Merge pull request #1103 from IBM/ba-2026-02-13

CP4BA 25.0.1 / IPM 2.1.0 / RPA 30.0.1 / BAMOE 9.3.1 / ICA 1.0.2

Author: jandusek4

.gitignore

@@ -10,6 +10,7 @@ playbooks/ier_configmgr_workspace
 .version-info
 *ier_configmgr_workspace
 .ansible
+workspace_config.yaml
 .logs
 .evfevent
-.env
+.env

automation-roles/50-install-cloud-pak/cp4ba/config/tasks/fill-capabilities.yml

@@ -1,3 +1,14 @@
+- name: Enable content Pattern for ica
+  ansible.builtin.set_fact:
+    _current_cp4ba_cluster: "{{ _current_cp4ba_cluster | combine(insert, recursive=true) }}"
+  vars:
+    insert:
+      cp4ba:
+        patterns:
+          content:
+            enabled: true
+  when: _current_cp4ba_cluster.ica.enabled
+
 - name: Enable parent Pattern for decisions
   ansible.builtin.set_fact:
     _current_cp4ba_cluster: "{{ _current_cp4ba_cluster | combine(insert, recursive=true) }}"

automation-roles/50-install-cloud-pak/cp4ba/config/tasks/internal-variables.yml

@@ -47,9 +47,7 @@ postgresql_hostname: "postgresql.{{ postgresql_project_name }}.svc.cluster.local
 mail_hostname: "mail.{{ mail_project_name }}.svc.cluster.local"
 mssql_hostname: "mssql.{{ mssql_project_name }}.svc.cluster.local"
 nexus_hostname: "nexus.{{ nexus_project_name }}.svc.cluster.local"
-
-opensearch_admin_user: opensearch-admin
-opensearch_universal_password: "{{ universal_password }}"
+opensearch_hostname: "opensearch.{{ opensearch_project_name }}.svc.cluster.local"
 
 usage_action: "{{ global_action }}"
 usage_project_name: "{{ main_project_name }}"
@@ -123,6 +121,13 @@ cloudbeaver_postgresql_universal_password: "{{ universal_password }}"
 cloudbeaver_mssql_hostname: "{{ mssql_hostname }}"
 cloudbeaver_mssql_universal_password: "{{ universal_password }}"
 
+opensearch_action: "{{ global_action }}"
+opensearch_project_name: "{{ collateral_project_name }}"
+opensearch_storage_class_name: "{{ block_storage_class_name }}"
+opensearch_ca_key_path: "{{ ca_key_path }}"
+opensearch_ca_crt_path: "{{ ca_crt_path }}"
+opensearch_universal_password: "{{ universal_password }}"
+
 cpfs_action: "{{ global_action }}"
 cpfs_universal_password: "{{ universal_password }}"
 cpfs_storage_class_name: "{{ storage_class_name }}"
@@ -151,8 +156,9 @@ cp4ba_ca_crt_path: "{{ ca_crt_path }}"
 cp4ba_google_client_id: "{{ google_client_id }}"
 cp4ba_google_client_secret: "{{ google_client_secret }}"
 cp4ba_deployment_platform: "{{ deployment_platform }}"
-cp4ba_opensearch_universal_password: "{{ opensearch_universal_password }}"
-cp4ba_opensearch_admin_user: "{{ opensearch_admin_user }}"
+
+cp4ba_opensearch_universal_password: "{{ universal_password }}"
+cp4ba_opensearch_admin_user: opensearch-admin
 
 mssql_action: "{{ global_action }}"
 mssql_project_name: "{{ collateral_project_name }}"
@@ -180,3 +186,10 @@ pm_postgresql_password: "{{ postgresql_universal_password }}"
 
 bamoe_action: "{{ global_action }}"
 bamoe_project_name: "{{ main_project_name }}"
+
+ica_action: "{{ global_action }}"
+ica_universal_password: "{{ universal_password }}"
+ica_project_name: "{{ main_project_name }}"
+ica_storage_class_name: "{{ storage_class_name }}"
+ica_opensearch_hostname: "{{ opensearch_hostname }}"
+ica_opensearch_password: "{{ opensearch_universal_password }}"

automation-roles/50-install-cloud-pak/cp4ba/config/tasks/main.yml

@@ -57,6 +57,10 @@
   ansible.builtin.set_fact:
     mssql_enabled: "{{ true if _current_cp4ba_cluster.rpa.enabled else false }}"
 
