├── .gitmodules ├── .gitignore ├── suite-license-services ├── ibm-catalog.yaml ├── trust-manager-subscription.yaml ├── sls-operator-subscription.yaml ├── sls-custom-scc.yaml └── sls-deployment.yaml ├── sbo_setup.sh ├── cert-manager_setup.sh ├── util.sh ├── setup.sh ├── ibm-common-services_setup.sh ├── uds_setup.sh ├── local-path_setup.sh ├── get_setup_params.sh ├── mas_setup.sh ├── sls_setup.sh ├── README.md ├── mas-ws_setup.sh ├── mongodb_setup.sh └── LICENSE /.gitmodules: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.log 2 | work 3 | -------------------------------------------------------------------------------- /suite-license-services/ibm-catalog.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: operators.coreos.com/v1alpha1 2 | kind: CatalogSource 3 | metadata: 4 | name: ibm-operator-catalog 5 | namespace: openshift-marketplace 6 | spec: 7 | displayName: "IBM Operator Catalog" 8 | publisher: IBM 9 | sourceType: grpc 10 | image: docker.io/ibmcom/ibm-operator-catalog 11 | updateStrategy: 12 | registryPoll: 13 | interval: 45m 14 | -------------------------------------------------------------------------------- /suite-license-services/trust-manager-subscription.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: operators.coreos.com/v1alpha1 2 | kind: Subscription 3 | metadata: 4 | name: ibm-truststore-mgr-1.x-ibm-operator-catalog-openshift-marketplace 5 | namespace: ibm-sls 6 | spec: 7 | source: ibm-operator-catalog 8 | sourceNamespace: openshift-marketplace 9 | name: ibm-truststore-mgr 10 | channel: 1.x 11 | startingCSV: ibm-truststore-mgr.v1.0.0 12 | installPlanApproval: Automatic 13 | -------------------------------------------------------------------------------- /suite-license-services/sls-operator-subscription.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: operators.coreos.com/v1 2 | kind: OperatorGroup 3 | metadata: 4 | name: ibm-sls-group 5 | spec: 6 | targetNamespaces: 7 | - ibm-sls 8 | --- 9 | apiVersion: operators.coreos.com/v1alpha1 10 | kind: Subscription 11 | metadata: 12 | name: ibm-sls 13 | namespace: ibm-sls 14 | spec: 15 | channel: 3.x 16 | installPlanApproval: Automatic 17 | name: ibm-sls 18 | source: ibm-operator-catalog 19 | sourceNamespace: openshift-marketplace 20 | -------------------------------------------------------------------------------- /suite-license-services/sls-custom-scc.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: security.openshift.io/v1 2 | metadata: 3 | annotations: 4 | kubernetes.io/description: "This policy is the most restrictive for SLS, 5 | requiring pods to run with a non-root UID, and preventing pods from accessing the host. 6 | The UID and GID will be bound by ranges specified at the Namespace level." 7 | name: ibm-sls-custom-scc 8 | allowHostDirVolumePlugin: false 9 | allowHostIPC: false 10 | allowHostNetwork: false 11 | allowHostPID: false 12 | allowHostPorts: false 13 | allowPrivilegeEscalation: true 14 | allowPrivilegedContainer: false 15 | allowedCapabilities: null 16 | defaultAddCapabilities: null 17 | fsGroup: 18 | type: MustRunAs 19 | kind: SecurityContextConstraint 20 | priority: 0 21 | readOnlyRootFilesystem: false 22 | requiredDropCapabilities: 23 | - KILL 24 | - MKNOD 25 | - SETUID 26 | - SETGID 27 | runAsUser: 28 | type: MustRunAsRange 29 | seLinuxContext: 30 | type: MustRunAs 31 | supplementalGroups: 32 | type: RunAsAny 33 | users: [] 34 | volumes: 35 | - configMap 36 | - downwardAPI 37 | - emptyDir 38 | - persistentVolumeClaim 39 | - projected 40 | - secret 41 | -------------------------------------------------------------------------------- /suite-license-services/sls-deployment.yaml: -------------------------------------------------------------------------------- 1 | apiVersion: sls.ibm.com/v1 2 | kind: LicenseService 3 | metadata: 4 | name: sls 5 | namespace: ibm-sls 6 | labels: 7 | app.kubernetes.io/instance: ibm-sls 8 | app.kubernetes.io/managed-by: olm 9 | app.kubernetes.io/name: ibm-sls 10 | spec: 11 | license: 12 | accept: true 13 | domain: apps-crc.testing 14 | mongo: 15 | authMechanism: DEFAULT 16 | configDb: admin 17 | nodes: 18 | - host: mas-mongo-ce-0.mas-mongo-ce-svc.mongo.svc.cluster.local 19 | port: 27017 20 | - host: mas-mongo-ce-1.mas-mongo-ce-svc.mongo.svc.cluster.local 21 | port: 27017 22 | - host: mas-mongo-ce-2.mas-mongo-ce-svc.mongo.svc.cluster.local 23 | port: 27017 24 | secretName: sls-mongo-credentials 25 | certificates: 26 | - alias: mongodb 27 | crt: "${MONGO_CERT}" 28 | rlks: 29 | storage: 30 | class: local-path 31 | size: 5G 32 | settings: 33 | auth: 34 | enforce: true 35 | compliance: 36 | enforce: true 37 | reconciliation: 38 | enabled: true 39 | reconciliationPeriod: 1800 40 | registration: 41 | open: true 42 | reporting: 43 | maxDailyReports: 90 44 | maxHourlyReports: 24 45 | maxMonthlyReports: 12 46 | reportGenerationPeriod: 3600 47 | samplingPeriod: 900 48 | -------------------------------------------------------------------------------- /sbo_setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ## This Script installs sb operator for MAS. 4 | SCRIPT_DIR=$( 5 | cd $(dirname $0) 6 | pwd 7 | ) 8 | 9 | source "${SCRIPT_DIR}/util.sh" 10 | 11 | status=$(oc whoami 2>&1) 12 | if [[ $? -gt 0 ]]; then 13 | echo "Login to OpenShift to continue Service Binding Operator installation." 14 | exit 1 15 | fi 16 | 17 | echo "--- Install Service Binding Operator" 18 | oc project default 19 | cat <&1) 12 | if [[ $? -gt 0 ]]; then 13 | echo "Login to OpenShift to continue installation." 1>&2 14 | exit 1 15 | fi 16 | 17 | echo "--- Check IBM Common Services installed" 18 | if [[ ! $(oc get crd operandrequests.operator.ibm.com 2> /dev/null) ]]; then 19 | echo "IBM Common Services not found." 1>&2 20 | exit 1 21 | fi 22 | 23 | echo "--- Install Cert Manager" 24 | cat <&2 30 | exit 1 31 | fi 32 | done 33 | } 34 | 35 | function waitUntilAvailable() { 36 | cmd="$1" 37 | retryCount=600 38 | retries=0 39 | 40 | while [ -z "$(${cmd})" ]; do 41 | sleep 10 42 | retries=$((retries + 1)) 43 | if [[ $retries -eq $retryCount ]]; then 44 | echo "Timed out." 1>&2 45 | exit 1 46 | fi 47 | done 48 | } 49 | 50 | function approvePlan() { 51 | installplan=$(oc get installplan -n ${projectName} | grep -i ${operatorName} | awk '{print $1}' | head -n 1) 52 | 53 | if [[ "${installplan}" != "" ]]; then 54 | oc patch installplan ${installplan} -n ${projectName} --type merge --patch '{"spec":{"approved":true}}' 55 | fi 56 | } 57 | 58 | -------------------------------------------------------------------------------- /setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | # unattended full setup 4 | 5 | while getopts p OPT 6 | do 7 | case $OPT in 8 | "p" ) PROD="1" ;; 9 | esac 10 | done 11 | 12 | SCRIPT_DIR=$( 13 | cd $(dirname $0) 14 | pwd 15 | ) 16 | 17 | if [ -z "${ENTITLEMENT_KEY}" ]; then 18 | echo "Missing entitlement key in environemnt variable ENTITLEMENT_KEY." 19 | exit 1 20 | fi 21 | 22 | if [ -n "${PROD}" ]; then 23 | if [ -z "${SLS_STORAGE_CLASS}" ]; then 24 | echo "Missing SLS Storage Class environemnt variable SLS_STORAGE_CLASS." 25 | exit 1 26 | fi 27 | 28 | if [ -z "${SLS_DOMAIN_NAME}" ]; then 29 | echo "Missing SLS base domain name environemnt variable SLS_DOMAIN_NAME." 30 | exit 1 31 | fi 32 | 33 | if [ -z "${UDS_STORAGE_CLASS}" ]; then 34 | echo "Missing UDS Storage Class environemnt variable UDS_STORAGE_CLASS." 