IBM Cloud Pak Foundational Services

https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd
Admin
IBM Cloud Pak foundational services provides essential platform capabilities such as API management,...
Tokens:509,286
Snippets:5,416
Trust Score:10
Update:4 months ago
Show doc for...
Tokens:
Raw
### Example: Create Installation Namespace

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ilsfpcr-installing-license-service-without-operator-lifecycle-manager-olm-1

Example of setting the `licensing_namespace` to `ibm-licensing` and creating the namespace.

```bash
export licensing_namespace=ibm-licensing
kubectl create namespace ${licensing_namespace}

```

--------------------------------

### Example ~/.ibm-pak Directory Structure

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ifshc-installing-foundational-services-by-mirroring-cloud-pak-images-private-container-registry-pak-plug-in-by-using-helm-charts

Illustrates the typical directory structure created within `~/.ibm-pak` after running CASE commands and mirroring images for connected installations.

```bash
tree ~/.ibm-pak
/root/.ibm-pak
├── config
│   └── config.yaml
├── data
│   ├── cases
│   │   └── YOUR-CASE-NAME
│   │       └── YOUR-CASE-VERSION
│   │           ├── charts
|   |           |   ├── XXXX
|   |           |   ├── XXXX
|   |           |   ├── XXXX
|   |           ├── XXXXX
|   |           ├── XXXXX
│   └── mirror
│       └── YOUR-CASE-NAME
│           └── YOUR-CASE-VERSION
│               ├── catalog-sources.yaml
│               ├── image-content-source-policy.yaml
|               ├── image-digest-mirror-set.yaml
│               └── images-mapping.txt
└── logs
   └── oc-ibm_pak.log
```

--------------------------------

### Setup Tenant Script for Topology 1

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=operators-by-using-script

This script configures tenant setup for topology 1, specifying operator, services, and tethered namespaces. It uses specific version and installation parameters.

```shell
setup_tenant.sh --license-accept \
--enable-licensing \
--operator-namespace tenant1-services \
--services-namespace tenant1-services \
--tethered-namespaces tenant1-cp4ba,tenant1-cp4i \
-c v4.15 \
-i Automatic \
-s opencloud-operators \
-n openshift-marketplace \
-v 1
```

--------------------------------

### Run Foundational Services Installation Script

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=operators-by-using-script

Execute the setup script with mandatory parameters like license acceptance and operator namespace. Optional parameters can be added for specific configurations like tethered, services, or excluded namespaces.

```bash
./setup_tenant.sh --license-accept --operator-namespace <foundational-services-namespace> [--tethered-namespaces|--services-namespace|--excluded-namespaces> <namespace> [OPTIONS]
```

--------------------------------

### Foundational services cert-manager pods example

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=tcms-problem-when-you-install-two-different-cert-managers

This output shows the typical pods for the cert-manager installed by foundational services. It is used for comparison when checking for multiple installations.

```bash
ibm-common-services    cert-manager-cainjector-xxx-xxx
ibm-common-services    cert-manager-controller-xxx-xxx
ibm-common-services    cert-manager-webhook-xxx-xxx
ibm-common-services    ibm-cert-manager-operator-xxx-xxx

```

--------------------------------

### Setup Tenant Script for Topology 3

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=operators-by-using-script

This script configures tenant setup for topology 3, specifying operator, services, and multiple tethered namespaces. It uses specific version and installation parameters.

```shell
setup_tenant.sh --license-accept \
--enable-licensing \
--operator-namespace tenant1-operators \
--services-namespace tenant1-instance \
--tethered-namespaces tenant1-instance-tethered1,tenant1-instance-tethered2 \
-c v4.15 \
-i Automatic \
-s opencloud-operators \
-n openshift-marketplace \
-v 1
```

--------------------------------

### Sample Storage Class Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=services-existing-instance-foundational-in-cluster

This is an example output of the `oc get storageclasses` command, showing various storage class names, their provisioners, and age.

```text
NAME                                  PROVISIONER                     AGE
rook-ceph-block-internal              rook-ceph.rbd.csi.ceph.com      42d
rook-ceph-cephfs-internal (default)   rook-ceph.cephfs.csi.ceph.com   42d
rook-ceph-delete-bucket-internal      ceph.rook.io/bucket             42d
```

--------------------------------

### CNCF cert-manager pods example

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=tcms-problem-when-you-install-two-different-cert-managers

This output shows the typical pods for a standard CNCF cert-manager installation. It is used for comparison when checking for multiple installations.

```bash
cert-manager    cert-manager-cainjector-xxx-xxx
cert-manager    cert-manager-xxx-xxx
cert-manager    cert-manager-webhook-xxx-xxx

