### Execute IBM Concert Installation Script

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-scaling-resources

Run the setup script to apply the configuration changes. This command requires license acceptance and authentication credentials for the registry.

```bash
./ibm-concert/bin/setup --license_acceptance=<y> --username=<user> --password=<password> --registry_password=<registry_entitlement_key>
```

--------------------------------

### Execute Installation Setup Script

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dk-migrating-from-rapid-infrastructure-automation-concert-workflows-ocp-cluster

Command to initialize the installation environment. It requires license acceptance and credentials for both the application and the container registry.

```bash
$INSTALL_DIR/bin/setup --license_acceptance=y --username=<user> --password=<password> --registry_password=<registry_entitlement_key>
```

--------------------------------

### Configure Installation Parameters

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dk-migrating-from-rapid-infrastructure-automation-concert-workflows-ocp-cluster

Command to initialize the params.ini configuration file by copying the provided quickstart template.

```bash
cp $INSTALL_DIR/etc/sample-params/workflows-quickstart-k8s-params.ini $INSTALL_DIR/etc/params.ini
```

--------------------------------

### Execute installation setup script

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-upgrading-eks-cluster

Runs the Concert setup script with required credentials and license acceptance. This script prepares the environment for the upgrade.

```bash
$INSTALL_DIR/bin/setup --license_acceptance=y --username=<user> --password=<password> --registry_password=${IBM_REGISTRY_PASSWORD}
```

--------------------------------

### Install and Configure K3s and Helm

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=vm-installing-fips-enabled

Instructions for installing K3s, configuring registry TLS settings, and installing the Helm package manager.

```bash
curl -sfL https://get.k3s.io | sudo INSTALL_K3S_VERSION=<K3s-version> sh -s - --write-kubeconfig-mode 644 --disable traefik

# /etc/rancher/k3s/registries.yaml
configs:
  "<INSTANCE_ADDRESS>": 
    tls: 
       insecure_skip_verify: true

sudo systemctl restart k3s

curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
chmod 700 get_helm.sh
./get_helm.sh

echo "export KUBECONFIG=/etc/rancher/k3s/k3s.yaml" >> ~/.bashrc
source ~/.bashrc
```

--------------------------------

### Export Install Directory for Keycloak BYOS Setup

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=idp-bring-your-own-storage-keycloak

This command exports the installation directory for Keycloak BYOS setup. It sets the INSTALL_DIR environment variable to the specified path. This is a prerequisite for running the Keycloak BYOS configuration script.

```bash
export INSTALL_DIR=<install_directory>/ibm-concert
```

--------------------------------

### Configure Installation Settings

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Set environment variables to TRUE for products that you want to install. Only products set to TRUE will have their images downloaded.

```shell
INSTALL_CONCERT=TRUE
INSTALL_DATAAPPS=TRUE
INSTALL_WORKFLOWS=TRUE
```

--------------------------------

### Extract and Install Helm

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Set the Helm version and proceed with extracting and installing Helm. This step is required for managing Kubernetes applications.

```shell
# As root on air-gapped VM
# Set Helm version
export HELM_VERSION=v3.20.0

```

--------------------------------

### Download K3s and Helm for Air-Gapped Installation (Shell)

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Downloads the K3s Kubernetes distribution binary, airgap images, install script, and the Helm package manager. These components are essential for installing Concert Workflows in an air-gapped environment. Ensure you have root privileges for some operations.

```shell
# As root on internet-connected host
export K3S_RELEASE_VER=v1.33.4+k3s1
export HELM_VERSION=${HELM_VERSION:-v3.20.0}

# Create prerequisites directory inside installation package
mkdir -p prerequisites

# Download K3s binary
K3S_RELEASE_VER_ENCODE=$(echo $K3S_RELEASE_VER | sed 's/+/%2B/g')
curl -Lo ./prerequisites/k3s https://github.com/k3s-io/k3s/releases/download/${K3S_RELEASE_VER_ENCODE}/k3s
chmod a+x ./prerequisites/k3s

# Download K3s airgap images
K3S_RELEASE_VER_SHORT=$(echo $K3S_RELEASE_VER | sed 's/+.*//g')
curl -Lo ./prerequisites/k3s-airgap-images-amd64.tar.zst https://github.com/k3s-io/k3s/releases/download/${K3S_RELEASE_VER_SHORT}%2Bk3s1/k3s-airgap-images-amd64.tar.zst

# Download K3s install script
curl -Lo ./prerequisites/install.sh https://get.k3s.io/
chmod a+x ./prerequisites/install.sh

# Download Helm
helm_download_name=helm-${HELM_VERSION}-linux-amd64.tar.gz
curl -Lo ./prerequisites/${helm_download_name} https://get.helm.sh/${helm_download_name}
```