+- name: OpenSearch config variable
+  ansible.builtin.set_fact:
+    opensearch_enabled: "{{ true if _current_cp4ba_cluster.ica.enabled else false }}"
+
 - name: Get OCP Apps Endpoint
   ansible.builtin.include_role:
     name: common

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-cluster/tasks/install.yml

@@ -99,3 +99,13 @@
   ansible.builtin.include_role:
     name: bamoe
   when: _current_cp4ba_cluster.bamoe.enabled
+
+- name: Install OpenSearch
+  ansible.builtin.include_role:
+    name: opensearch
+  when: opensearch_enabled
+
+- name: Install ICA
+  ansible.builtin.include_role:
+    name: ica
+  when: _current_cp4ba_cluster.ica.enabled

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-cluster/tasks/remove.yml

@@ -1,3 +1,18 @@
+- name: Remove ICA
+  ansible.builtin.include_role:
+    name: ica
+  when: _current_cp4ba_cluster.ica.enabled
+
+- name: Remove OpenSearch
+  ansible.builtin.include_role:
+    name: opensearch
+  when: opensearch_enabled
+
+- name: Remove BAMOE
+  ansible.builtin.include_role:
+    name: bamoe
+  when: _current_cp4ba_cluster.bamoe.enabled
+
 - name: Remove RPA
   ansible.builtin.include_role:
     name: rpa

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-core/tasks/db/fncm.yml

@@ -94,3 +94,47 @@
         REVOKE CONNECT ON DATABASE contentdb FROM PUBLIC;
       EOF"
   register: command_status
+
+# Based on https://www.ibm.com/docs/en/cloud-paks/cp-biz-automation/latest?topic=manager-preparing-databases
+# Based on https://www.ibm.com/docs/en/filenet-p8-platform/latest?topic=vtpiicd-creating-postgresql-database-table-spaces-content-platform-engine-object-store
+- name: OS1DB DB prepare tablespace
+  kubernetes.core.k8s_exec:
+    namespace: "{{ cp4ba_postgresql_project }}"
+    pod: "{{ postgresql_pod.resources[0].metadata.name }}"
+    command: >
+      bash -c "
+        mkdir -p /pgsqldata/os1db_tbs;
+        chown postgres:postgres /pgsqldata/os1db_tbs;
+      "
+  register: command_status
+  failed_when: command_status.rc != 0 and command_status.stderr is not search('.*File exists.*')
+
+- name: OS1DB DB
+  kubernetes.core.k8s_exec:
+    namespace: "{{ cp4ba_postgresql_project }}"
+    pod: "{{ postgresql_pod.resources[0].metadata.name }}"
+    command: >
+      bash -c "
+        psql postgresql://postgres:$POSTGRES_PASSWORD@localhost:5432 <<-EOF
+        -- create user os1db
+        CREATE USER os1db WITH PASSWORD '{{ cp4ba_postgresql_universal_password }}';
+
+        -- create tablespace for os1db
+        CREATE TABLESPACE os1db_tbs OWNER os1db LOCATION '/pgsqldata/os1db_tbs';
+        GRANT CREATE ON TABLESPACE os1db_tbs TO os1db;
+
+        -- create database os1db
+        CREATE DATABASE os1db OWNER os1db TABLESPACE os1db_tbs TEMPLATE template0 ENCODING UTF8;
+
+        -- Connect to your database and create schema
+        \c os1db;
+        CREATE SCHEMA IF NOT EXISTS os1db AUTHORIZATION os1db;
+        GRANT ALL ON SCHEMA os1db TO os1db;
+
+        -- create a schema for os1db and set the default
+        -- connect to the respective database before executing the below commands
+        SET ROLE os1db;
+        ALTER DATABASE os1db SET search_path TO os1db;
+        REVOKE CONNECT ON DATABASE os1db FROM PUBLIC;
+      EOF"
+  register: command_status

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-core/tasks/postdeploy/ads.yml

@@ -65,7 +65,7 @@
 
 - name: Get groups
   ansible.builtin.uri:
-    url: "https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/usermgmt/v2/groups"
+    url: "https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/usermgmt/v4/groups"
     method: GET
     headers:
       Authorization: "Bearer {{ zen_token }}"

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-core/tasks/postdeploy/fncm.yml