```

--------------------------------

### Setup Tenant Script for Topology 2

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=operators-by-using-script

This script configures tenant setup for topology 2, focusing on operator and services namespaces without tethered namespaces. It uses specific version and installation parameters.

```shell
setup_tenant.sh --license-accept \
--enable-licensing \
--operator-namespace tenant1-control \
--services-namespace tenant1-data \
-c v4.15 \
-i Automatic \
-s opencloud-operators \
-n openshift-marketplace \
-v 1
```

--------------------------------

### Example Output for Licensing Operator Subscription and CSV

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=manager-installing-cert-licensing-by-script

This output shows an example of what to expect when checking the subscription and CSV for the IBM Licensing Operator. It confirms the package name, source, channel, and the status of the installed operator.

```text
NAME                         PACKAGE                      SOURCE                CHANNEL
ibm-licensing-operator-app   ibm-licensing-operator-app   opencloud-operators   v4.2

NAME                               DISPLAY            VERSION   REPLACES   PHASE
ibm-licensing-operator.v4.2.18      IBM Licensing      4.2.18                Succeeded
```

--------------------------------

### Example platform-auth-idp configmap content

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=configurations-changing-ldap-search-cache-variable-values

This is an example of the file content you will see when editing the `platform-auth-idp` configmap. Lines starting with '#' are ignored, and an empty file will abort the edit.

```yaml
# Please edit the following object. Lines beginning with a '#'
# will be ignored, and an empty file will abort the edit. If an error
# occurs while saving this file will be reopened with the relevant failures.

```

--------------------------------

### Describe Subscription for Install Plan details

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-olm-is-unable-generate-new-install-plans

Examine the details of a Subscription object to verify the status and reference of its associated Install Plan. This helps confirm that the issue has been resolved and a new install plan is being generated.

```bash
$ oc describe subs/new-operator-subscription -n <namespace_name>

 Install Plan Generation:  1
  Install Plan Ref:
    API Version:       operators.coreos.com/v1alpha1
    Kind:              InstallPlan
    Name:              install-mxw59
    Namespace:         <namespace_name>
    Resource Version:  215607
    UID:               43162fc6-c91e-4394-a836-1399c7465a11
  Installplan:
    API Version:  operators.coreos.com/v1alpha1
    Kind:         InstallPlan
    Name:         install-mxw59
    Uuid:         43162fc6-c91e-4394-a836-1399c7465a11
  Last Updated:   2022-04-25T08:24:08Z
  State:          UpgradePending


```

--------------------------------

### Example cp-console Route Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ui-cp-console-address-is-changed-after-cs-operator-is-upgraded-v4-but-iam-service-is-still-in-v3

This is an example of the expected output after the cp-console route has been successfully updated.

```text
NAME         HOST/PORT                                          PATH   SERVICES                   PORT    TERMINATION            WILDCARD
cp-console   cp-console.apps.installer-cp3pt0.cp.fyre.ibm.com          icp-management-ingress     https   reencrypt/Redirect     None

```

--------------------------------

### Example Output of CSV Identification

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=services-existing-instance-foundational-in-cluster

This is an example output from the 'oc get csv' command, illustrating how foundational services CSVs and their versions are displayed. It helps in visually confirming the installed versions.

```text
ibm-common-services                                ibm-common-service-operator.v3.19.20            IBM Cloud Pak foundational services    3.19.20          ibm-common-service-operator.v3.19.19            Succeeded
foundational-serivces-v4                           ibm-common-service-operator.v4.4.0              IBM Cloud Pak foundational services    4.4.0                                                           Succeeded
```

--------------------------------

### Display script usage instructions

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=olm-upgrade-foundational-operators-services

View the help message for the `setup_tenant.sh` script to understand its available options and parameters. This is useful before executing the upgrade.

```bash
./setup_tenant.sh -h
```

--------------------------------

### Display Script Usage Instructions

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=manager-installing-cert-licensing-by-script

Run the `setup_singleton.sh` script with the -h flag to view its usage instructions and available options.

```bash
./setup_singleton.sh -h
```

--------------------------------

### Example OpenShift Console Route Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=services-existing-instance-foundational-in-cluster

An example of the output from the `oc -n openshift-console get route` command, showing the console URL.

```text
openshift-console    console    console-openshift-console.apps.new-coral.purple-chesterfield.com    console    https    reencrypt/Redirect    None

```

--------------------------------

### Migrate and Set Up Singleton Services

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=4x-all-namespaces-migration

Run the setup_singleton.sh script to migrate and set up new singleton services for Licensing and Cert-Manager. Use the --operator-namespace parameter to specify the namespace for foundational services 3.x.x singleton services.

```bash
./setup_singleton.sh --license-accept --enable-licensing --operator-namespace ibm-common-services

```

--------------------------------

### Script Usage Information

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=manager-installing-cert-licensing-by-script

