Configuring IBM Financial Services Workbench

After you completed the installation process you then have to do the initial configuration of IBM Financial Services Workbench to get Solution Designer and Solution Hub up and running. Be aware, that even if all necessary pods are running without this configuration you are not able to work with neither one of the components.

All the configurations mentioned in this chapter are related to Solution Designer and Solution Hub. This chapter is not about the configurations related to deployed projects. You can find this information under Run Time Configuration.

The initial configuration of IBM Financial Services Workbench is done via a REST API called K5 Configurator Controller API. This API provides a Swagger UI for ease-of-use, but you can use the tool of your choice for calling APIs (e.g. cURL, Postman).

<https://k5-configurator>.<domain>

oc get route k5-configurator -n <namespace>

For a new installation at least, the following configuration must be provided:

• ArgoCD: Configures the properties to access ArgoCD service

• Helm Repository: Configures the properties to access the Helm repository

• IAM: Configures the properties to access the Identity and Access Management system ( IAM), respectively Keycloak

• Master Key: Configures the master key, needed to have encryption at rest for some sensitive user data, like Git tokens or API keys

• MongoDB: Configures the connection to the Mongo database, which is used by the Solution Designer

• Audit Binding: Configure connection to the audit logging collector

• S3Storage:Configures properties to access an S3-Storage, which is used as a persistence layer for the k5-marketplace

• Truststore: Updates the truststore, which holds a bunch of certificates, that should be trusted within FSW

• Vault: Configures the properties to access a HashiCorp Vault

These configurations are required to connect to the ArgoCD service.

Use PUT method Update properties for accessing ArgoCD of the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/argocd" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "url": "string",
  "username": "string",
  "password": "string",
  "namespace": "openshift-gitops"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

url, username and password are required to connect to the ArgoCD service. Please use the Route Url as url or ensure that all certificates (whole chain) of the ArgoCD Service are included in the Truststore.

These configurations are required to connect to the Helm repository and to upload helm charts to it.

Use PUT method Update properties for accessing Helm repository of the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/helmrepo" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "url": "string",
  "username": "string",
  "password": "string",
  "uploadUrl": "string",
  "uploadRequestType": "string",
  "uploadFilePattern": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

url, username and password are required to connect to the Helm repository. If your helm repository is not backed by ChartMuseum it is also required to set uploadUrl, uploadFilePattern and uploadRequestType in order to make the following command work:

curl -i --fail -S -u ${username}:${password} ${uploadUrl} ${uploadFilePattern}${helmChartPath}

Consider that a space at the end of uploadFilePattern could be necessary.

Example configuration for a GitLab Helm Repository:

{
  "url": "https://gitlab.company.net/api/v4/projects/123/packages/helm/myrepo",
  "username": "myUsername",
  "password": "myPassword",
  "uploadUrl": "",
  "uploadRequestType": "",
  "uploadFilePattern": ""
}

These configurations are required to connect to the IAM Provider.

Use PUT method Update properties for accessing iam of the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/iam" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "adminUsername": "string",
  "adminPassword": "string",
  "hostname": "string",
  "realm": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

This configuration is necessary for the encryption.

Use PUT method Update properties for the master key in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/masterkey" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "key": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

This information needs to be provided by the customer. There are no further restrictions on the key, but it is recommended to provide a master key that matches the common AES rules.

In the initial state the value is empty, which is why the encryption is failing. Only due to that it is safe in respect of data loss in the initial state.

This configuration is necessary to connect to the Mongo database.

Use PUT method Update properties for accessing solution designer mongodb in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/mongodb" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "connectionString": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

This configuration is necessary to connect to your audit logging collector (e.g. Fluentd). By default, the audit logging is disabled since it is not meant to be used without a connection to an audit logging collector.

Use PUT method Configure connection to the audit logging collector in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/auditlog" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "auditEnabled": true,
  "connectionString": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

Configures properties to access an S3-Storage, which is used as a persistence layer for the K5 Marketplace.

Use PUT method Update properties for accessing s3 storage in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/s3storage" -H "accept: application/json;charset=UTF-8" -H "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "accesskey": "string",
  "secretkey": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

In the initial state the s3 storage is not working, because no access- and secretkey was set. Only due to that it is safe in respect of data loss in the initial state.

Updates the truststore, which holds a bunch of certificates, that should be trusted within IBM Financial Services Workbench.

Use PUT method Update entries within the truststore in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/truststore" -H "accept: application/json;charset=UTF-8" -H  "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "additionalProp1": "string",
  "additionalProp2": "string",
  "additionalProp3": "string"
}

Request Parameters:

Configuration Parameters (body parameters)

The body parameters contain key-value pairs. It is possible to provide the value of each entry as a base64 string, e.g.:

{
  "identity": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSS4uLndVQQpNRW8uLi5RUUQKRXhwLi4udzB5Ck1ERS4uLjJsegpMbU4uLi5sMncvbwpqQkMuLi40b0sKUWMxLi4uPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJLi4uQU1UCkRrUi4uLmxvdwpTakVMLi4uQU1UCkdreC4uLmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t"
}

As an alternative you can provide the PEM certificates as plain text but line breaks have to be replaced with "\n" for the Swagger UI or "" for cURL operations.

An OpenShift token with following permissions must be provided:

• secrets: get, create, update

Configures properties to access a HashiCorp Vault. This configuration is not mandatory.

Use PUT method Update properties for accessing the vault in the Swagger UI or

curl -X PUT "{your-hostname}/api/k5-configurator/v1/configs/vault" -H "accept: application/json;charset=UTF-8" -H "Authorization: Bearer {BearerToken}" -d '{}'

With the following request body (schema):

{
  "url": "string",
  "role": "string"
}

Request Parameters:

An OpenShift bearer token with following permissions must be provided to perform this action:

• secrets: get, create, update

The config-maps-controller in the K5 Configurator Controller API allows configuration of all config maps that are provided through IBM Financial Services Workbench. Config maps allow a very detailed level of control for the components. Any adjustments to the initial values, might have unwanted side effects.

Configuration changes within the config map section is not mandatory. Nevertheless, the most important options are listed below:

• GET List all available config maps: Lists all config maps that can be configured by the k5-configurator API. Includes the names of the config maps and their contents to proceed with different APIs.

• PUT Update an existing config map: Updates the content of a config map.

• DELETE Reset a config map to the initial values of the installation: Resets a config map to the initial values.

• PUT Update a key-value pair in the config map: Updates an existing entry within a config map.

• POST Create a new key-value pair in the config map: Creates a not-existing entry within a config map.

• DELETE Delete a key-value pair in the config map: Removes an entry from a config map.