35 | exit 1 36 | fi 37 | 38 | if [ -z "${MONGODB_STORAGE_CLASS}" ]; then 39 | echo "Missing MongoDB Storage Class environemnt variable MONGODB_STORAGE_CLASS." 40 | exit 1 41 | fi 42 | 43 | if [ -z ${MAS_INSTANCE_ID} ]; then 44 | echo "Missing MAS Instance ID in environemnt variable MAS_INSTANCE_ID." 45 | exit 1 46 | fi 47 | 48 | if [ -z "${MAS_DOMAIN_NAME}" ]; then 49 | echo "Missing Maximo base domain name environemnt variable MAS_DOMAIN_NAME." 50 | exit 1 51 | fi 52 | 53 | if [ -z "${MONGODB_CPU_LIMIT}" ]; then 54 | export MONGODB_CPU_LIMIT="2" 55 | fi 56 | 57 | if [ -z "${MONGODB_MEM_LIMIT}" ]; then 58 | export MONGODB_MEM_LIMIT="2Gi" 59 | fi 60 | fi 61 | 62 | if [[ -d "${SCRIPT_DIR}/work" ]]; then 63 | rm -r ${SCRIPT_DIR}/work/* 64 | fi 65 | 66 | if [ -z "${PROD}" ]; then 67 | ${SCRIPT_DIR}/local-path_setup.sh || exit 1 68 | fi 69 | 70 | ${SCRIPT_DIR}/ibm-common-services_setup.sh || exit 1 71 | ${SCRIPT_DIR}/cert-manager_setup.sh || exit 1 72 | ${SCRIPT_DIR}/sbo_setup.sh || exit 1 73 | ${SCRIPT_DIR}/uds_setup.sh || exit 1 74 | ${SCRIPT_DIR}/mongodb_setup.sh || exit 1 75 | ${SCRIPT_DIR}/sls_setup.sh || exit 1 76 | ${SCRIPT_DIR}/mas_setup.sh || exit 1 77 | 78 | ${SCRIPT_DIR}/get_setup_params.sh 79 | -------------------------------------------------------------------------------- /ibm-common-services_setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ## This Script installs ibm cert manager operator 4 | 5 | SCRIPT_DIR=$( 6 | cd $(dirname $0) 7 | pwd 8 | ) 9 | 10 | source "${SCRIPT_DIR}/util.sh" 11 | 12 | status=$(oc whoami 2>&1) 13 | if [[ $? -gt 0 ]]; then 14 | echo "Login to OpenShift to continue cert manager installation." 1>&2 15 | exit 1 16 | fi 17 | 18 | echo "--- Install IBM Operator Catalog" 19 | cat <&1) 16 | if [[ $? -gt 0 ]]; then 17 | echo "Login to OpenShift to continue installation." 1>&2 18 | exit 1 19 | fi 20 | 21 | echo "--- Check IBM Common Services installed" 22 | if [[ ! $(oc get crd operandrequests.operator.ibm.com 2> /dev/null) ]]; then 23 | echo "IBM Common Services not found." 1>&2 24 | exit 1 25 | fi 26 | 27 | echo "--- Install User Data Services Operand opetator" 28 | cat <&1) 9 | if [[ $? -gt 0 ]]; then 10 | echo "Login to OpenShift to continue local-path installation." 11 | exit 1; 12 | fi 13 | 14 | echo "--- Create namespace for local-path-storage." 15 | projectName="local-path-storage" 16 | createProject 17 | 18 | echo "--- Create service account for local-path-storage" 19 | oc create serviceaccount local-path-provisioner-service-account -n "${projectName}" 20 | 21 | echo "--- Configure adm policy for local-path-storage" 22 | oc adm policy add-scc-to-user hostaccess -z local-path-provisioner-service-account -n "${projectName}" 23 | 24 | echo "--- Create service account for local-path-storage" 25 | cat <&1) 28 | if [[ $? -gt 0 ]]; then 29 | echo "Login to OpenShift to continue." 30 | exit 1 31 | fi 32 | 33 | echo "MongoDB Setup Parameters" 34 | echo "===========Hosts==============" 35 | oc get MongoDBCommunity -n ${MONGODB_NAMESPACE} -o 'jsonpath={..status.mongoUri}' | sed -e 's|mongodb\://||g' -e 's/,/\n/g' 36 | 37 | echo "" 38 | echo "===========MongoDB login account credentials==============" 39 | echo "Username: admin" 40 | MONGO_PASSWORD=$(oc get secret mas-mongo-ce-admin-password -n ${MONGODB_NAMESPACE} --output="jsonpath={.data.password}" | base64 -d) 41 | echo "Password: ${MONGO_PASSWORD}" 42 | 43 | echo "===========Certificates==============" 44 | oc get configmap mas-mongo-ce-cert-map -n ${MONGODB_NAMESPACE} -o jsonpath='{.data.ca\.crt}' 45 | echo "" 46 | 47 | echo "UDS Setup Parameters" 48 | echo "===========Endpoint