Skip to content

Commit 731142b

Browse files
mmoulymmouly
committed
refactor licensing
1 parent 776a68c commit 731142b

File tree

4 files changed

+200
-121
lines changed

4 files changed

+200
-121
lines changed

‎platform/azure/README-NGINX.md

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
# Deploying IBM Operational Decision Manager with NGINX Ingress Controller on Azure AKS
2+
3+
The aim of this complementary documentation is to explain how to replace the **AKS default Load Balancer** usage with an **NGINX Ingress Controller**.
4+
5+
## Prerequisites
6+
7+
You must have created an AKS cluster and set up your environment by following steps :
8+
- [Prepare your AKS instance 30 min](README.md#prepare-your-aks-instance-30-min)
9+
- [Create the PostgreSQL Azure instance 10 min](README.md#create-the-postgresql-azure-instance-10-min)
10+
- [Prepare your environment for the ODM installation](README.md#prepare-your-environment-for-the-odm-installation)
11+
12+
## Provision an NGINX Ingress Controller
13+
14+
Installing an NGINX Ingress controller allows you to access ODM components through a single external IP address instead of the different IP addresses as seen above. It is also mandatory to retrieve license usage through the IBM License Service.
15+
16+
1. Use the official YAML manifest:
17+
18+
```shell
19+
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.12.0-beta.0/deploy/static/provider/cloud/deploy.yaml
20+
```
21+
22+
> [!NOTE]
23+
> The version will probably change after the publication of our documentation so please refer to the actual [documentation](https://kubernetes.github.io/ingress-nginx/deploy/#azure)!
24+
25+
2. Get the Ingress controller external IP address (it will appear 80 seconds or so after the resource application above):
26+
27+
```shell
28+
kubectl get service --selector app.kubernetes.io/name=ingress-nginx --namespace ingress-nginx
29+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
30+
ingress-nginx-controller LoadBalancer 10.0.78.246 20.19.105.130 80:32208/TCP,443:30249/TCP 2m12s
31+
ingress-nginx-controller-admission ClusterIP 10.0.229.164 <none> 443/TCP 2m12s
32+
```
33+
34+
3. Verify the name of the new IngressClass:
35+
36+
```shell
37+
kubectl get ingressclass
38+
NAME CONTROLLER PARAMETERS AGE
39+
nginx k8s.io/ingress-nginx <none> 5h38m
40+
```
41+
42+
It should be "nginx" but if different please update the next command accordingly.
43+
44+
## Install an ODM release with NGINX Ingress Controller
45+
46+
You can reuse the secret with TLS certificate created [above](README.md#manage-adigital-certificate-10-min):
47+
48+
```shell
49+
helm install <release> ibmcharts/ibm-odm-prod \
50+
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=<registrysecret> \
51+
--set externalDatabase.type=postgres \
52+
--set externalDatabase.serverName=<postgresqlserver>.postgres.database.azure.com \
53+
--set externalDatabase.databaseName=postgres \
54+
--set externalDatabase.port=5432 \
55+
--set externalDatabase.secretCredentials=<odmdbsecret> \
56+
--set service.ingress.enabled=true --set service.ingress.tlsSecretRef=<mynicecompanytlssecret> \
57+
--set service.ingress.tlsHosts={mynicecompany.com} --set service.ingress.host=mynicecompany.com \
58+
--set service.ingress.annotations={"nginx.ingress.kubernetes.io/backend-protocol: HTTPS"} \
59+
--set service.ingress.class=nginx \
60+
--set license=true --set usersPassword=<password>
61+
```
62+
63+
> [!NOTE]
64+
> By default, the NGINX Ingress controller does not enable sticky session. If you want to use sticky session to connect to DC, refer to [Using sticky session for Decision Center connection](../../contrib/sticky-session/README.md)
65+
66+
67+
### Edit the file /etc/hosts on your host
68+
69+
```shell
70+
# vi /etc/hosts
71+
<externalip> mynicecompany.com
72+
```
73+
74+
### Access the ODM services
75+
76+
Check that ODM services are in NodePort type:
77+
78+
