IBM webMethods Hybrid Integration Event Endpoint Management

https://www.ibm.com/docs/en/eem-ipaas
Admin
Event Endpoint Management enables users to describe, catalog, and control access to Kafka topics as...
Tokens:14,346
Snippets:271
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### Example Subscription Details

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

This is an example output showing subscription details, including the package, source, and the current channel.

```text
NAME                          PACKAGE                        SOURCE                                CHANNEL
ibm-eventendpointmanagement   ibm-eventendpointmanagement    ibm-eventendpointmanagement-catalog   v11.6
```

--------------------------------

### Install Custom Resource Definitions

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Installs the required CRDs for the operator. Includes a generic command and a concrete example.

```bash
helm install <release-name> ibm-helm/ibm-eem-operator-crd -n <crd namespace>
```

```bash
helm install eem-crds ibm-helm/ibm-eem-operator-crd -n eem-crds-ns
```

--------------------------------

### Example Helm release details

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

This is an example output from 'helm list --all-namespaces' showing the details for 'ibm-eem-operator-crd' and 'ibm-eem-operator'. Note the NAME, NAMESPACE, CHART, and APP VERSION.

```text
NAME     NAMESPACE	REVISION	UPDATED                                	STATUS  	CHART                                   	APP VERSION     
eem-crd  eemns   	1       	2025-08-29 02:10:55.343886423 -0800 PST	deployed	ibmM-eem-operator-crd-11.6.3             	26955880-704cca1
eem-op   eemns  	1         	2025-08-29 02:11:08.814270035 -0800 PST	deployed	ibmM-eem-operator-11.6.3                 	26955880-704cca1
```

--------------------------------

### Install Event Gateway via OpenShift CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Apply the custom resource file to the specified namespace using the OpenShift CLI.

```bash
oc -n <gateway namespace> apply -f gateway_cr.yaml
```

--------------------------------

### Create an Operator Subscription

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Define and apply the Subscription resource to install the operator.

```yaml
apiVersion: operators.coreos.com/v1alpha1
kind: Subscription
metadata:
  name: ibm-eventendpointmanagement
  namespace: <target-namespace>
spec:
  channel: v11.6
  installPlanApproval: Manual
  name: ibm-eventendpointmanagement
  source: <catalog-source-name>
  sourceNamespace: openshift-marketplace
```

```bash
oc apply -f subscription.yaml
```

--------------------------------

### Install Event Gateway via kubectl

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Apply the custom resource file to the specified namespace using the standard Kubernetes CLI.

```bash
kubectl -n <gateway namespace> apply -f gateway_cr.yaml
```

--------------------------------

### Install OpenSSL and Gettext on MacOS

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Installs the 'openssl@3' and 'gettext' packages using Homebrew. These are required for certificate generation on MacOS.

```bash
brew install gettext openssl@3

```

--------------------------------

### Verify operator installation

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Checks the deployment status to confirm the operator is running.

```bash
kubectl get deploy ibm-eem-operator -n <operator namespace>
```

--------------------------------

### Check operator status via CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Use this command to list installed operators and verify the installation phase.

```bash
oc get csv
```

--------------------------------

### Verify ibm-pak Installation

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Check if the IBM Catalog Management Plug-in for IBM Cloud Paks is installed.

```bash
oc ibm-pak --help
```

--------------------------------

### Install the Event Endpoint Management operator

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Deploys the operator using Helm with various configuration parameters for webhooks, DNS domains, and namespace scope.

```bash
helm install \
   <release-name> ibm-helm/ibm-eem-operator \
   -n <operator namespace> \
   --set webhook.create=<true or false> \
   --set kubernetesServiceDnsDomain=<k8s service dns domain>  \
   --set watchAnyNamespace=<true or false>
```

```bash
helm install \
   eventendpointmanagement ibm-helm/ibm-eem-operator\
   -n "eem-op" \
   --set watchAnyNamespace=true \
   --set webhook.create=false
```

```bash
helm install eventendpointmanagement ibm-helm/ibm-eem-operator -n "my-ns"
```