URL==============" 49 | echo https://$(oc get routes uds-endpoint -n "${UDS_NAMESPACE}" |awk 'NR==2 {print $2}') 50 | 51 | echo "===========API KEY==============" 52 | oc get secret uds-api-key -n "${UDS_NAMESPACE}" --output="jsonpath={.data.apikey}" | base64 -d 53 | echo "" 54 | 55 | echo "===========Certificates==============" 56 | oc get secret router-certs-default -n "openshift-ingress" -o "jsonpath={.data.tls\.crt}" | base64 -d 57 | 58 | oc get secret -n ${SLS_NAMESPACE} sls-cert-client -o jsonpath='{.data.tls\.key}' | base64 -d -w 0 > ${WORK_DIR}/tls.key 59 | oc get secret -n ${SLS_NAMESPACE} sls-cert-client -o jsonpath='{.data.tls\.crt}' | base64 -d -w 0 > ${WORK_DIR}/tls.crt 60 | oc get secret -n ${SLS_NAMESPACE} sls-cert-client -o jsonpath='{.data.ca\.crt}' | base64 -d -w 0 > ${WORK_DIR}/ca.crt 61 | 62 | echo "SLS Setup Parameters" 63 | echo "" 64 | echo "===========SLS Endpoint URL==============" 65 | oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.url}' 66 | echo "" 67 | echo "===========Registration Key==============" 68 | oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.registrationKey}' 69 | echo "" 70 | echo "===========Certificates==============" 71 | oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.ca}' 72 | echo "" 73 | 74 | echo "===========Registration Info==============" 75 | function getSlsInfo() { 76 | curl -ks --cert ${WORK_DIR}/tls.crt --key ${WORK_DIR}/tls.key --cacert ${WORK_DIR}/tls.crt $(oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.url}')/api/entitlement/config | jq ${path} 77 | } 78 | path=".rlks.configuration" 79 | echo "Configuration: $(getSlsInfo)" 80 | path=".rlks.hosts[0].id" 81 | echo "Registration ID: $(getSlsInfo)" 82 | path=".rlks.hosts[0].hostname" 83 | echo "Hostname: $(getSlsInfo)" 84 | path=".rlks.hosts[0].port" 85 | echo "port: $(getSlsInfo)" 86 | 87 | rm -r ${WORK_DIR} 88 | 89 | echo "" 90 | echo "MAS Setup Parameters" 91 | echo "===========Initial Setup URL==============" 92 | echo https://$(oc get route -n mas-${MAS_INSTANCE_ID}-core ${MAS_INSTANCE_ID}-admin -o jsonpath='{.spec.host}')/initialsetup 93 | echo "===========Superuser Username==============" 94 | oc get secret ${MAS_INSTANCE_ID}-credentials-superuser -n mas-${MAS_INSTANCE_ID}-core -o jsonpath='{.data.username}' | base64 --decode && echo "" 95 | echo "===========Superuser Password==============" 96 | oc get secret ${MAS_INSTANCE_ID}-credentials-superuser -n mas-${MAS_INSTANCE_ID}-core -o jsonpath='{.data.password}' | base64 --decode && echo "" 97 | 98 | -------------------------------------------------------------------------------- /mas_setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ## This Script installs MAS core. 4 | SCRIPT_DIR=$( 5 | cd $(dirname $0) 6 | pwd 7 | ) 8 | 9 | source "${SCRIPT_DIR}/util.sh" 10 | 11 | if [ -z "${ENTITLEMENT_KEY}" ]; then 12 | echo "Missing entitlement key in environemnt variable ENTITLEMENT_KEY." 1>&2 13 | exit 1 14 | fi 15 | 16 | if [ -z "${MAS_INSTANCE_ID}" ]; then 17 | MAS_INSTANCE_ID="crc" 18 | fi 19 | 20 | if [ -z "${MAS_DOMAIN_NAME}" ]; then 21 | MAS_DOMAIN_NAME="mas.apps-crc.testing" 22 | fi 23 | 24 | if [ -z "${MAS_CHANNEL}" ]; then 25 | MAS_CHANNEL="8.7.x" 26 | fi 27 | 28 | #if [ -z "${MAS_UPGRADE_PLAN}" ]; then 29 | MAS_UPGRADE_PLAN="Automatic" 30 | #fi 31 | 32 | status=$(oc whoami 2>&1) 33 | if [[ $? -gt 0 ]]; then 34 | echo "Login to OpenShift to continue installation." 