```shell
79+
kubectl get services --selector release=<release>
80+
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
81+
release-odm-decisioncenter NodePort 10.0.178.43 <none> 9453:32720/TCP 16m
82+
release-odm-decisionrunner NodePort 10.0.171.46 <none> 9443:30223/TCP 16m
83+
release-odm-decisionserverconsole NodePort 10.0.106.222 <none> 9443:30280/TCP 16m
84+
release-odm-decisionserverconsole-notif ClusterIP 10.0.115.118 <none> 1883/TCP 16m
85+
release-odm-decisionserverruntime NodePort 10.0.232.212 <none> 9443:30082/TCP 16m
86+
```
87+
88+
ODM services are available through the following URLs:
89+
90+
<!-- markdown-link-check-disable -->
91+
| SERVICE NAME | URL | USERNAME/PASSWORD
92+
| --- | --- | ---
93+
| Decision Server Console | https://mynicecompany.com/res | odmAdmin/\<password\>
94+
| Decision Center | https://mynicecompany.com/decisioncenter | odmAdmin/\<password\>
95+
| Decision Server Runtime | https://mynicecompany.com/DecisionService | odmAdmin/\<password\>
96+
| Decision Runner | https://mynicecompany.com/DecisionRunner | odmAdmin/\<password\>
97+
<!-- markdown-link-check-enable -->
98+
99+
Where:
100+
101+
* \<password\> is the password provided to the **usersPassword** helm chart parameter
102+
103+
## Install the IBM License Service and retrieve license usage
104+
105+
This section explains how to track ODM usage with the IBM License Service.
106+
107+
Follow the **Installation** section of the [Manual installation without the Operator Lifecycle Manager (OLM)](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=ils-installing-license-service-without-operator-lifecycle-manager-olm) documentation.
108+
109+
### Patch the IBM Licensing instance with Nginx configuration
110+
111+
Get the [licensing-instance-nginx.yaml](./licensing-instance-nginx.yaml) file and run the command:
112+
113+
```bash
114+
kubectl patch IBMLicensing instance --type merge --patch-file licensing-instance-nginx.yaml -n ibm-licensing
115+
```
116+
117+
Wait a couple of minutes for the changes to be applied.
118+
119+
Run the following command to see the status of Ingress instance:
120+
121+
```bash
122+
kubectl get ingress -n ibm-licensing
123+
```
124+
125+
You should be able to see the address and other details about `ibm-licensing-service-instance`.
126+
```
127+
NAME CLASS HOSTS ADDRESS PORTS AGE
128+
ibm-licensing-service-instance nginx * xxx.xxx.xxx.xxx 80 11m
129+
```
130+
131+
You will be able to access the IBM License Service by retrieving the URL with this command:
132+
133+
```bash
134+
export LICENSING_URL=$(kubectl get ingress ibm-licensing-service-instance -n ibm-licensing -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')/ibm-licensing-service-instance
135+
export TOKEN=$(kubectl get secret ibm-licensing-token -n ibm-licensing -o jsonpath='{.data.token}' |base64 -d)
136+
```
137+
138+
You can access the `http://${LICENSING_URL}:8080/status?token=${TOKEN}` URL to view the licensing usage.
139+
140+
Otherwise, you can also retrieve the licensing report .zip file by running:
141+
142+
```bash
143+
curl "http://${LICENSING_URL}:8080/snapshot?token=${TOKEN}" --output report.zip
144+
```
145+
146+
If your IBM License Service instance is not running properly, refer to this [troubleshooting page](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=service-troubleshooting-license).
147+
148+
## Troubleshooting
149+
150+
If your ODM instances are not running properly, refer to [our dedicated troubleshooting page](https://www.ibm.com/docs/en/odm/9.0.0?topic=900-troubleshooting-support).
151+
152+
## Getting Started with IBM Operational Decision Manager for Containers
153+
154+
Get hands-on experience with IBM Operational Decision Manager in a container environment by following this [Getting started tutorial](https://github.com/DecisionsDev/odm-for-container-getting-started/blob/master/README.md).
155+
156+
# License
157+
158+
[Apache 2.0](/LICENSE)