--------------------------------

### Set the target namespace for the operator

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Switch to the desired namespace for operator installation using the OpenShift CLI.

```bash
oc project openshift-operators
```

```bash
oc project <target-namespace>
```

--------------------------------

### Get Event Gateway Instance Names

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Retrieve the names of all Event Gateway instances within a specified namespace. This is a prerequisite for updating individual gateway instances.

```bash
oc -n <namespace> get eventgateways.events.ibm.com
```

--------------------------------

### Create IBM Operator Catalog Source Definition

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Define the IBM Operator Catalog as a CatalogSource resource in OpenShift. This is used when installing via the CLI.

```yaml
apiVersion: operators.coreos.com/v1alpha1
kind: CatalogSource
metadata:
   name: ibm-operator-catalog
   namespace: openshift-marketplace
spec:
   displayName: "IBM Operator Catalog"
   publisher: IBM
   sourceType: grpc
   image: icr.io/cpopen/ibm-operator-catalog
```

--------------------------------

### Upgrade EEM Operator with Helm

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Execute this command to upgrade the Helm release for your Event Endpoint Management operator installation. Ensure you replace the namespace and operator name placeholders.

```bash
helm -n <EEM operator namespace> upgrade <EEM operator name> ibm-helm/ibm-eem-operator
```

--------------------------------

### Get Cluster Ingress Domain on OpenShift

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-planning-your-event-gateway-deployment

Use this command to retrieve the default DNS domain for your cluster's ingress controller on Red Hat OpenShift. This is a crucial step in determining the Fully Qualified Domain Names (FQDNs) for your Event Gateway instance.

```bash
oc get ingresses.config/cluster -o jsonpath={.spec.domain}
```

--------------------------------

### Set OpenSSL Command Alias

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Creates an alias for the 'openssl' command to ensure the correct version (openssl@3) is used on MacOS. This is necessary after installing openssl@3 via Homebrew.

```bash
alias openssl=$(brew --prefix)/opt/openssl@3/bin/openssl

```

--------------------------------

### Create a new project with CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Use this command to create a new project (namespace) for your Event Gateway instance. The `--description` and `--display-name` arguments are optional.

```bash
oc new-project <project_name> --description="<description>" --display-name="<display_name>"
```

--------------------------------

### Apply Catalog Sources for Event Endpoint Management

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Apply the generated catalog sources to the cluster. Ensure the path to the catalog-sources.yaml file is correct.

```bash
oc apply -f ~/.ibm-pak/data/mirror/ibm-eventendpointmanagement/11.6.5/catalog-sources.yaml
```

--------------------------------

### Generate CA certificate and key with OpenSSL

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-configuring-tls-certificates-your-event

Use these OpenSSL commands to generate a CA certificate and key for testing and demonstration purposes. It is recommended to use cert-manager for production environments.

```bash
openssl genrsa -out tls.key 2048
```

```bash
openssl req -new -x509 -key tls.key -days 730 -out tls.crt
```

--------------------------------

### Review active network policies

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-event-gateway-network-configuration

Use this command to list all network policies currently applied within the specified gateway namespace.

```bash
kubectl get netpol -n <gateway namespace>
```

--------------------------------

### Generate Mirror Manifests for Event Endpoint Management

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Generate mirror manifests for Event Endpoint Management, specifying the image registry.

```bash
oc ibm-pak generate mirror-manifests ibm-eventendpointmanagement icr.io 
```

--------------------------------

### Add the IBM Helm repository

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Adds the repository containing Event Endpoint Management Helm charts to the local environment.

```bash
helm repo add ibm-helm https://raw.githubusercontent.com/IBM/charts/master/repo/ibm-helm
```

--------------------------------

### Configure Docker Gateway Environment Variables

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-exporting-event-gateway-metrics-traces-opentelemetry