This is the output of the `./setup_singleton.sh -h` command, detailing the script's purpose, installation namespaces, and available options for customization.

```text
Usage: setup_singleton.sh --license-accept [OPTIONS]...

Install Cloud Pak 3 pre-reqs if they do not already exist: ibm-cert-manager-operator and optionally ibm-licensing-operator
The ibm-cert-manager-operator will be installed in namespace ibm-cert-manager
The ibm-licensing-operator will be installed in namespace ibm-licensing
The --license-accept must be provided.

Options:
  --oc string                                    File path to oc CLI. Default uses oc in your PATH
  --operator-namespace string                    Namespace to migrate Cloud Pak 2 Foundational services
  --enable-licensing                             Set this flag to install ibm-licensing-operator
  --enable-private-catalog                       Set this flag to use namespace scoped CatalogSource. Default is in openshift-marketplace namespace
  --cert-manager-source string                   CatalogSource name of ibm-cert-manager-operator. This assumes your CatalogSource is already created. Default is ibm-cert-manager-catalog
  --licensing-source string                      CatalogSource name of ibm-licensing. This assumes your CatalogSource is already created. Default is ibm-licensing-catalog
  -cmNs, --cert-manager-namespace string         Set custom namespace for ibm-cert-manager-operator. Default is ibm-cert-manager
  -licensingNs, --licensing-namespace string     Set custom namespace for ibm-licensing-operator. Default is ibm-licensing
  --license-accept                               Set this flag to accept the license agreement.
  -c, --channel string                           Channel for Subscription(s). Default is v4.2
  -i, --install-mode string                      InstallPlan Approval Mode. Default is Automatic. Set to Manual for manual approval mode
  -h, --help                                     Print usage information

```

--------------------------------

### Requesting Display Name of a Specific Team (GET)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=api-graphql-example-queries

This example demonstrates how to use the GET API to retrieve the display name of a specific team by its UUID.

```APIDOC
## Using GET to request the display name of a specific team

### Query
```graphql
{
  team(uuid:"72d8e3b6-d4a3-4d0f-a5a7-2e63cea03460") {
    displayName
  }
}
```

### Request Example (curl)
```bash
curl -i -k -H "Authorization: Bearer oauthtoken" -H "Accept: application/json" -H "Content-Type: application/json" -X POST https://host:port/teamserver/rest/graphql -d '{ "query" : "{ team(uuid:\"72d8e3b6-d4a3-4d0f-a5a7-2e63cea03460\") { displayName }}" }'
```

### Response Example
```json
{
    "data": {
        "team": {
            "displayName": "Team3"
        }
    }
}
```
```

--------------------------------

### Example Component Set Configuration File

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=manager-installing-cert-offline

An example of a component-set-config.yaml file defining product name, version, description, and a list of CASEs with their versions. Exactly one CASE should have 'launch: true'.

```yaml
name: "example-product"                         # <required> defines the name for the "product"; this is NOT a CASE name, but follows IBM CASE name rules. For more information, see https://ibm.biz/case-yaml
version: "1.0.0"                                # <required> defines a version for the "product"
description: "an example product targeting OCP 4.9" # <optional but recommended> defines a human readable description for this listing of components
cases:                                          # list of CASEs. First item in the list is assumed to be the "top-level" CASE, and all others are dependencies
- name: ibm-mas
 version: 5.5.2
 launch: true                                  # Exactly one CASE should have this field set to true. The launch scripts of that CASE are used as an entry point while executing 'ibm-pak launch' with a ComponentSetConfig
- name: ibm-cp-common-services
 version: 1.15.2


```

--------------------------------

### Example Command to Get OpenShift Endpoint URL

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=types-delegating-authentication-openshift

A concrete example of the curl command used to retrieve the OpenShift endpoint URL, demonstrating the expected format.

```bash
curl -sk https://api.par-test.os.fyre.ibm.com:6443/.well-known/oauth-authorization-server | jq -r '.issuer'

```

--------------------------------

### Install foundational services v4.x with advanced topology

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=4x-isolated-migration

Use the `setup_tenant.sh` script for an advanced topology installation of foundational services v4.x. This script requires specifying operator, services, and tethered namespaces, along with license acceptance.

```bash
./cp3pt0-deployment/setup_tenant.sh --operator-namespace <foundational-services-v4-operators-ns> --services-namespace <foundational-services-v4-operands-ns-if-needed> --tethered-namespace <to-be-upgrade-Cloud-Pak-ns> --license-accept
```

--------------------------------

### Run Foundational Services Upgrade Script

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=olm-upgrade-foundational-operators-services

Execute the `setup_singleton.sh` script to upgrade Cert Manager or Licensing Service. The `--license-accept` parameter is mandatory. You can specify the subscription channel (e.g., `v4.15`) using the `-c` argument to target a specific version.

```bash
./setup_singleton.sh --license-accept \
  --enable-licensing \
  -c <version, such as v4.15> \

```

--------------------------------

### Example Alert Rule Configuration

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=reporting-cluster-threshold-management-visualization

