
  • elasticsearch
  • kafka
 No
sc_run_as_user For Cloud Native Computing Foundation (CNCF) platforms such as Amazon Web Services (AWS), Google Kubernetes Engine (GKE), and so on, a value is required for this parameter. On OCP and ROKS, this parameter is not required. Specify the user to run the security context of the pod. The value is usually a number that corresponds to a user ID. None Yes if the deployment platform is set to other.
sc_seccomp_profile.type Specify the type of seccomp profile to be used by the pods. Possible values are: Unconfined, RuntimeDefault, Localhost. For more information about seccomp profile, see the Restrict a Container's Syscalls with seccomp.
Default value:
  • RuntimeDefault on OCP 4.11 and later.
  • Empty on OCP 4.10.

Example: Localhost

 No
sc_seccomp_profile.localhost_profile Specify the local path of the seccomp profile file. This parameter is required if sc_seccomp_profile.type is set to Localhost. The value of sc_seccomp_profile.localhost_profile is ignored if sc_seccomp_profile.type is set to anything other than Localhost. For more information, see Configuring seccomp profiles. Example: profiles/audit.json Only if sc_seccomp_profile.type is set to Localhost
sc_skip_ldap_config

Controls whether the operator configures the Content Platform Engine to use an LDAP directory configuration or a SCIM directory configuration to authorize users and groups.

Set to true (default) for the operator to configure a Content Platform Engine SCIM directory configuration to retrieve authorization information such as the groups to which a user belongs from IM.

Set to false for the operator to configure a Content Platform Engine LDAP directory configuration to retrieve authorization information such as the groups to which a user belongs from an LDAP server.

 true Yes, if false must be specified to retain a non-default configuration of the Content Platform Engine. Examples include upgrading from a previous deployment where an LDAP directory was configured to perform user and group authorization, or moving from a traditional deployment that utilized an LDAP directory to containerized.
storage_configuration
  • sc_slow_file_storage_classname
  • sc_medium_file_storage_classname
  • sc_fast_file_storage_classname
  • sc_block_storage_classname
 Three storage classes are needed for slow, medium, and fast storage. If one storage class is defined, then you can use that one storage class for all three parameters.

The set block storage class name is used for the PVCs that are created for MongoDB.

None Yes
trusted_certificate_list Trusted certificate secret names. Every component trusts these certificates for secure communication. Enter a comma-delimited list of the secret names in an array. For example, [secret_name1, secret_name2]. [] No