Configures the Event Gateway container using environment variables passed during startup.

```bash
-e OTEL_EXPORTER_OTLP_ENDPOINT="https://<otel endpoint>" \
-e OTEL_LOGS_EXPORTER="none" \
-e OTEL_METRICS_EXPORTER="none" \
-e OTEL_SERVICE_NAME="<unique name>" \
-e IBM_JAVA_OPTIONS="-javaagent:/opt/ibm/gateway/lib/opentelemetry-javaagent.jar" \
-e EGW_ENABLE_OTEL_METRICS="false" \
-e EGW_ENABLE_OTEL_KAFKA_RECORD_TRACING="true" \
-e OTEL_EXPORTER_OTLP_HEADERS="Authorization=mcsp-key apikey=<api key>" \
```

--------------------------------

### Apply CASE Bundle for Catalog Sources

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Apply the CASE bundle to manage catalog sources. Ensure the path to the CASE bundle is correct for your environment.

```bash
oc apply -f ~/.ibm-pak/data/mirror/ibm-eventendpointmanagement/<case version>/catalog-sources.yaml
```

--------------------------------

### Apply IBM Operator Catalog Source via CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Apply the IBM Operator Catalog definition to the cluster using the `oc apply` command.

```bash
oc apply -f ibm_catalogsource.yaml
```

--------------------------------

### Download Event Endpoint Management CASE Files

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Download, validate, and extract the latest Event Endpoint Management CASE version.

```bash
oc ibm-pak get ibm-eventendpointmanagement
```

--------------------------------

### List Helm Releases

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Verify that your upgrade has completed by listing all Helm releases in the specified namespace. Check the CHART column for the target version.

```bash
helm list -n <namespace>
```

--------------------------------

### Docker configuration placeholders

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Placeholder variables used in the generated Docker command that require manual replacement before deployment.

```text
KAFKA_ADVERTISED_LISTENER
```

```text
<provide-path-to-tls-certificate>
```

```text
<provide-path-to-tls-key>
```

```text
<provide-path-to-CA-certificates-to-trust-gateway>
```

--------------------------------

### Download CASE Bundle

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Download and extract the latest Event Endpoint Management CASE version using this command. This is required if you manage your catalog sources with a CASE bundle.

```bash
oc ibm-pak get ibm-eventendpointmanagement 
```

--------------------------------

### View Event Gateway Certificate with OpenSSL

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Use this command to connect to your Event Gateway endpoint and display its certificate. This verifies that the client can establish a TCP connection and that the certificate matches the configured one. No HTTP response is returned.

```bash
openssl s_client -connect <gateway endpoint>:443 -servername <gateway endpoint> -showcerts
```

--------------------------------

### Generate Mirror Manifests

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Generate mirror manifests for Event Endpoint Management after downloading the CASE bundle. This command is used when managing catalog sources with a CASE bundle.

```bash
oc ibm-pak generate mirror-manifests ibm-eventendpointmanagement icr.io
```

--------------------------------

### Retrieve Event Gateway Instances

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

This command lists all Event Gateway instances within a specified namespace. It is used to identify instances that need their license updated.

```bash
kubectl -n <namespace> get eventgateways.events.ibm.com
```

--------------------------------

### Create a Kubernetes namespace

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Creates a dedicated namespace for the operator, CRDs, and gateway instance. Avoid using system namespaces like default or kube-system.

```bash
kubectl create ns <gateway namespace>
```

--------------------------------

### View Gateway Certificate Properties

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Displays the properties of the generated gateway certificate in a human-readable format. This command is useful for inspecting certificate details like validity, issuer, and subject.

```bash
openssl x509 -in gateway.crt -text -noout

```

--------------------------------

### Patch Event Gateway Instance License

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Update the license information for a specific Event Gateway instance. Replace `<gateway instance name>` and `<license ID>` with your actual values.

```bash
oc -n <namespace> patch eventgateway.events.ibm.com <gateway instance name> --patch '{"spec":{"license":{"license":"<license ID>"}}}' --type=merge
```

--------------------------------

### Display Helm release information

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

This command displays detailed information about the specified Helm chart, including its version. Check the 'version:' value to determine the current chart version.

```bash
helm show chart ibm-helm/ibm-eem-operator
```

--------------------------------

### Define DNS alt_names for certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Specify the DNS alternative names in the certificate configuration to match the gateway hostname.

```text
[alt_names]
DNS.1 = localhost
```