Example values for productId, metricId, and threshold for a specific product like IBM Cloud Pak for Integration.

```shell
productId='c8b82d189e7545f0892db9ef2731b90d'
metricId='VIRTUAL_PROCESSOR_CORE'
threshold=40
```

--------------------------------

### Describe a Foundational Services InstallPlan

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=troubleshooting-gather-information-about-your-foundational-services-installation

Use this command to view detailed information about a specific `installPlan`. This can provide insights into why an operator's operand might not be deploying.

```bash
oc describe installplan -n <your-foundational-services-namespace> <installplan-name>

```

--------------------------------

### Run the foundational services upgrade script

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=olm-upgrade-foundational-operators-services

Execute the `setup_tenant.sh` script to upgrade foundational services. Ensure you provide the necessary parameters such as `--license-accept`, `--operator-namespace`, and the desired version channel (`-c`).

```bash
./setup_tenant.sh --license-accept \
  --enable-licensing \
  --operator-namespace <foundational-services-namespace> \
  -c <version, such as v4.15> \
  -i Automatic \
  -s opencloud-operators \
  -n openshift-marketplace \
  -v 1
```

--------------------------------

### Example Redirect URI for Unified Console

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=cc-updating-cp-console-hostname-certificates-in-4140-onward

This is an example of a valid redirect URI format for a unified console after updating the hostname. Use the `oc get routes -n` command to retrieve the correct CPD console or `cp-console` URL.

```text
https://<updated CPD or cp-console URL>/ibm/api/social-login/redirect/<OIDC connection name>
```

--------------------------------

### Example Console resource configuration

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=configurations-adding-logout-redirect-url

This is a sample of the `Console` resource before adding the logout redirect URL. It shows the basic structure and metadata.

```yaml
apiVersion: config.openshift.io/v1
kind: Console
metadata:
  annotations:
    release.openshift.io/create-only: "true"
  creationTimestamp: "2020-03-25T15:34:01Z"
  generation: 6
  name: cluster
  resourceVersion: "9119030"
  selfLink: /apis/config.openshift.io/v1/consoles/cluster
  uid: ab896f97-ad65-456e-806b-1f7fbe879345
spec: {}
status:
  consoleURL: https://console-openshift-console.apps.hcp.darumtech.net

```

--------------------------------

### Sample CSV Status Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ui-operator-upgrade-fails-pod-in-crashloopbackoff-status-olm-known-issue

This is a sample output from the 'oc get csv' command, illustrating an operator in the 'Installing' state.

```text
...
ibm-platform-api-operator.v3.8.1                IBM Platform API                       3.8.1     ibm-platform-api-operator.v3.7.2                Installing
...

```

--------------------------------

### Get Identity Provider Registration Response

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=apis-identity-provider

Example response structure for a successful retrieval of an identity provider registration by UID.

```json
{
  "uid": "eohu8kpOL1yp1-z2z1-jb",
  "name": "tls_cert_auth",
  "description": "cert authentication",
  "protocol": "cert",
  "type": "certAuth",
  "idp_config": {
    "certs": {
    "certAuthCA": "<base64-encoded-certAuthCA.crt>"
    },
    "ldap_config": {
    "ldap_id": "<ldap_connection_name>"
    }
  }
}
```

--------------------------------

### Install License Service Catalog using Pak Plugin

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=registry-installing-license-service-using-pak-plugin

Installs the License Service catalog source using the 'oc ibm-pak launch' command with specific parameters for registry, recursion, and input directory.

```bash
oc ibm-pak launch \
$CASE_NAME \
  --version $CASE_VERSION \
  --action install-catalog \
  --inventory $CASE_INVENTORY_SETUP \
  --namespace $NAMESPACE \
  --args "--registry $TARGET_REGISTRY --recursive \
  --inputDir ~/.ibm-pak/data/cases/$CASE_NAME/$CASE_VERSION"

```

--------------------------------

### Download Singleton Application Recipes

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-olm-spectrum-fusion

Use these wget commands to download the necessary recipe files for singleton applications. Ensure you adjust the namespace values in the downloaded files according to your Fusion installation.

```bash
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/singletons/child-cert-manager-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/singletons/child-licensing-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/singletons/child-ls-reporter-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/singletons/parent-singleton-recipe.yaml
```