1>&2 35 | exit 1 36 | fi 37 | 38 | echo "--- Create the project" 39 | projectName="mas-${MAS_INSTANCE_ID}-core" 40 | createProject 41 | 42 | echo "--- Add IBM Entitlement Registry" 43 | oc -n ${projectName} create secret docker-registry ibm-entitlement \ 44 | --docker-server=cp.icr.io/cp \ 45 | --docker-username=cp \ 46 | --docker-password="${ENTITLEMENT_KEY}" 47 | 48 | echo "--- Install IBM Operator Catalog" 49 | cat <&2 13 | exit 1 14 | fi 15 | 16 | if [ -z "$MONGODB_NAMESPACE" ]; then 17 | MONGODB_NAMESPACE="mongodb" 18 | fi 19 | 20 | if [ -z "${MONGODB_REPLICAS}" ]; then 21 | MONGODB_REPLICAS="3" 22 | fi 23 | 24 | if [ -z "${SLS_STORAGE_CLASS}" ]; then 25 | SLS_STORAGE_CLASS=local-path 26 | fi 27 | 28 | if [ -z "${SLS_DOMAIN_NAME}" ]; then 29 | SLS_DOMAIN_NAME=apps-crc.testing 30 | fi 31 | 32 | status=$(oc whoami 2>&1) 33 | if [[ $? -gt 0 ]]; then 34 | echo "Login to OpenShift to continue SLS Operator installation." 1>&2 35 | exit 1 36 | fi 37 | 38 | echo "--- Install IBM Operator Catalog" 39 | oc project default 40 | oc apply -f "${SCRIPT_DIR}/suite-license-services/ibm-catalog.yaml" 41 | 42 | echo "--- Create namespace for IBM SLS" 43 | projectName="ibm-sls" 44 | createProject 45 | 46 | echo "--- Install IBM Suite License Service" 47 | oc apply -n "${projectName}" -f "${SCRIPT_DIR}/suite-license-services/sls-operator-subscription.yaml" 48 | 49 | echo "--- Verify IBM Suite License Service installation" 50 | operatorName="ibm-sls" 51 | cmd="oc get subscription -n ${projectName} ${operatorName} -o jsonpath={.status.currentCSV}" 52 | waitUntilAvailable "${cmd}" 53 | csv=$(${cmd}) 54 | 55 | cmd="oc get csv -n ${projectName} ${csv} -o jsonpath={.status.phase}" 56 | state="Succeeded" 57 | waitUntil "${cmd}" "${state}" 58 | 59 | echo "--- Add IBM Entitlement Registry" 60 | oc -n ${projectName} create secret docker-registry ibm-entitlement \ 61 | --docker-server=cp.icr.io/cp \ 62 | --docker-username=cp \ 63 | --docker-password="${ENTITLEMENT_KEY}" 64 | 65 | echo "--- Create Mongo DB credentials" 66 | MONGO_PASSWORD=$(oc get secret mas-mongo-ce-admin-password -n ${MONGODB_NAMESPACE} --output="jsonpath={.data.password}" | base64 -d) 67 | cat < # Get from https://myibm.ibm.com/products-services/containerlibrary 26 | $ ./setup.sh 27 | ``` 28 | 29 | The additional script, ```mas-ws_setup.sh```, enables to complete MAS workspace configuration except license file uploading to start deployment for MAS apps like Maximo Manage. To put your license file path to ```SLS_LICENSE_FILE```, all of the steps of Suite setup are completed without any manual interventions. 30 | 31 | ```shell 32 | $ export UDS_EMAIL= 33 | $ export UDS_LASTNAME= 34 | $ export UDS_FIRSTNAME= 35 | $ # export SLS_LICENSE_FILE= 36 | $ ./mas-ws_setup.sh 37 | ``` 38 | 39 | The required information to complete Suite setup can be obtained from the following command. 40 | 41 | ```shell 42 | $ ./get_setup_params.sh 43 | ``` 44 | 45 | For a small OCP enviroment, use ```-p``` option with required environment variables. 46 | 47 | ```shell 48 | $ export ENTITLEMENT_KEY= # Get from https://myibm.ibm.com/products-services/containerlibrary 49 | $ ./setup.sh -p 50 | ``` 51 | 52 | 53 | ## Environment varialbe list 54 | 55 | ``` 56 | ENTITLEMENT_KEY 57 | ``` 58 | 59 | A key for accessing IBM Container Registry. It can be obtained from here: https://myibm.ibm.com/products-services/containerlibrary 60 | 61 | ``` 62 | MAS_INSTANCE_ID (default: crc) 63 | ``` 64 | 65 | An instance ID for the deployment. https://www.ibm.com/docs/en/mas87/8.7.0?topic=installation-instance-requirements#instance_name 66 | 67 | ``` 68 | MAS_DOMAIN_NAME (default: mas.apps-crc.testing) 69 | ``` 70 | 71 | A base domain name for the deployment. https://www.ibm.com/docs/en/mas87/8.7.0?topic=installation-instance-requirements#dns 72 | 73 | ``` 74 | MAS_CHANNEL (default: 8.7.x) 75 | ``` 76 | 77 | A channel for the MAS subscription. This specifies which version to be used in the instance. 