--------------------------------

### Edit Kubernetes Deployment

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-kubernetes-deployment

Use this command to open the Kubernetes deployment configuration for editing. Replace `<namespace>` and `<deployment name>` with your specific values.

```bash
kubectl -n <namespace> edit deployment <deployment name>
```

--------------------------------

### Create an image pull secret with CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Create a docker-registry secret named `ibm-entitlement-key` in your Event Gateway namespace. This secret is required for pulling the Event Gateway container image from the registry. Replace `<your-entitlement-key>` with your actual entitlement key and `<namespace>` with your project name.

```bash
oc create secret docker-registry ibm-entitlement-key --docker-username=cp --docker-password="<your-entitlement-key>" --docker-server="cp.icr.io" -n <namespace>
```

--------------------------------

### Create an OperatorGroup

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Define and apply an OperatorGroup configuration for the target namespace.

```yaml
apiVersion: operators.coreos.com/v1
kind: OperatorGroup
metadata:
  name: ibm-eventautomation-operatorgroup
  namespace: <target-namespace>
spec:
  targetNamespaces:
    - <target-namespace>
```

```bash
oc apply -f operator-group.yaml
```

--------------------------------

### Create a deny-all-ingress network policy

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-event-gateway-network-configuration

Apply this YAML to restrict all inbound traffic to pods in the namespace. Ensure this does not conflict with other applications requiring inbound communication.

```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```

--------------------------------

### Check Subscription Details with CLI

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Use this command to check the Event Endpoint Management operator subscription details, including the current OLM channel. Replace `<namespace>` with your operator's namespace.

```bash
oc -n <namespace> get subscription
```

--------------------------------

### Configure Kubernetes Deployment Environment Variables

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-exporting-event-gateway-metrics-traces-opentelemetry

Sets the required OpenTelemetry environment variables within the Kubernetes deployment manifest.

```yaml
        # Optional env for enabling kafka record end to end monitoring
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: "https://<otel endpoint>"
        - name: OTEL_LOGS_EXPORTER
          value: none
        - name: OTEL_METRICS_EXPORTER
          value: none
        - name: OTEL_SERVICE_NAME
          value: "<unique name>"
        - name: IBM_JAVA_OPTIONS
          value: "-javaagent:/opt/ibm/gateway/lib/opentelemetry-javaagent.jar"
        - name: EGW_ENABLE_OTEL_METRICS
          value: "false"
        - name: EGW_ENABLE_OTEL_KAFKA_RECORD_TRACING
          value: "true"
        - name: OTEL_EXPORTER_OTLP_HEADERS
          valueFrom:
            secretKeyRef:
              name: otel-api-key
              key: "apikeystring"
```

--------------------------------

### Generate Gateway Certificate Signing Request (CSR)

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Creates a Certificate Signing Request (CSR) for the Event Gateway using its private key. Prompts for 'Common Name' (enter 'IBM EEM') and other details.

```bash
openssl req -new -key gateway.key -out gateway.csr

```

--------------------------------

### List all Helm releases

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Use this command to identify the name, namespace, and chart of your Event Endpoint Management operator. You can filter the output for 'eem' if you have many Helm releases.

```bash
helm list --all-namespaces
```

```bash
helm list --all-namespaces | grep eem
```

--------------------------------

### Create Kubernetes Secret for OTEL API Key

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-exporting-event-gateway-metrics-traces-opentelemetry

Stores the API key in a Kubernetes secret for use by the Event Gateway.

```bash
kubectl -n <namespace> create secret generic otel-api-key --from-literal=apikeystring="Authorization=mcsp-key apikey=<api key>"
```

--------------------------------

### Configure GATEWAY_TRUST_PEM environment variable

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Reference a Kubernetes secret containing the CA certificate to allow consumers to download it from the UI.

```yaml
      - name: GATEWAY_TRUST_PEM
        valueFrom:
          secretKeyRef:
            key: ca.crt
            name: "<Kubernetes secret that contains your certificate>"
```

--------------------------------

### Generate Gateway Private Key

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Generates a 4096-bit RSA private key for the Event Gateway. This key will be used to secure communication for the gateway.