--------------------------------

### Get New Access Token Response Example

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=apis-oidc-registration

Example JSON response when obtaining a new access token using a refresh token. It includes the new access token, token type, expiration, scope, and a new refresh token.

```json
{
  "access_token": "77f3ea9695e50d147a3081990c331f8ce9baa0b6d02ac4e970c886eabccd7aa7e7f12e1897ceacbdf6bdaf0881ed5a725f214209eb20b9415c2fcf4ad1afb90412a247aeab6ab0e026e08013b8f2b773b5bdb2d8d3c1247e9e7ebeaa8c9c9c66c1e85caf78105e35e934a28f21619bef2ff17cebe75792da86b4a65c19973713559569e92ae6aa86ddb8ee48991c6ced9caf41ae6c3b88f67fcaacf8c2c6af82018b5f55a4e35c1b9026438b690a606de0314bdced35eab21642b4b6c33c5241db457f2564840b9d32c255d0bfa9e4fda176416f7481c205ee98912790a11134597ce7245264669568fd69153a8e2f240df9edb4df3b219e213c3cfb0366713802a9a525fe85c9ec2a8c54ba61b5d845054ff23eb466c990c15dcb025ef320f36bb21ec0d0a412bcdecafba57da6b239891e22c139a7d4057f84fd741215ed5567c3f4b824d9bbfe92d56b77fe1712d35cea60e12f5207b727e3cc658db1b8b5002780049a5faefd8ccc2ccee9100472dfff58978ee3e7303547dc4ea03025275e58ec4e3da8e6ae91939bfb092f1ce78fe2d91124c179f55bda4027957093090c4f47037771e9cacf227867063c909e9aee3bf87140426052821116c6484037822a41f05a0fa565276b5ff1a8a654d3d5d119f6a665469a7591e4ec197d6a90bd586b8b95e227b9869b8654c23c10f78fc6a3fcbbe6d543638f379736193643",
  "token_type": "Bearer",
  "expires_in": 43199,
  "scope": "openid",
  "refresh_token": "5QM3H8fmGjxhPRyYlQ77s4Z5APOHVk5276ItT8q41e2xKNMxF6"
}
```

--------------------------------

### Get Foundational Services Namespace

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=cc-updating-cp-console-hostname-tls-secret-in-4130-earlier

Identify the namespace where the common service operator is deployed. This is typically the namespace where foundational services are installed.

```bash
oc get csv -A | grep common-service-operator
```

--------------------------------

### Collect Specified Support Data (Example)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=support-collecting-information-mustgather

Example command to collect specific support data, including modules and namespaces. Replace placeholders with actual values.

```bash
oc adm must-gather --run-namespace=<NAMESPACE_NAME>--image=<MUST_GATHER_IMAGE> -- gather -m <MUST_GATHER_MODULES> -n <IBM_CLOUDPAK_NAMESPACES> | -h | -v
```

--------------------------------

### Get Identity Provider Registrations by Query Response

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=apis-identity-provider

Example response structure for retrieving multiple identity provider registrations using a query.

```json
{
  "idp": [
{
  "uid": "eohu8kpOL1yp1-z2z1-jb",
  "name": "tls_cert_auth",
  "description": "cert authentication",
  "protocol": "cert",
  "type": "certAuth",
  "idp_config": {
    "certs": {
    "certAuthCA": "<base64-encoded-certAuthCA.crt>"
    },
    "ldap_config": {
    "ldap_id": "<ldap_connection_name>"
    }
  }
}
]
}
```

--------------------------------

### Sample Log Output (Default Cloudfoundry Format)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-enabling-additional-logs-zen-pods

Example of log output when using the default 'cloudfoundry' log format.

```log
10.0.0.1 - https://{CPD-ROUTE}/zen-admin/?deployment_target=icp4data - [20/Nov/2024:20:27:44 +0000] " GET /usermgmt/v2/csrf_token HTTP/1.1" 200 95
10.0.0.1 - https://{CPD-ROUTE}/zen-admin/?deployment_target=icp4data - [20/Nov/2024:20:27:44 +0000] " GET /zen-admin/1.df2fbd175c594d38d711.bundle.js HTTP/1.1" 200 1124303
10.0.0.1 - https://{CPD-ROUTE}/zen-admin/?deployment_target=icp4data - [20/Nov/2024:20:27:44 +0000] " GET /v2/nav/header?context=icp4data&client_side=true&deployment_target=icp4data&skin=carbon10 HTTP/1.1" 200 8975
```

--------------------------------

### Get OpenShift Console Route

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=services-existing-instance-foundational-in-cluster

Retrieve the route for the OpenShift console to access the web console. This command is useful for verifying cluster setup.

```bash
oc -n openshift-console get route

```

--------------------------------

### Example Pod Status Output (Running/Completed)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-secret-watcher-security-onboarding-pods-fail-start

This is an example of the expected output when `secret-watcher` is running and `security-onboarding` has completed successfully. Note the `STATUS` column indicating the state of each pod.

```text
NAMESPACE                     NAME                              READY  STATUS     RESTARTS  AGE
<your-foundational-services-namespace>           secret-watcher-5c79cb8969-7w4nw   1/1    Running    0         19h
<your-foundational-services-namespace>           security-onboarding-8kh8l         0/1    Completed  0         20h

```

--------------------------------

### Cert Manager Subscription and CSV Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=manager-installing-cert-licensing-by-script

Example output showing the details of the installed IBM Cert Manager operator subscription and its ClusterServiceVersion (CSV).

```text
NAME                        PACKAGE                     SOURCE                CHANNEL
ibm-cert-manager-operator   ibm-cert-manager-operator   opencloud-operators   v4.2

NAME                               DISPLAY            VERSION   REPLACES   PHASE
ibm-cert-manager-operator.v4.2.18   IBM Cert Manager   4.2.18                Succeeded