--------------------------------

### Install K3s on VM

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=workers-installing-remote-worker

Installs K3s on a virtual machine. Replace '<K3s-version>' with a supported version (e.g., v1.29.2+k3s1 to v1.33.x). This command downloads and executes the K3s installation script, configuring it to write kubeconfig with specific permissions and disabling Traefik.

```bash
curl -sfL https://get.k3s.io | sudo INSTALL_K3S_VERSION=<K3s-version> sh -s - --write-kubeconfig-mode 644 --disable traefik
```

--------------------------------

### Concert Workflows Installation Settings with Istio Enabled

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=backend-enhancing-pod-communication-security-by-using-istio

This is an example snippet from the params.ini file, showing how to enable Istio and disable FaaS for Concert Workflows installation on OCP. It sets essential variables for a successful deployment.

```ini
...
...
...
# Workflows installation settings
INSTALL_WORKFLOWS=true
WORKFLOWS_NS=concert-workflows
WORKFLOWS_ENABLE_ISTIO=true
WORKFLOWS_ENABLE_FAAS=false

```

--------------------------------

### Example params.ini Configuration

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-installing-cluster-hardened-security-configuration

A sample structure of the params.ini file, containing key-value pairs for environment variables such as registry prefixes, namespaces, and storage classes required for deployment.

```ini
# INSTALL_EKS: Set as True if installing on EKS
INSTALL_EKS=
# This example is to install Hub, Concert, Data Apps and Workflows on a Kubernetes cluster.
REG_USER=cp

IMAGE_REGISTRY_PREFIX=cp.icr.io/cp

# The parameters are for Hub deployment.
#namespace for Hub
HUB_NS=
HUB_IMAGE_REGISTRY_SUFFIX=/solis-hub
SCALE_CONFIG_HUB=level_1
# storage class for Hub
STORAGE_CLASS_HUB=

# The parameters are for Concert deployment.
INSTALL_CONCERT=true
# namespace for Concert
CONCERT_NS=
CONCERT_IMAGE_REGISTRY_SUFFIX=/concert
SCALE_CONFIG_CONCERT=level_1
#storage class for Concert
STORAGE_CLASS_CONCERT=

# The parameters are for DataApps deployment.
INSTALL_DATAAPPS=true
# namespace for Data Apps
DATAAPPS_NS=
DATAAPPS_IMAGE_REGISTRY_SUFFIX=/concert
SCALE_CONFIG_DATAAPPS=level_1
#storage class for Dataapps
STORAGE_CLASS_DATAAPPS=

# The parameters are for Workflows deployment.
INSTALL_WORKFLOWS=true
#namespace for Workflows
WORKFLOWS_NS=
WORKFLOWS_IMAGE_REGISTRY_SUFFIX=/concert  
# workflows instance address. e.g. solis-gw-workflows.apps.test.cp.fyre.ibm.com  
WORKFLOWS_INSTANCE_ADDRESS=
# OPTIONAL- storage class  pass the storage class name for workflows if not bringing your own repositories.
STORAGE_CLASS_WORKFLOWS=
# workflows installation type
WORKFLOWS_INSTALLATION_TYPE=no-svc-acc
```

--------------------------------

### Configure params.ini installation parameters

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-installing-eks-cluster

Commands to copy the appropriate sample parameter file to the configuration directory and open it for editing.

```bash
cp $INSTALL_DIR/etc/sample-params/concert-dataapps-workflows-k8s-quickstart-params.ini $INSTALL_DIR/etc/params.ini
vi $INSTALL_DIR/etc/params.ini
```

--------------------------------

### Manage IBM Concert Service Lifecycle

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=vm-installing

Provides commands to check the status of all services, as well as scripts to stop or start the systemd-managed services. These scripts are located within the installation directory.

```bash
$INSTALL_DIR/ibm-concert-std/bin/status
```

```bash
$INSTALL_DIR/ibm-concert-std/systemd/stop_service
```

```bash
$INSTALL_DIR/ibm-concert-std/systemd/start_service
```

--------------------------------

### Backup and Initialize params.ini

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-installing-cluster-hardened-security-configuration

Commands to back up the existing params.ini file and copy a specific sample configuration file to the installation directory.

```bash
mv $INSTALL_DIR/etc/params.ini $INSTALL_DIR/etc/params.ini.all
cp $INSTALL_DIR/etc/sample-params/<sample-params-file-name> $INSTALL_DIR/etc/params.ini
```

--------------------------------

### Retrieve Application and Environment Details via cURL

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=inventory-application-environment-name-restrictions