78 | 79 | ``` 80 | MAS_WORKSPACE_ID (default: dev) 81 | ``` 82 | 83 | A workspace ID for the instance. https://www.ibm.com/docs/en/mas87/8.7.0?topic=installation-instance-requirements#workspace 84 | 85 | ``` 86 | MAS_WORKSPACE_NAME (default: Maximo dev) 87 | ``` 88 | 89 | A description for the workspace ID. https://www.ibm.com/docs/en/mas87/8.7.0?topic=installation-instance-requirements#workspace 90 | 91 | 92 | ``` 93 | SLS_NAMESPACE (default: ibm-sls) 94 | ``` 95 | 96 | A namespace for Suite License Service. 97 | 98 | ``` 99 | SLS_STORAGE_CLASS (default: local-path) 100 | ``` 101 | 102 | A storage class (RWO) for persistent storage in the SLS operator. Use appropriate storage class provided by cloud provider or on-premise solutions in OCP env. 103 | 104 | ``` 105 | SLS_DOMAIN_NAME (default: apps-crc.testing) 106 | ``` 107 | 108 | A base domain name for SLS. 109 | 110 | ``` 111 | SLS_LICENSE_FILE 112 | ``` 113 | 114 | A license file path for uploading MAS AppPoints token license to SLS. 115 | 116 | ``` 117 | UDS_EMAIL 118 | ``` 119 | A contact email address to use for User Data Service communication. 120 | 121 | ``` 122 | UDS_LASTNAME 123 | ``` 124 | The given name of the owner of the provided contact email address. 125 | 126 | ``` 127 | UDS_FIRSTNAME 128 | ``` 129 | 130 | The surname of the owner of the provided contact email address. 131 | 132 | ``` 133 | UDS_STORAGE_CLASS (default: local-path) 134 | ``` 135 | 136 | A storage class (RWO) for persistent storage in the UDS operator. Use appropriate storage class provided by cloud provider or on-premise solutions in OCP env. 137 | 138 | ``` 139 | MONGODB_NAMESPACE (defualt: mongodb) 140 | ``` 141 | 142 | A namespace for the MongoDB operator. 143 | 144 | ``` 145 | MONGODB_REPLICAS (default: 3) 146 | ``` 147 | 148 | A number of instances for MongoDB service. 149 | 150 | ``` 151 | MONGODB_CPU_REQUEST (default: 100m) 152 | ``` 153 | 154 | A request parameter for CPU in the MongoDB instance. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits 155 | 156 | ``` 157 | MONGODB_MEM_REQUEST (default: 256Mi) 158 | ``` 159 | A request parameter for memory in the MongoDB instance. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits 160 | 161 | ``` 162 | MONGODB_CPU_LIMIT (default: 1) 163 | ``` 164 | 165 | A limit parameter for CPU in the MongoDB instance. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits 166 | 167 | ``` 168 | MONGODB_MEM_LIMIT (default: 1Gi) 169 | ``` 170 | 171 | A limit parameter for memory in the MongoDB instance. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits 172 | 173 | ``` 174 | MONGODB_STORAGE_SIZE (default: 20Gi) 175 | ``` 176 | 177 | The storage claim size of the provided storage class for the MongoDB instances. 178 | 179 | ``` 180 | MONGODB_STORAGE_LOG_SIZE (default: 2Gi) 181 | ``` 182 | 183 | The storage claim size of the provided storage class for the MongoDB logs. 184 | 185 | ``` 186 | MONGODB_STORAGE_CLASS (default: local-path) 187 | ``` 188 | 189 | Storage class (RWO) for persistent storage in the UDS operator. Use appropriate storage class provided by cloud provider or on-premise solutions in OCP env. 190 | 191 | ``` 192 | MONGODB_PASSWORD (default: auto-generated) 193 | ``` 194 | 195 | A MongoDB password to access the MongoDB servcies. This parameter is automatically generated when it specified in the environment variable. 196 | -------------------------------------------------------------------------------- /mas-ws_setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ## This Script installs MAS workspace. 