```

--------------------------------

### Download Foundational Services Instance Recipes (v2.10.0)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-olm-spectrum-fusion

Download the recipe files for foundational services instances using these wget commands. Make necessary modifications to the namespace and service names within these files.

```bash
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-csdb-recipe-2.10.0.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-zen-recipe-2.10.0.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-nss-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/parent-cpfs-recipe.yaml
```

--------------------------------

### Download Singleton Application Recipes

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-helm-chart-deployments-spectrum-fusion

Use these wget commands to download the necessary Velero recipe files for singleton applications in IBM Spectrum Fusion.

```bash
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/no-olm/singletons/child-cert-manager-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/no-olm/singletons/child-licensing-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/no-olm/singletons/child-ls-reporter-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/no-olm/singletons/parent-singleton-recipe.yaml
```

--------------------------------

### CASE Prerequisite Configuration Example

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-errors-in-case-prerequisites-airgapsh

This snippet shows a sample configuration for a CASE prerequisite check in `prereq.yaml`. It defines how to check the `oc` client version. Ensure the `versionRegex` accurately reflects the expected output format.

```yaml
oc:
  metadata:
    description: "Client has oc version 4.4.0 or greater"
  command: "oc"
  versionArgs: "version --client"
  versionRegex: "Client Version: 4.[4-9]*.[0-9]*"

```

--------------------------------

### Get Catalog Operator Logs

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-operator-installation-hangs-during-upgrade

Use this command to retrieve logs from the catalog operator, which can help diagnose installation hangs. Ensure you are in the correct namespace.

```bash
oc -n openshift-operator-lifecycle-manager logs deploy/catalog-operator
```

--------------------------------

### Create Mirror Registry Directory

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=cm-installing-red-hat-cert-manager-in-disconnected-environment

Create a directory to store mirrored images. Replace `<example-registry>` with your desired registry path.

```bash
mkdir <example-registry>
```

--------------------------------

### Get Foundational Services Version for CASE

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=cc-updating-cp-console-hostname-tls-secret-in-4130-earlier

Retrieve the version of the common service operator to determine the correct CASE version for downloading installer scripts.

```bash
oc get csv -n  "<your-foundational-services-namespace>"  | grep ibm-common-service-operator
```

--------------------------------

### Example Pod Status Output (CreateContainerConfigError)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-secret-watcher-security-onboarding-pods-fail-start

This output illustrates a `CreateContainerConfigError` status for both `secret-watcher` and `security-onboarding` pods, indicating a configuration issue preventing them from starting.

```text
NAMESPACE             NAME                             READY    STATUS                       RESTARTS    AGE
<your-foundational-services-namespace>   secret-watcher-cccd54d9f-vdnn2   0/1      CreateContainerConfigError   0           20m
<your-foundational-services-namespace>   security-onboarding-btlhh        0/1      CreateContainerConfigError   0           20m

```

--------------------------------

### Environment Properties Configuration Example

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-helm-chart-deployments

This is an example of the `env.properties` file content, showing variables for namespace configuration and resource labeling enablement.

```properties
# Change the following values to match your environment
OPERATOR_NS="" # Pass the namespace where the cs operator is installed

# Pass the namespace where the cs services are installed
# Leave it as empty string if the services are installed in the same namespace as the operator
SERVICES_NS=""
CONTROL_NS="" # Pass the control namespace if it is needed to be backed up

#Pass any additional namespaces in the tenant that are not the operator or services namespace. Comma delimited
TETHERED_NS=""

# Change to the namespace where cert-manager, licensing and LSR are installed
CERT_MANAGER_NAMESPACE="ibm-cert-manager"
LICENSING_NAMESPACE="ibm-licensing"
LSR_NAMESPACE="ibm-lsr"

# enable labeling of cert manager, licensing, and LSR resources by changing value to 1
ENABLE_CERT_MANAGER=0
ENABLE_LICENSING=0
ENABLE_LSR=0

# Change to 1 to enable private catalog
ENABLE_PRIVATE_CATALOG=0

#change to 1 to label catalog sources in openshift-marketplace
ENABLE_DEFAULT_CS=0

# Add additional CatalogSources separated by comma which are withour ".spec.publisher: IBM"
# For example: "my-catalog,my-catalog2,my-catalog3"
ADDITIONAL_SOURCES=""

```

--------------------------------

### Sample Catalog Operator Log Message

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-operator-installation-hangs-during-upgrade

This is an example of a log message that may appear when an operator installation hangs. It indicates an issue with multiple heads for a channel.

```text
E1201 07:54:37.617295       1 queueinformer_operator.go:290] sync "<your-foundational-services-namespace>" failed: found more than one head for channel
```