‎platform/azure/README.md

Lines changed: 28 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,6 @@ Then, [create an Azure account and pay as you go](https://azure.microsoft.com/en
4343
- [Create the PostgreSQL Azure instance 10 min](#create-the-postgresql-azure-instance-10-min)
4444
- [Prepare your environment for the ODM installation](#prepare-your-environment-for-the-odm-installation)
4545
- [Install an ODM Helm release and expose it with the service type LoadBalancer 10 min](#install-an-odm-helm-release-and-expose-it-with-the-service-type-loadbalancer-10-min)
46-
- [Create an NGINX Ingress controller](#create-an-nginx-ingress-controller)
47-
- [Optional Install an ODM Helm release and expose it with the NGINX Ingress controller 10 min](#optional-install-an-odm-helm-release-and-expose-it-with-the-nginx-ingress-controller-10-min)
4846
- [Install the IBM License Service and retrieve license usage](#install-the-ibm-license-service-and-retrieve-license-usage)
4947
- [Troubleshooting](#troubleshooting)
5048
- [Getting Started with IBM Operational Decision Manager for Containers](#getting-started-with-ibm-operational-decision-manager-for-containers)
@@ -112,7 +110,7 @@ After a few minutes, the command completes and returns JSON-formatted informatio
112110

113111
```shell
114112
az group update --name <noderesourcegroup> \
115-
--tags Owner=<email> Team=DBA Usage=demo Usage_desc="Azure customers support" Delete_date=2023-12-31
113+
--tags Owner=<email> Team=DBA Usage=demo Usage_desc="Azure customers support" Delete_date=2024-12-31
116114
```
117115

118116
### Set up your environment to this cluster
@@ -139,8 +137,8 @@ The following example output shows the single node created in the previous steps
139137

140138
```
141139
NAME STATUS ROLES AGE VERSION
142-
aks-nodepool1-27504729-vmss000000 Ready agent 21m v1.28.5
143-
aks-nodepool1-27504729-vmss000001 Ready agent 21m v1.28.5
140+
aks-nodepool1-27504729-vmss000000 Ready agent 21m v1.29.9
141+
aks-nodepool1-27504729-vmss000001 Ready agent 21m v1.29.9
144142
```
145143

146144
## Create the PostgreSQL Azure instance (10 min)
@@ -269,7 +267,7 @@ Check that you can access the ODM charts:
269267
```shell
270268
helm search repo ibm-odm-prod
271269
NAME CHART VERSION APP VERSION DESCRIPTION
272-
ibmcharts/ibm-odm-prod 24.0.0 9.0.0.0 IBM Operational Decision Manager License By in...
270+
ibmcharts/ibm-odm-prod 24.1.0 9.0.0.1 IBM Operational Decision Manager License By in...
273271
```
274272

275273
### Manage a digital certificate (10 min)
@@ -305,12 +303,15 @@ az aks update --name <cluster> --resource-group <resourcegroup> --load-balancer-
305303

306304
### Install the ODM release
307305

306+
> **Note**
307+
> If you prefer to use the NGINX Ingress Controller instead of the default AKS Load Balancer, refer to [Deploying IBM Operational Decision Manager with NGINX Ingress Controller on Azure AKS](README-NGINX.md)
308+
308309
You can now install the product:
309310