@@ -27,7 +27,7 @@
 
 - name: Build OS list
   ansible.builtin.set_fact:
-    os_list: ["CONTENT"]
+    os_list: ["OS1"]
 
 - name: Add IER to OS list
   ansible.builtin.set_fact:
@@ -50,6 +50,14 @@
     os_list: "{{ os_list + ['DEVOS1'] }}"
   when: _current_cp4ba_cluster.cp4ba.patterns.document_processing.enabled
 
+- name: Setup FNCM ASA storage policy for object stores
+  ansible.builtin.include_tasks: fncm-asa-storage-policy.yml
+  with_items: "{{ os_list }}"
+
+- name: Add CONTENT to OS list
+  ansible.builtin.set_fact:
+    os_list: "{{ os_list + ['CONTENT'] }}"
+
 - name: Enable DYNAMIC CBR Summary for Simple Search
   ansible.builtin.uri:
     url: "https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/content-services-graphql/graphql"
@@ -83,10 +91,6 @@
   failed_when: "'errors' in graphql_response.content"
   with_items: "{{ os_list }}"
 
-- name: Setup FNCM Subscription for ECM Content event
-  ansible.builtin.include_tasks: fncm-asa-storage-policy.yml
-  with_items: "{{ os_list }}"
-
 - name: Set usage entry
   ansible.builtin.include_role:
     name: usage
@@ -125,7 +129,9 @@
 
       - GraphQL endpoint: https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/content-services-graphql/graphql
 
-      - CONTENT Desktop: https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/icn/navigator/?desktop=CONTENT
+      - CONTENT Desktop: https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/icn/navigator/?desktop=CONTENT (Uses Database storage policy)
+
+      - OS1 Desktop: https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/icn/navigator/?desktop=OS1 (Uses File system storage policy)
 
       - Task Manager API endpoint: https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/tm/api/v1
 
@@ -157,7 +163,7 @@
 
       ```
 
-      ## MCP Server configuration for watsonx Orchestrate
+      ## MCP Server configuration for watsonx Orchestrate for OS1 object store
 
       Based on https://github.com/ibm-ecm/ibm-content-services-mcp-server
 
@@ -171,7 +177,7 @@
 
         --entries SERVER_URL=https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/content-services-graphql/graphql \\
 
-        --entries OBJECT_STORE=CONTENT \\
+        --entries OBJECT_STORE=OS1 \\
 
         --entries ZENIAM_ZEN_URL=https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/v1/preauth/validateAuth \\
 
@@ -197,4 +203,40 @@
 
         --app-id core-cs-mcp-server-connection
 
+      orchestrate toolkits add --kind mcp \\
+
+        --name property-extraction-and-classification-cs-mcp-server \\
+
+        --description \"property-extraction-and-classification-cs-mcp-server\" \\
+
+        --command \"uvx --from git+https://github.com/ibm-ecm/ibm-content-services-mcp-server property-extraction-and-classification-cs-mcp-server\" \\
+
+        --tools \"*\" \\
+
+        --app-id core-cs-mcp-server-connection
+
+      orchestrate toolkits add --kind mcp \\
+
+        --name legal-hold-cs-mcp-server \\
+
+        --description \"legal-hold-cs-mcp-server\" \\
+
+        --command \"uvx --from git+https://github.com/ibm-ecm/ibm-content-services-mcp-server legal-hold-cs-mcp-server\" \\
+
+        --tools \"*\" \\
+
+        --app-id core-cs-mcp-server-connection
+
+      orchestrate toolkits add --kind mcp \\
+
+        --name ai-document-insight-cs-mcp-server \\
+
+        --description \"ai-document-insight-cs-mcp-server\" \\
+
+        --command \"uvx --from git+https://github.com/ibm-ecm/ibm-content-services-mcp-server ai-document-insight-cs-mcp-server\" \\
+
+        --tools \"*\" \\
+
+        --app-id core-cs-mcp-server-connection
+
       "

automation-roles/50-install-cloud-pak/cp4ba/cp4ba-core/tasks/postdeploy/odm.yml

@@ -27,7 +27,7 @@
 
 - name: Get groups
   ansible.builtin.uri:
-    url: "https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/usermgmt/v2/groups"
+    url: "https://cpd-{{ cp4ba_project_name }}.{{ apps_endpoint_domain }}/usermgmt/v4/groups"
     method: GET
     headers:
       Authorization: "Bearer {{ zen_token }}"