Demonstrates how to perform GET requests to the IBM Concert API. These examples highlight the requirement to URL-encode path parameters such as application and environment names.

```bash
curl -k -X 'GET' 'https://<concertHost>:<concertPort>/core/api/v1/applications/IBM%20Concert' \
--header 'Authorization: C_API_KEY <concertAPIKey>' \
--header 'instanceid: <concertinstanceID>' \
--header 'accept: application/json'
```

```bash
curl -k -X 'GET' 'https://<concertHost>:<concertPort>/core/api/v1/environments/concert%20prod' \
--header 'Authorization: C_API_KEY <concertAPIKey>' \
--header 'instanceid: <concertinstanceID>' \
--header 'accept: application/json'
```

--------------------------------

### Verify and Enable FIPS Mode on OCP

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-installing-fips-enabled-ocp

Commands to check the current FIPS status of an OCP cluster and enable it if necessary. Requires root privileges for setup and a cluster reboot.

```bash
cat /proc/sys/crypto/fips_enabled
sudo fips-mode-setup --enable
sudo reboot
```

--------------------------------

### Get Nginx Ingress Controller Service

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-upgrading-eks-cluster

Example command to retrieve the details of the nginx-ingress-controller service, including its external IP address. This information is used to construct the login URL.

```bash
kubectl get service -n concert-ingress-nginx
```

--------------------------------

### Download Container Images

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Run the manage-images script to download container images from the IBM Container Registry. The script pulls images for selected products and saves them as compressed archives in the `images/<version>/` directory.

```shell
./bin/manage-images --save
```

--------------------------------

### Get Data Apps Ingress Controller Service

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-upgrading-eks-cluster

Example command to retrieve the details of the dataapps-ingress-nginx-controller service, including its external IP address. This is used for the Concert Data Apps login URL.

```bash
kubectl get service -n dataapps-ingress-nginx
```

--------------------------------

### Navigate to Installation Directory

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=kubernetes-installing-ocp-cluster

Changes the current directory to the IBM Concert installation directory, as defined by the INSTALL_DIR environment variable.

```shell
cd $INSTALL_DIR
```

--------------------------------

### Initialize Keycloak Authentication for Concert HUB

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=idp-integrating-openid-connect-keycloak-kubernetes

Commands to export environment variables, navigate to the deployment directory, and execute the initialization script to configure OIDC authentication.

```bash
export SOLIS_DIR=<PATH-TO-YOUR-SOLIS-DIR>
cd $SOLIS_DIR
./bin/init-keycloak-auth.sh <namespace> <kc-url> <client-secret> <client-id> <realm-name>
```

--------------------------------

### Enable Systemd User Linger

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Enable systemd user linger for the specified user to ensure services and processes start automatically at system boot and remain active after the session terminates. Replace `<user>` with the root or non-root account name.

```shell
loginctl enable-linger <user>
```

--------------------------------

### Create Air-Gap Archive

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

Create a complete archive containing the installation package and downloaded images. This archive will be used for installation on an air-gapped VM. The archive can be large (10-40 GB), so ensure sufficient disk space.

```shell
cd ..
tar -czf ibm-concert-x86-airgap.tar.gz ibm-concert/
```

--------------------------------

### Verify Helm Installation

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=planning-installing-helm-vm

This command verifies that Helm has been successfully installed on your system. It checks the installed Helm version. This command should be run after the installation script has completed.

```bash
helm version
```

--------------------------------

### Verify Image Archives

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=dvmv-installing-concert-concert-workflows-concert-data-apps-in-air-gapped-environment-vm

List the contents of the images directory to verify that the archive files for each selected product have been created. Expected files include `images-hub.tar.gz`, `images-concert.tar.gz`, `images-dataapps.tar.gz`, and `images-workflows.tar.gz`.

```shell
ls -lh images/*/
```

--------------------------------

### SSH Command Array Execution Example

Source: https://www.ibm.com/docs/en/concert/2.3.x?topic=blocks-expect-ssh

This JSON array defines a sequence of commands to be executed on a remote host via SSH. Each object specifies a timeout, an expected output pattern to wait for, and the command to send. This is used by the Expect SSH block to perform operations like setting up directories and verifying software installations.

```json
[
  {
  "timeout": 10,
  "expect": ["[#$]$"],
  "send": "echo SHELL is READY"
  },
  {
  "timeout": 10,
  "expect": ["SHELL is READY"],
  "send": "mkdir -p /tmp/app && echo 'DIR_OK'"
  },
  {
  "timeout": 10,
  "expect": ["DIR_OK"],
  "send": "cd /tmp/app && pwd"
  },
  {
  "timeout": 10,
  "expect": ["/tmp/app"],
  "send": "docker -v"
  },
  {
  "timeout": 10,
  "expect": ["Docker version [0-9]+\\.[0-9]+\\.[0-9]+"],
  "send": "echo 'Docker version is present and ready to use!'"
  }
]
```