310311
```shell
311312
helm install <release> ibmcharts/ibm-odm-prod \
312313
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=<registrysecret> \
313-
--set image.tag=${ODM_VERSION:-9.0.0.0} --set service.type=LoadBalancer \
314+
--set service.type=LoadBalancer \
314315
--set externalDatabase.type=postgres \
315316
--set externalDatabase.serverName=<postgresqlserver>.postgres.database.azure.com \
316317
--set externalDatabase.databaseName=postgres \
@@ -355,131 +356,43 @@ NAME TYPE CLUSTER-IP EXTERN
355356
You can then open a browser on `https://xxx.xxx.xxx.xxx:9453` to access Decision Center, and on `https://xxx.xxx.xxx.xxx:9443` to access Decision Server console, Decision Server Runtime, and Decision Runner.
356357
<!-- markdown-link-check-enable -->
357358

358-
## Create an NGINX Ingress controller
359-
360-
Installing an NGINX Ingress controller allows you to access ODM components through a single external IP address instead of the different IP addresses as seen above. It is also mandatory to retrieve license usage through the IBM License Service.
361-
362-
1. Use the official YAML manifest:
363-
364-
```shell
365-
kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.9.6/deploy/static/provider/cloud/deploy.yaml
366-
```
367-
368-
> [!NOTE]
369-
> The version will probably change after the publication of our documentation so please refer to the actual [documentation](https://kubernetes.github.io/ingress-nginx/deploy/#azure)!
370-
371-
2. Get the Ingress controller external IP address (it will appear 80 seconds or so after the resource application above):
372-
373-
```shell
374-
kubectl get service --selector app.kubernetes.io/name=ingress-nginx --namespace ingress-nginx
375-
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
376-
ingress-nginx-controller LoadBalancer 10.0.78.246 20.19.105.130 80:32208/TCP,443:30249/TCP 2m12s
377-
ingress-nginx-controller-admission ClusterIP 10.0.229.164 <none> 443/TCP 2m12s
378-
```
379-
380-
3. Verify the name of the new IngressClass:
381-
382-
```shell
383-
kubectl get ingressclass
384-
NAME CONTROLLER PARAMETERS AGE
385-
nginx k8s.io/ingress-nginx <none> 5h38m
386-
```
387-
388-
It should be "nginx" but if different please update the next command accordingly.
389-
390-
## (Optional) Install an ODM Helm release and expose it with the NGINX Ingress controller (10 min)
391-
392-
You might want to access ODM components through a single external IP address.
393-
394-
### Install the product
395-
396-
You can reuse the secret with TLS certificate created [above](#manage-adigital-certificate-10-min):
397-
398-
```shell
399-
helm install <release> ibmcharts/ibm-odm-prod \
400-
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=<registrysecret> \
401-
--set image.tag=${ODM_VERSION:-9.0.0.0} \
402-
--set externalDatabase.type=postgres \
403-
--set externalDatabase.serverName=<postgresqlserver>.postgres.database.azure.com \
404-
--set externalDatabase.databaseName=postgres \
405-
--set externalDatabase.port=5432 \
406-
--set externalDatabase.secretCredentials=<odmdbsecret> \
407-
--set service.ingress.enabled=true --set service.ingress.tlsSecretRef=<mynicecompanytlssecret> \
408-
--set service.ingress.tlsHosts={mynicecompany.com} --set service.ingress.host=mynicecompany.com \
409-
--set service.ingress.annotations={"nginx.ingress.kubernetes.io/backend-protocol: HTTPS"} \
410-
--set service.ingress.class=nginx \
411-
--set license=true --set usersPassword=<password>
412-
```
413-
414-
> [!NOTE]
415-
> By default, the NGINX Ingress controller does not enable sticky session. If you want to use sticky session to connect to DC, refer to [Using sticky session for Decision Center connection](../../contrib/sticky-session/README.md)
416-
417-
418-
### Edit the file /etc/hosts on your host
419-
420-
```shell
421-
# vi /etc/hosts
422-
<externalip> mynicecompany.com
423-
```
424-
425-
### Access the ODM services
426-
427-
Check that ODM services are in NodePort type:
428-
429-
```shell
430-
kubectl get services --selector release=<release>
431-
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
432-
release-odm-decisioncenter NodePort 10.0.178.43 <none> 9453:32720/TCP 16m
433-
release-odm-decisionrunner NodePort 10.0.171.46 <none> 9443:30223/TCP 16m
434-
release-odm-decisionserverconsole NodePort 10.0.106.222 <none> 9443:30280/TCP 16m
435-
release-odm-decisionserverconsole-notif ClusterIP 10.0.115.118 <none> 1883/TCP 16m
436-
release-odm-decisionserverruntime NodePort 10.0.232.212 <none> 9443:30082/TCP 16m
437-
```
438-
439-
ODM services are available through the following URLs:
440-
441-
<!-- markdown-link-check-disable -->
442-
| SERVICE NAME | URL | USERNAME/PASSWORD
443-
| --- | --- | ---
444-
| Decision Server Console | https://mynicecompany.com/res | odmAdmin/\<password\>
445-
| Decision Center | https://mynicecompany.com/decisioncenter | odmAdmin/\<password\>
446-
| Decision Server Runtime | https://mynicecompany.com/DecisionService | odmAdmin/\<password\>
447-
| Decision Runner | https://mynicecompany.com/DecisionRunner | odmAdmin/\<password\>
448-
<!-- markdown-link-check-enable -->
449-
450-
Where:
451-
452-
* \<password\> is the password provided to the **usersPassword** helm chart parameter
453-
454359
## Install the IBM License Service and retrieve license usage
455360

456361
This section explains how to track ODM usage with the IBM License Service.
457362

458-
Follow the **Installation** section of the [Manual installation without the Operator Lifecycle Manager (OLM)](https://www.ibm.com/docs/en/cpfs?topic=software-manual-installation-without-operator-lifecycle-manager-olm) documentation. Do not follow the **Creating an IBM Licensing instance** part!
363+
Follow the **Installation** section of the [Installation License Service without Operator Lifecycle Manager (OLM)](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=ils-installing-license-service-without-operator-lifecycle-manager-olm) documentation.
459364

460-
### Create the Licensing instance
365+
#### b. Patch the IBM Licensing instance
461366

462-
Just run:
367+
Get the [licensing-instance.yaml](./licensing-instance.yaml) file and run the command:
463368

464-
```shell
465-
kubectl create -f licensing-instance.yml -n ibm-common-services
369+
```bash
370+
kubectl patch IBMLicensing instance --type merge --patch-file licensing-instance.yaml -n ibm-licensing
466371
```
467372