```bash
openssl genrsa -out gateway.key 4096

```

--------------------------------

### Access denied error message

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Error message encountered when the Docker process lacks read permissions for certificate files.

```text
java.nio.file.AccessDeniedException
```

--------------------------------

### Define OTEL_EXPORTER_OTLP_HEADERS Value

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-exporting-event-gateway-metrics-traces-opentelemetry

Specifies the required format for the OTEL_EXPORTER_OTLP_HEADERS property.

```text
"Authorization=mcsp-key apikey=<api key>"
```

--------------------------------

### Update Helm repository

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Run this command to update your local Helm repository cache with the latest information from the configured repositories, including 'ibm-helm'.

```bash
helm repo update ibm-helm
```

--------------------------------

### Configure Kubernetes Deployment environment variables

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-advanced-event-gateway-configuration

Use this YAML structure within the container specification to define environment variables for the Event Gateway.

```yaml
spec:
  containers:
    - name: egw
      env:
        - name: <name>
          value: <value>
```

--------------------------------

### Configure TLS secret reference

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Update the spec.tls section to point to the Kubernetes secret containing your server certificate and keys.

```yaml
 spec:
   tls:
    secretName: <Kubernetes secret that contains your certificate>
    key: tls.key
    serverCertificate: tls.crt
    caCertificate: ca.crt
```

--------------------------------

### Verify Event Endpoint Management Operator Upgrade Channel

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Check the available update channels for the Event Endpoint Management operator in a specific namespace. This helps confirm that the target version is accessible.

```bash
oc -n <namespace> get packagemanifest ibm-eventendpointmanagement -o=jsonpath='{.status.channels[*].name}'
```

--------------------------------

### Generate Certificate Authority (CA) Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Creates a self-signed CA certificate valid for 730 days using the generated CA private key. Prompts for 'Common Name' (enter 'IBM EEM') and other details.

```bash
openssl req -new -x509 -key ca.key -days 730 -out ca.crt

```

--------------------------------

### Check Subscription Status for Operator Upgrade

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Verify the status of the Subscription custom resource to confirm the Event Endpoint Management operator has been updated to the target version. The `status.installedCSV` field indicates the current operator version.

```bash
oc -n <namespace> get -o yaml subscription
```

--------------------------------

### Verify Gateway Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Verifies the generated gateway certificate against the CA certificate to ensure it is trusted. A successful verification indicates the certificate is valid and signed by the specified CA.

```bash
openssl verify -CAfile ca.crt gateway.crt

```

--------------------------------

### Update Docker Image Reference

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-docker-event

Modify the Docker run command to specify the target version of the gateway image.

```bash
-d icr.io/cpopen/ibm-eventendpointmanagement/egw:11.6.5
```

--------------------------------

### Configure Operator-Managed Gateway Custom Resource

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-exporting-event-gateway-metrics-traces-opentelemetry

Updates the Event Gateway custom resource to enable OpenTelemetry and configure the necessary environment variables.

```yaml
  # Optional config for enabling kafka record end to end monitoring
  openTelemetry:
    endpoint: "https://<otel endpoint>"
    metricsEnablement:
      - name: gateway
        enabled: false
    tracesEnablement:
      - name: kafkaRecord
        enabled: true
```

```yaml
              # Optional env for enabling kafka record end to end monitoring
              - name: OTEL_EXPORTER_OTLP_HEADERS
                valueFrom:
                  secretKeyRef:
                    name: otel-api-key
                    key: "apikeystring"
```

--------------------------------

### Create an image pull secret

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-other-kubernetes-platforms

Creates a docker-registry secret named ibm-entitlement-key to allow pulling images from the IBM registry.

```bash
kubectl create secret docker-registry ibm-entitlement-key --docker-username=cp --docker-password="<your-entitlement-key>" --docker-server="cp.icr.io" -n "<gateway namespace>"
```

--------------------------------

### Generate Certificate Authority (CA) Key

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Generates a 4096-bit RSA private key for the Certificate Authority (CA). This key is essential for signing other certificates.

```bash
openssl genrsa -out ca.key 4096

```

--------------------------------

### List Running Docker Containers

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-docker-event

Use this command to identify the ID of the currently running gateway container before stopping it.

