Skip to Main Content
Integration


This is an IBM Automation portal for Integration products. To view all of your ideas submitted to IBM, create and manage groups of Ideas, or create an idea explicitly set to be either visible by all (public) or visible only to you and IBM (private), use the IBM Unified Ideas Portal (https://ideas.ibm.com).


Shape the future of IBM!

We invite you to shape the future of IBM, including product roadmaps, by submitting ideas that matter to you the most. Here's how it works:

Search existing ideas

Start by searching and reviewing ideas and requests to enhance a product or service. Take a look at ideas others have posted, and add a comment, vote, or subscribe to updates on them if they matter to you. If you can't find what you are looking for,

Post your ideas
  1. Post an idea.

  2. Get feedback from the IBM team and other customers to refine your idea.

  3. Follow the idea through the IBM Ideas process.


Specific links you will want to bookmark for future use

Welcome to the IBM Ideas Portal (https://www.ibm.com/ideas) - Use this site to find out additional information and details about the IBM Ideas process and statuses.

IBM Unified Ideas Portal (https://ideas.ibm.com) - Use this site to view all of your ideas, create new ideas for any IBM product, or search for ideas across all of IBM.

ideasibm@us.ibm.com - Use this email to suggest enhancements to the Ideas process or request help from IBM for submitting your Ideas.


Status Functionality already exists
Created by Guest
Created on Apr 30, 2021

Using custom apic-ingress-ca certificates for API Manager GUI

We are running API Connect EUS version on CP4I EUS version on Openshift 4.6.21 on Azure cloud.

As part of our internal security requirements, we wish to replace the default cert-manager generated API Manager GUI (https://apic-mgmt-api-manager-apic.cpi.qa.ocp.tine.no/manager/) certificate "apic-ingress-ca" with a custom certificate which is signed by our internal PKI system. The certificate we wish to use already has a CN=*.cpi.qa.ocp.tine.no which is set on Openshift ingress, in other words, when a user is logging in to API Manager, they shouldn't have to trust multiple certificates in order to be allowed in, not to mention the security risk of using a self-signed IBM generated/cert manager generated certificate in the value chain.

We need this feature/functionality on our EUS/long term release of CP4I in case this fixed in a future version of API Connect.


Example steps for using a custom certificate for common services management ingress endpoint for reference: https://www.ibm.com/support/knowledgecenter/SSGT7J_20.4/cert-manager/3.x.x/cert_mgmt_ingress.html#rep_cs360


Idea priority Urgent
  • Guest
    Reply
    |
    Nov 29, 2022

    Have raised internally. Asking Abu for more detail in slack.

  • Guest
    Reply
    |
    Oct 24, 2022

    Sadly we had to spend a lot of consultant hours to make this work due to poor documentation from the IBM side. Reference PMR TS010780695. Not sure when the documentation will be fixed.

    The official documentation "Bring your own CA Certificate" DOES NOT work - https://www.ibm.com/docs/en/cloud-paks/cp-integration/2022.2?topic=services-using-commonservice-custom-resource

    This is the documentation which works, the second link is not part of CP4I:

    https://www.ibm.com/docs/en/cpfs?topic=operator-replacing-foundational-services-endpoint-certificates

    https://www.ibm.com/docs/en/cloud-paks/1.0?topic=ac-custom-cloud-pak-platform-ui-zen-route-certificates


  • Admin
    Andy Garratt
    Reply
    |
    Oct 21, 2022

    Hi Abu, we're moving this to ''Functionality already exists" as hopefully James's solution is working for you. If this is not the case, please let us know and we'll re-open the idea.

  • Admin
    Andy Garratt
    Reply
    |
    Sep 16, 2022

    Hi Abu, thanks for this update - please let us know how it's going.

  • Guest
    Reply
    |
    Sep 2, 2022

    The storage is no longer an issue. We are soon going to try to apply a custom certificate to common services to see if the API Connect is able to pick them, will keep you posted.

  • Admin
    Andy Garratt
    Reply
    |
    Sep 2, 2022

    Hi Abu - just reviewing this idea - is James's response what you're neeeding?

  • Guest
    Reply
    |
    May 20, 2022

    If you use something like an NFS storage class or rook to provide an RWX storage class it will work on Azure just fine.

    We also now have pre-release instructions for how to work around the need for RWX on any cluster, which I've passed on. This information will be added to the documentation when we're happy that we have sufficiently tested it.

  • Guest
    Reply
    |
    Apr 29, 2022

    Do you know if the RWX for zen is successfully tested by IBM to work on Openshift on Azure cloud?

  • Admin
    Andy Garratt
    Reply
    |
    Apr 29, 2022

    Hi Abu, we are working on reducing the dependency of RWX but there isn't an ETA date at the moment - we'll update this idea when we have one.

  • Guest
    Reply
    |
    Apr 8, 2022

    That should meet the requirement. However, in order to deploy zen, we are waiting for the IBM team to remove the dependency on the zen storage of type RWX (file) as we had huge challenges deploying it on Azure (Azure-files provides RWX). We were told that they may move to using a block storage (RWO) soon, is there an ETA on this?

  • Admin
    Andy Garratt
    Reply
    |
    Apr 8, 2022

    Hi Abu,

    We're reviewing this idea and we believe that this is now available in the "Zen" releases of the cloud pak (June 2021 onwards) - this will also be available in the next EUS/LTS release of the pak.


    Could you confirm if this meets your requirements or if there is anything else needed by your idea?