--------------------------------

### Sample Output for cp-console Hostname

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=apis-identity-provider

Example output showing the hostname for the cp-console route.

```text
cp-console.apps.mycluster.mydomain.com
```

--------------------------------

### Get Zen Service Custom Resource Status

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=issues-troubleshooting-control-plane-installation-zen

Use this command to retrieve the status of the `zenservice` custom resource. This helps in diagnosing installation or runtime failures.

```bash
oc get zenservice <name> -n <zen service namespace> -o yaml
```

--------------------------------

### Example component-set-config.yaml file

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ifshc-installing-foundational-services-by-mirroring-cloud-pak-images-private-container-registry-pak-plug-in-by-using-helm-charts

An example component-set-config.yaml file defining CASEs with pinned down versions for a product. This file captures all the CASEs that were downloaded, pinning down their exact versions during this particular download.

```yaml
name: "example-product"                         # <required> defines the name for the "product"; this is NOT a CASE name, but follows IBM CASE name rules. For more information, see https://ibm.biz/case-yaml
version: "1.0.0"                                # <required> defines a version for the "product"
description: "an example product targeting OCP 4.9" # <optional, but recommended> defines a human readable description for this listing of components
cases:                                          # list of CASEs. First item in the list is assumed to be the "top-level" CASE, and all others are dependencies
- name: ibm-mas
 version: 5.5.2
 launch: true                                  # Exactly one CASE should have this field set to true. The launch scripts of that CASE are used as an entry point while executing 'ibm-pak launch' with a ComponentSetConfig
- name: ibm-cp-common-services
 version: 1.15.2


```

--------------------------------

### Retrieve Authentication CR Status

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=management-database-migration-status

Use this command to get the Authentication CR and inspect its status property. Replace SERVICES_NS with the namespace where foundational services are installed.

```bash
# SERVICES_NS is the namespace where foundational services Operands, such as the Authentication CR, are installed.
oc get authentication.operator.ibm.com example-authentication -oyaml -n "${SERVICES_NS}"

```

--------------------------------

### Get RealmName for IdP using curl

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=users-using-realname-as-query-filter

Use this curl command to retrieve the realmName for an LDAP IdP. Ensure you replace placeholders with your actual values and have jq installed.

```bash
curl -k -X "Authorization: Bearer $ACCESS_TOKEN" "https://<cp-console>/idprovider/v3/auth/idsource?protocol=ldap" | jq -r .idp | jq -r '.[0].idp_config.name'
```

--------------------------------

### Download Foundational Services Instance Recipes (v4.19.0+)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-olm-spectrum-fusion

Use these wget commands to download recipe files for foundational services instances compatible with version 4.19.0 or later. Adjust the 'child-zen-recipe' URL if necessary for your specific Zen service deployment.

```bash
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-csdb-recipe-2.10.0.yaml
wget https://github.com/IBM/ibm-common-service-operator/blob/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-zen-recipe-ibm-pg.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/child-nss-recipe.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/spectrum-fusion/recipes/dynamic-recipes/core/parent-cpfs-recipe.yaml
```

--------------------------------

### Get Zen Audit Pod Name

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=guide-auditing-im-service

If Zen is installed, use this command to find the name of the `zen-audit` pod for checking logs. Replace `<your-foundational-services-namespace>` with the actual namespace.

```bash
oc get pods -n <your-foundational-services-namespace> | grep zen-audit  

```

--------------------------------

### Sample cs-onprem-tenant-config ConfigMap for revert

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=cc-updating-cp-console-hostname-tls-secret-in-4130-earlier

This is an example of the cs-onprem-tenant-config ConfigMap. Comment out or remove custom hostname and certificate settings to revert.

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: cs-onprem-tenant-config
  namespace: $csNamespace
labels:
  cs_onprem_tenant_config: "true"
data:
  ##comment out or remove this setting if not changing the hostname
  custom_hostname: <Default hostname>
  ##comment out or remove this setting if not changing the certificates
  custom_host_certificate_secret: custom-tls-secret
```

--------------------------------

### Get SCIM Admin Password (Alternative Decoding)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=configuration-cloud-pak-scim-okta-integration

Retrieves the SCIM admin password from Kubernetes secrets using an alternative base64 decoding flag. This is used for authentication during SCIM provisioning setup.

```bash
oc get secrets/platform-auth-scim-credentials --template={{.data.scim_admin_password}} | base64 -D

```

--------------------------------

### Configure Deployment Profile and Size

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=service-post-installation

Set the deployment profile to 'Starter' or 'Production' and choose a size (Small, Medium, Large) to define scaling parameters. This example shows a Production deployment of Medium size.

```yaml
spec:
  deploymentProfile: Production
  deploymentProfileSize: Medium
```

--------------------------------

### Retrieve and Filter a List of Teams

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=api-rest-examples

This GET request demonstrates retrieving a list of teams, filtered by display name starting with 'Aut', using the `filter` query parameter. URL encoding for query parameters is omitted for readability.