```bash
docker ps
```

--------------------------------

### Base64 Decode CA Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-verifying-your-event-endpoint-management-deployment

Decode the CA certificate file using the base64 command. This prepares the certificate for insertion into configuration or code samples.

```bash
base64 -d gateway-ca.crt
```

--------------------------------

### Add gateway endpoint for non-OpenShift platforms

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Define the gateway endpoint in the spec.endpoints section for environments other than Red Hat OpenShift.

```yaml
  spec:
    endpoints:
      - name: gateway
        host: <gateway endpoint>
```

--------------------------------

### Default ingress annotations

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-event-gateway-network-configuration

These annotations are applied by default to generated ingress endpoints when not running on Red Hat OpenShift.

```yaml
  ingress.kubernetes.io/ssl-passthrough: 'true'
  nginx.ingress.kubernetes.io/backend-protocol: HTTPS
  nginx.ingress.kubernetes.io/ssl-passthrough: 'true'
```

--------------------------------

### Set maximum Kafka brokers for external access

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-advanced-event-gateway-configuration

Define the number of routes or ingresses for Kafka client connectivity by setting the maxNumKafkaBrokers field.

```yaml
spec:
  maxNumKafkaBrokers: 3
```

--------------------------------

### Update Event Gateway Image

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-kubernetes-deployment

Specify the new Event Gateway image name within the deployment configuration. Ensure the image name is correct for your desired version.

```yaml
icr.io/cpopen/ibm-eventendpointmanagement/egw:11.6.5
```

--------------------------------

### Apply Kubernetes Secret using kubectl

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-configuring-tls-certificates-your-event

Apply the custom gateway certificate secret to your Kubernetes cluster using `kubectl`. Ensure you specify the correct namespace where your Event Gateway will be deployed.

```bash
kubectl -n <namespace> apply -f custom-gateway-cert.yaml
```

--------------------------------

### Configure Subject Alternative Names for Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Defines the Subject Alternative Names (SANs) for the TLS certificate. This file is used by OpenSSL to specify hostnames the certificate is valid for, such as 'localhost'.

```ini
[req_ext]
subjectAltName = @alt_names

[alt_names]
DNS.1 = localhost

```

--------------------------------

### Stop a Docker Event Gateway Container

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

Execute this command to stop the Event Gateway container. Replace `<container_id>` with the actual ID obtained from `docker ps`.

```bash
docker stop <container_id>

```

--------------------------------

### Upgrade EEM CRDs with Helm

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Use this command to upgrade the Helm release managing your Event Endpoint Management Custom Resource Definitions (CRDs). Replace placeholders with your specific namespace and release name.

```bash
helm -n <EEM CRD namespace> upgrade <EEM CRD name> ibm-helm/ibm-eem-operator-crd
```

--------------------------------

### Remove write permissions from gateway configuration

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Use this command to prevent accidental modifications to the original gateway custom resource file.

```bash
chmod a-w gateway_cr_original.yaml
```

--------------------------------

### Check for existing OperatorGroup

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-preparing-red-hat-openshift-environment

Verify if an OperatorGroup is already present in the target namespace.

```bash
oc get OperatorGroup
```

--------------------------------

### Patch Event Gateway License

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-other-kubernetes-platforms

Update the license field for a specific Event Gateway instance. This is required when upgrading from versions 11.6.x to 11.7.0 or later. Replace placeholders with your namespace, gateway name, and the new license ID.

```bash
kubectl -n <namespace> patch eventgateways.events.ibm.com <gateway instance name> --patch '{"spec":{"license":{"license":"<license ID>"}}}' --type=merge
```

--------------------------------

### Sign Gateway CSR to Create Gateway Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-installing-event-gateway-as-docker-container

Signs the Event Gateway's CSR using the CA certificate and key to produce the final gateway certificate. It includes Subject Alternative Names from 'my-gateway-cert.txt' and is valid for 730 days.