4 | SCRIPT_DIR=$( 5 | cd $(dirname $0) 6 | pwd 7 | ) 8 | 9 | source "${SCRIPT_DIR}/util.sh" 10 | 11 | if [ -z "${UDS_EMAIL}" ]; then 12 | echo "Missing email address in environemnt variable UDS_EMAIL." 1>&2 13 | exit 1 14 | fi 15 | 16 | if [ -z "${UDS_LASTNAME}" ]; then 17 | echo "Missing last name in environemnt variable UDS_LASTNAME." 1>&2 18 | exit 1 19 | fi 20 | 21 | if [ -z "${UDS_FIRSTNAME}" ]; then 22 | echo "Missing first name in environemnt variable UDS_FIRSTNAME." 1>&2 23 | exit 1 24 | fi 25 | 26 | if [ -z "$UDS_NAMESPACE" ]; then 27 | UDS_NAMESPACE="ibm-common-services" 28 | fi 29 | 30 | if [ -z "$SLS_NAMESPACE" ]; then 31 | SLS_NAMESPACE="ibm-sls" 32 | fi 33 | 34 | if [ -z "${MAS_INSTANCE_ID}" ]; then 35 | MAS_INSTANCE_ID="crc" 36 | fi 37 | 38 | if [ -z "${MAS_WORKSPACE_ID}" ]; then 39 | MAS_WORKSPACE_ID="dev" 40 | fi 41 | 42 | if [ -z "${MAS_WORKSPACE_NAME}" ]; then 43 | MAS_WORKSPACE_NAME="Maximo dev" 44 | fi 45 | 46 | if [ -z "${MAS_DOMAIN_NAME}" ]; then 47 | MAS_DOMAIN_NAME="mas.apps-crc.testing" 48 | fi 49 | 50 | if [ -z "$MONGODB_NAMESPACE" ]; then 51 | MONGODB_NAMESPACE="mongodb" 52 | fi 53 | 54 | if [ -z "${MONGODB_REPLICAS}" ]; then 55 | MONGODB_REPLICAS=3 56 | fi 57 | 58 | status=$(oc whoami 2>&1) 59 | if [[ $? -gt 0 ]]; then 60 | echo "Login to OpenShift to continue installation." 1>&2 61 | exit 1 62 | fi 63 | 64 | echo "--- Set up the project" 65 | projectName="mas-${MAS_INSTANCE_ID}-core" 66 | createProject 67 | 68 | echo "--- Install MongoDB Config for MAS" 69 | MONGO_PASSWORD=$(oc get secret mas-mongo-ce-admin-password -n ${MONGODB_NAMESPACE} --output="jsonpath={.data.password}" | base64 -d) 70 | MONGO_CERT=$(oc get configmap mas-mongo-ce-cert-map -n ${MONGODB_NAMESPACE} -o jsonpath='{.data.ca\.crt}' | sed -E ':a;N;$!ba;s/\r{0,1}\n/\\n/g') 71 | MONGO_NODES="" 72 | for i in $(seq 0 $((${MONGODB_REPLICAS} - 1))); do 73 | MONGO_NODES="${MONGO_NODES}\n - host: mas-mongo-ce-${i}.mas-mongo-ce-svc.${MONGODB_NAMESPACE}.svc.cluster.local\n port: 27017\n" 74 | done 75 | MONGO_NODES=$(echo -ne "${MONGO_NODES}") 76 | 77 | cat <${WORK_DIR}/tls.key 224 | oc get secret -n ${SLS_NAMESPACE} sls-cert-client -o jsonpath='{.data.tls\.crt}' | base64 -d -w 0 >${WORK_DIR}/tls.crt 225 | oc get secret -n ${SLS_NAMESPACE} sls-cert-client -o jsonpath='{.data.ca\.crt}' | base64 -d -w 0 >${WORK_DIR}/ca.crt 226 | curl -ks --cert ${WORK_DIR}/tls.crt --key ${WORK_DIR}/tls.key --cacert ${WORK_DIR}/ca.crt -X PUT -F "file=@${SLS_LICENSE_FILE}" $(oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.url}')/api/entitlement/file 227 | curl -ks --cert ${WORK_DIR}/tls.crt --key ${WORK_DIR}/tls.key --cacert ${WORK_DIR}/ca.crt $(oc get configmap -n ${SLS_NAMESPACE} sls-suite-registration -o jsonpath='{.data.url}')/api/tokens | jq '.[0]' 228 | rm -r ${WORK_DIR} 229 | echo "" 230 | 231 | cmd="oc get suite.core.mas.ibm.com ${MAS_INSTANCE_ID} -n ${projectName} -o jsonpath={.status.conditions[?(@.type==\"SLSIntegrationReady\")].status}" 232 | state="True" 233 | waitUntil "${cmd}" "${state}" 234 | 235 | cmd="oc get suite.core.mas.ibm.com ${MAS_INSTANCE_ID} -n ${projectName} -o jsonpath={.status.conditions[?(@.type==\"Ready\")].status}" 236 | state="True" 237 | waitUntil "${cmd}" "${state}" 238 | else 239 | cmd="oc get suite.core.mas.ibm.com ${MAS_INSTANCE_ID} -n ${projectName} -o jsonpath={.status.conditions[?(@.type==\"SLSIntegrationReady\")].reason}" 240 | state="MissingLicenseFile" 241 | waitUntil "${cmd}" "${state}" 242 | echo "Put your license file to enable MAS workspece." 243 | fi 244 | 245 | echo "--- Wait UDS config completion" 246 | cmd="oc get suite.core.mas.ibm.com ${MAS_INSTANCE_ID} -n ${projectName} -o jsonpath={.status.conditions[?