468-
(More information and use cases on [this page](https://www.ibm.com/docs/en/cpfs?topic=software-configuration).)
373+
Wait a couple of minutes for the changes to be applied.
374+
375+
You can find more information and use cases on [this page](https://www.ibm.com/docs/en/cloud-paks/foundational-services/4.9?topic=configuration-configuring-kubernetes-ingress).
376+
377+
> **Note**
378+
> If you choose to use the NGINX Ingress Controller, you must use the [licensing-instance-nginx.yaml](./licensing-instance-nginx.yaml) file. Refer to [Track ODM usage with the IBM License Service with NGINX Ingress Controller](README-NGINX.md#track-odm-usage-with-the-ibm-license-service-with-nginx-ingress-controller).
469379
470380
### Retrieve license usage
471381

472-
After a couple of minutes, the NGINX load balancer reflects the Ingress configuration and you will be able to access the IBM License Service by retrieving the URL with this command:
382+
You will be able to access the IBM License Service by retrieving the URL with this command:
473383

474-
```shell
475-
export LICENSING_URL=$(kubectl get ingress ibm-licensing-service-instance --namespace ibm-common-services --no-headers | awk '{print $4}')/ibm-licensing-service-instance
476-
export TOKEN=$(kubectl get secret ibm-licensing-token --output jsonpath={.data.token} --namespace ibm-common-services | base64 -d)
384+
```bash
385+
export LICENSING_URL=$(kubectl get ingress ibm-licensing-service-instance -n ibm-licensing -o jsonpath='{.status.loadBalancer.ingress[0].hostname}')
386+
export TOKEN=$(kubectl get secret ibm-licensing-token -n ibm-licensing -o jsonpath='{.data.token}' |base64 -d)
477387
```
478388

479-
You can access the `http://${LICENSING_URL}/status?token=${TOKEN}` URL to view the licensing usage, or retrieve the licensing report .zip file by running:
389+
> **Note**
390+
> If `LICENSING_URL` is empty, take a look at the [troubleshooting](#troubleshooting) section.
391+
392+
You can access the `http://${LICENSING_URL}:8080/status?token=${TOKEN}` URL to view the licensing usage or retrieve the licensing report .zip file by running:
480393

481394
```shell
482-
curl "http://${LICENSING_URL}/snapshot?token=${TOKEN}" --output report.zip
395+
curl "http://${LICENSING_URL}:8080/snapshot?token=${TOKEN}" --output report.zip
483396
```
484397

485398
If your IBM License Service instance is not running properly, refer to this [troubleshooting page](https://www.ibm.com/docs/en/cpfs?topic=software-troubleshooting).

‎platform/azure/licensing-instance-nginx.yml

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: operator.ibm.com/v1alpha1
2+
kind: IBMLicensing
3+
metadata:
4+
name: instance
5+
spec:
6+
apiSecretToken: ibm-licensing-token
7+
datasource: datacollector
8+
httpsEnable: false
9+
ingressEnabled: true
10+
ingressOptions:
11+
annotations:
12+
kubernetes.io/ingress.class: nginx
13+
nginx.ingress.kubernetes.io/rewrite-target: '/$2'
14+
path: /ibm-licensing-service-instance(/|$)(.*)

0 commit comments

Comments
 (0)