```bash
openssl x509 -req -in gateway.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out gateway.crt -days 730 -extensions 'req_ext' -extfile <(envsubst < my-gateway-cert.txt)

```

--------------------------------

### Patch Subscription to Required Update Channel

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=uomeg-upgrading-operator-managed-event-gateways-red-hat-openshift

Update the Event Endpoint Management operator's subscription to target a specific update channel for upgrades. Replace `vX.Y` with the desired channel, such as `v11.6`.

```bash
oc -n <namespace> patch subscription ibm-eventendpointmanagement --patch '{"spec":{"channel":"vX.Y"}}' --type=merge
```

--------------------------------

### Stop Docker Gateway Container

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-docker-event

Execute this command to stop the running gateway container using its ID.

```bash
docker stop <container_id>
```

--------------------------------

### Remove a Docker Event Gateway Container and Image

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

After stopping the container, use these commands to remove the gateway container and its associated image. Replace placeholders with your specific container and image names.

```bash
docker rm <gateway_container>

```

```bash
docker rmi <gateway_image_name>

```

--------------------------------

### Remove Issuer and Certificate sections

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-install-operator-managed-event-instance

Delete these sections from the custom resource YAML when supplying custom server certificates.

```yaml
apiVersion: cert-manager.io/v1
kind: Issuer
...
---
apiVersion: cert-manager.io/v1
kind: Certificate
...
```

--------------------------------

### Remove Docker Gateway Image

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-docker-event

Remove the Docker image associated with the gateway after the container has been deleted.

```bash
docker rmi <gateway_image_name>
```

--------------------------------

### Override ingress annotations

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-event-gateway-network-configuration

Specify custom annotations on a gateway endpoint to override the default ingress configuration.

```yaml
spec:
  endpoints:
    - name: gateway
      host: my-gateway.mycompany.com
      annotations:
        some.annotation.foo: "true"
        some.other.annotation: value
```

--------------------------------

### Remove Docker Gateway Container

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-upgrading-docker-event

Delete the stopped gateway container after it has been halted.

```bash
docker rm <gateway_container>
```

--------------------------------

### Delete Event Gateway CR

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

Removes the Event Gateway custom resource from the specified namespace.

```bash
kubectl -n <namespace> delete egw <gateway cr name>
```

--------------------------------

### Delete Associated Networking Resources

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

Removes routes, ingresses, or services created for the Event Gateway instance.

```bash
kubectl -n <namespace> delete <service/ingress/route> <name>
```

--------------------------------

### Retrieve Gateway Secret CA Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-verifying-your-event-endpoint-management-deployment

Use this kubectl command to retrieve the CA certificate from your Event Gateway's Kubernetes secret. Replace placeholders with your specific namespace and secret name.

```bash
kubectl -n <gateway namespace> get -o yaml <secret name> | grep "ca.crt"
```

--------------------------------

### Create Kubernetes Secret for Custom Gateway Certificate

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateway-configuring-tls-certificates-your-event

Define a Kubernetes secret of type `kubernetes.io/tls` to store your custom CA certificate, server certificate, and private key. This secret is used by the Event Gateway for secure communication.

```yaml
apiVersion: v1
data:
  ca.crt: <base64 encoded CA certificate>
  tls.crt: <base64 encoded server certificate>
  tls.key: <base64 encoded key>
metadata:
  name: custom-gateway-cert
kind: Secret
type: kubernetes.io/tls
```

--------------------------------

### Delete a Kubernetes Deployment Event Gateway

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

To remove a Kubernetes Deployment Event Gateway, delete the deployment, its associated secret, and any related services, ingresses, or routes. Ensure you specify the correct namespace and names.

```bash
kubectl -n <namespace> delete deploy <gateway-deployment>

```

```bash
kubectl -n <namespace> delete secret <gateway-secret>

```

```bash
kubectl -n <namespace> delete <service/ingress/route> <name>

```

--------------------------------

### Delete Event Gateway Secret

Source: https://www.ibm.com/docs/en/eem-ipaas?topic=gateways-uninstalling-event

Deletes the secret associated with the Event Gateway, which shares the same name as the gateway CR.

```bash
kubectl -n <namespace> delete secret <gateway-secret>
```
Tokens:
Raw