(@.type==\"BASIntegrationReady\")].status}" 247 | state="True" 248 | waitUntil "${cmd}" "${state}" 249 | 250 | echo "Done" 251 | -------------------------------------------------------------------------------- /mongodb_setup.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | ## This Script installs MongoDB Community operator 4 | ## Based on the blog https://www.mongodb.com/blog/post/run-secure-containerized-mongodb-deployments-using-the-mongo-db-community-kubernetes-oper?hmsr=joyk.com&utm_source=joyk.com&utm_medium=referral 5 | 6 | SCRIPT_DIR=$( 7 | cd $(dirname $0) 8 | pwd 9 | ) 10 | 11 | source "${SCRIPT_DIR}/util.sh" 12 | 13 | if [ -z "${MONGODB_NAMESPACE}" ]; then 14 | MONGODB_NAMESPACE="mongodb" 15 | fi 16 | 17 | if [ -z "${MONGODB_REPLICAS}" ]; then 18 | MONGODB_REPLICAS=3 19 | fi 20 | 21 | if [ -z "${MONGODB_CPU_REQUEST}" ]; then 22 | MONGODB_CPU_REQUEST="100m" 23 | fi 24 | 25 | if [ -z "${MONGODB_MEM_REQUEST}" ]; then 26 | MONGODB_MEM_REQUEST="256Mi" 27 | fi 28 | 29 | if [ -z "${MONGODB_CPU_LIMIT}" ]; then 30 | MONGODB_CPU_LIMIT="1" 31 | fi 32 | 33 | if [ -z "${MONGODB_MEM_LIMIT}" ]; then 34 | MONGODB_MEM_LIMIT="1Gi" 35 | fi 36 | 37 | if [ -z "${MONGODB_STORAGE_SIZE}" ]; then 38 | MONGODB_STORAGE_SIZE="20Gi" 39 | fi 40 | 41 | if [ -z "${MONGODB_STORAGE_LOG_SIZE}" ]; then 42 | MONGODB_STORAGE_LOG_SIZE="2Gi" 43 | fi 44 | 45 | if [ -z "${MONGODB_STORAGE_CLASS}" ]; then 46 | MONGODB_STORAGE_CLASS="local-path" 47 | fi 48 | 49 | if [ -z "${MONGODB_PASSWORD}" ]; then 50 | MONGODB_PASSWORD=$(openssl rand -base64 29 | tr -d "=+/" | cut -c1-25) 51 | fi 52 | 53 | if [ -z "${MONGODB_ALWAYS_GEN_PASSWORD}" ]; then 54 | MONGODB_ALWAYS_GEN_PASSWORD=0 55 | fi 56 | 57 | if [ -z "${MONGODB_ALWAYS_GEN_CERT}" ]; then 58 | MONGODB_ALWAYS_GEN_CERT=0 59 | fi 60 | 61 | status=$(oc whoami 2>&1) 62 | if [[ $? -gt 0 ]]; then 63 | echo "Login to OpenShift to continue installation." 1>&2 64 | exit 1 65 | fi 66 | 67 | echo "--- Create namespace for MongoDB" 68 | projectName=${MONGODB_NAMESPACE} 69 | createProject 70 | 71 | echo "--- Install MongoDB Community CRD" 72 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/crd/bases/mongodbcommunity.mongodb.com_mongodbcommunity.yaml 73 | 74 | echo "--- Install MongoDB Roles" 75 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/role.yaml 76 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/role_database.yaml 77 | 78 | echo "--- Install MongoDB RoleBinding" 79 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/role_binding.yaml 80 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/role_binding_database.yaml 81 | 82 | echo "--- Install MongoDB Service Account" 83 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/service_account.yaml 84 | oc apply -n ${MONGODB_NAMESPACE} -f https://raw.githubusercontent.com/mongodb/mongodb-kubernetes-operator/master/config/rbac/service_account_database.yaml 85 | 86 | echo "--- Install MongoDB Certificate" 87 | oldCert=$(oc get secret mas-mongo-ce-cert-secret -n ${MONGODB_NAMESPACE} --ignore-not-found) 88 | if [ ${MONGODB_ALWAYS_GEN_CERT} = 1 ] || [ -z "${oldCert}" ]; then 89 | WORK_DIR="${SCRIPT_DIR}/work" 90 | mkdir -p "${WORK_DIR}" 91 | openssl genrsa -out ${WORK_DIR}/ca.key 4096 92 | openssl req -new -x509 -days 3650 -key ${WORK_DIR}/ca.key -reqexts v3_req -extensions v3_ca -out ${WORK_DIR}/ca.crt -subj "/C=US/ST=NY/L=New York/O=AIAPPS/OU=MAS/CN=MAS" 93 | 94 | oc create secret tls ca-mas-mongodb-key-pair --cert=${WORK_DIR}/ca.crt --key=${WORK_DIR}/ca.key -n ${MONGODB_NAMESPACE} 95 | oc create configmap mas-mongo-ce-cert-map --from-file=ca.crt=${WORK_DIR}/ca.crt -n ${MONGODB_NAMESPACE} 96 | 97 | cat <