```HTTP
GET /teamserver/rest/teams?my_teams=true&filter=displayName SW "Aut"
```

--------------------------------

### Install License Service with Helm Chart URL

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=service-installing-license-helm-charts

Install License Service by providing the raw GitHub URL of the Helm chart. This command should be run twice.

```bash
helm template ibm-licensing-cluster-scoped https://github.com/IBM/charts/raw/refs/heads/master/repo/ibm-helm/ibm-licensing-cluster-scoped-4.2.16+20250606.101044.0.tgz | kubectl apply -f -
helm template ibm-licensing-cluster-scoped https://github.com/IBM/charts/raw/refs/heads/master/repo/ibm-helm/ibm-licensing-cluster-scoped-4.2.16+20250606.101044.0.tgz | kubectl apply -f -
```

--------------------------------

### Calculating Solution Bundle Usage with Ratios

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=service-methodology-counting-usage

Demonstrates the calculation of usage for a solution bundle, showing how individual product usage is rounded up based on specified ratios and summed to determine the total bundle usage.

```text
⌈2/5⌉ + ⌈3/4⌉ + ⌈2/5⌉ ~ 1 + 1 + 1 = 3
```

--------------------------------

### Verify License Service Installation with CLI

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=registry-installing-license-service-openshift-container-platform

Run this command to check if License Service is already installed on your OpenShift cluster. If a deployment is returned, it is installed; otherwise, proceed with installation.

```bash
oc get deployment --all-namespaces | grep ibm-licensing-operator

```

--------------------------------

### OLM Installation Confirmation

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=registry-installing-license-service-kubernetes-cluster

This is the expected output if OLM is successfully installed.

```text
NAME                                          CREATED AT
clusterserviceversions.operators.coreos.com   2020-06-04T14:42:13Z

```

--------------------------------

### Download zen5-br-scripts-cm.yaml

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-clusters-single-instance-foundational-services

Download the configuration map script for Velero restores if it is missing.

```shell
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/zen5-br-scripts-cm.yaml.
```

--------------------------------

### View oc image mirror Help

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=ifshc-installing-foundational-services-by-mirroring-cloud-pak-images-private-container-registry-pak-plug-in-by-using-helm-charts

Displays all available options for the `oc image mirror` command. Useful for understanding advanced configurations.

```cmd
oc image mirror --help
```

--------------------------------

### Example Secret Output

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=options-provisioning-static-storage-configuration

This is an example of the output you can expect when verifying the cephfs-static-secret.

```yaml
apiVersion: v1
kind: Secret
metadata:
  name: cephfs-static-secret
  namespace: rook-ceph
type: Opaque
data:
  adminID: Y3NpLWNlcGhmcy1ub2Rl
  adminKey: QVFCbFN1SnB1UlJzRUJBQTBmcXFyQ1ZRV3A2M0plS0Z5MUNMOVE9PQ==
  userID: Y3NpLWNlcGhmcy1ub2Rl
  userKey: QVFCbFN1SnB1UlJzRUJBQTBmcXFyQ1ZRV3A2M0plS0Z5MUNMOVE9PQ==
```

--------------------------------

### Install PostgreSQL 16 Server

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=management-configuring-external-postgresql-database-im

Installs PostgreSQL 16 on the target cluster by adding the PostgreSQL Yum repository, disabling the default module, and installing the server package. This is for RHEL-based systems.

```bash
sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-x86_64/pgdg-redhat-repo-latest.noarch.rpm 
sudo dnf -qy module disable postgresql 
sudo dnf install -y postgresql16-server 
```

--------------------------------

### Example Git Repository Structure

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=charts-integrating-foundational-services-helm-chart-argo-cd

This example shows a basic Git repository structure for deploying IBM Cloud Pak foundational services using an umbrella Helm chart and an Argo CD Application definition. Adjust paths and names for your specific environment.

```yaml
git-root/
  umbrella/
    Chart.yaml
    values.yaml
  argo/
    application.yaml       # Argo CD Application definition
  README.md

```

--------------------------------

### Example Output for RealmName

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=users-using-realname-as-query-filter

This is an example of the output you can expect when retrieving the realmName for an IdP.

```text
OutPut: openLDAP
```

--------------------------------

### Download Zen 5 Backup Resources (v4.19.0+)

Source: https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.x_cd?topic=restoring-multiple-instances-foundational-services

Use these commands to download the necessary YAML files for backing up Zen 5 instances when using foundational services version 4.19.0 or later. Note the different path for the resources.

```bash
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-backup-deployment.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-backup-pvc.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-br-scripts-cm.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-sa.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-role.yaml
wget https://raw.githubusercontent.com/IBM/ibm-common-service-operator/scripts-adopter/velero/schedule/ibm-pg/zen5-rolebinding.yaml
```
Tokens:
Raw