Prepare your environment

To prepare for Oracle Identity Governance deployment in a Kubernetes environment, complete the following steps:

  1. Check the Kubernetes cluster is ready

  2. Obtain the OIG container image

  3. Setup the code repository to deploy OIG domains

  4. Install the WebLogic Kubernetes Operator

  5. Create a namespace for Oracle Identity Governance

  6. Create a Kubernetes secret for the container registry

  7. Create OIG Domains Using WDT Models

  8. Create OIG Domains Using WLST Scripts

    a. RCU schema creation

    b. Creating Kubernetes secrets for the domain and RCU

    c. Create a Kubernetes persistent volume and persistent volume claim

Check the Kubernetes cluster is ready

As per the Prerequisites a Kubernetes cluster should have already been configured.

  1. Run the following command on the master node to check the cluster and worker nodes are running:

    $ kubectl get nodes,pods -n kube-system
    

    The output will look similar to the following:

    NAME                  STATUS   ROLES    AGE   VERSION
    node/worker-node1     Ready    <none>   17h   v1.28.3+3.el8
    node/worker-node2     Ready    <none>   17h   v1.28.3+3.el8
    node/master-node      Ready    master   23h   v1.28.3+3.el8
    
    NAME                                     READY   STATUS    RESTARTS   AGE
    pod/coredns-66bff467f8-fnhbq             1/1     Running   0          23h
    pod/coredns-66bff467f8-xtc8k             1/1     Running   0          23h
    pod/etcd-master                          1/1     Running   0          21h
    pod/kube-apiserver-master-node           1/1     Running   0          21h
    pod/kube-controller-manager-master-node  1/1     Running   0          21h
    pod/kube-flannel-ds-amd64-lxsfw          1/1     Running   0          17h
    pod/kube-flannel-ds-amd64-pqrqr          1/1     Running   0          17h
    pod/kube-flannel-ds-amd64-wj5nh          1/1     Running   0          17h
    pod/kube-proxy-2kxv2                     1/1     Running   0          17h
    pod/kube-proxy-82vvj                     1/1     Running   0          17h
    pod/kube-proxy-nrgw9                     1/1     Running   0          23h
    pod/kube-scheduler-master                1/1     Running   0          21h
    

Obtain the OIG container image

The OIG Kubernetes deployment requires access to an OIG container image. The image can be obtained in the following ways:

  • Prebuilt OIG container image
  • Build your own OIG container image using WebLogic Image Tool

Prebuilt OIG container image

The latest prebuilt OIG April 2024 container image can be downloaded from Oracle Container Registry. This image is prebuilt by Oracle and includes Oracle Identity Governance 12.2.1.4.0, the April Patch Set Update (PSU) and other fixes released with the Critical Patch Update (CPU) program..

Note: Before using this image you must login to Oracle Container Registry, navigate to Middleware > oig_cpu and accept the license agreement.

You can use this image in the following ways:

  • Pull the container image from the Oracle Container Registry automatically during the OIG Kubernetes deployment.
  • Manually pull the container image from the Oracle Container Registry and then upload it to your own container registry.
  • Manually pull the container image from the Oracle Container Registry and manually stage it on the master node and each worker node.

Build your own OIG container image using WebLogic Image Tool

You can build your own OIG container image using the WebLogic Image Tool. This is recommended if you need to apply one off patches to a Prebuilt OIG container image. For more information about building your own container image with WebLogic Image Tool, see Create or update image.

You can use an image built with WebLogic Image Tool in the following ways:

  • Manually upload them to your own container registry.
  • Manually stage them on the master node and each worker node.

Note: This documentation does not tell you how to pull or push the above images into a private container registry, or stage them on the master and worker nodes. Details of this can be found in the Enterprise Deployment Guide.

Setup the code repository to deploy OIG domains

Oracle Identity Governance domain deployment on Kubernetes leverages the WebLogic Kubernetes Operator infrastructure. For deploying the OIG domains, you need to set up the deployment scripts on the master node as below:

  1. Create a working directory to setup the source code.

    $ mkdir <workdir>
    

    For example:

    $ mkdir /scratch/OIGK8S
    
  2. Download the latest OIG deployment scripts from the OIG repository.

    $ cd <workdir>
    $ git clone https://github.com/oracle/fmw-kubernetes.git --branch release/24.2.1
    

    For example:

    $ cd /scratch/OIGK8S
    $ git clone https://github.com/oracle/fmw-kubernetes.git --branch release/24.2.1
    
  3. Set the $WORKDIR environment variable as follows:

    $ export WORKDIR=<workdir>/fmw-kubernetes/OracleIdentityGovernance
    

    For example:

    $ export WORKDIR=/scratch/OIGK8S/fmw-kubernetes/OracleIdentityGovernance
    
  4. Run the following command and see if the WebLogic custom resource definition name already exists:

    $ kubectl get crd
    

    In the output you should see:

    No resources found in default namespace.
    

    If you see any of the following:

    NAME                      AGE
    clusters.weblogic.oracle  5d
    domains.weblogic.oracle   5d
    

    then run the following command to delete the existing crd’s:

    $ kubectl delete crd clusters.weblogic.oracle
    $ kubectl delete crd domains.weblogic.oracle
    

Install the WebLogic Kubernetes Operator

  1. On the master node run the following command to create a namespace for the operator:

    $ kubectl create namespace <sample-kubernetes-operator-ns>
    

    For example:

    $ kubectl create namespace opns
    

    The output will look similar to the following:

    namespace/opns created
    
  2. Create a service account for the operator in the operator’s namespace by running the following command:

    $ kubectl create serviceaccount -n <sample-kubernetes-operator-ns> <sample-kubernetes-operator-sa>
    

    For example:

    $ kubectl create serviceaccount -n opns op-sa
    

    The output will look similar to the following:

    serviceaccount/op-sa created
    
  3. Run the following helm command to install and start the operator:

    $ cd $WORKDIR
    $ helm install weblogic-kubernetes-operator kubernetes/charts/weblogic-operator \
    --namespace <sample-kubernetes-operator-ns> \
    --set image=ghcr.io/oracle/weblogic-kubernetes-operator:4.1.8 \
    --set serviceAccount=<sample-kubernetes-operator-sa> \
    --set “enableClusterRoleBinding=true” \
    --set "domainNamespaceSelectionStrategy=LabelSelector" \
    --set "domainNamespaceLabelSelector=weblogic-operator\=enabled" \
    --set "javaLoggingLevel=FINE" --wait
    

    For example:

    $ cd $WORKDIR
    $ helm install weblogic-kubernetes-operator kubernetes/charts/weblogic-operator \
    --namespace opns \
    --set image=ghcr.io/oracle/weblogic-kubernetes-operator:4.1.8 \
    --set serviceAccount=op-sa \
    --set "enableClusterRoleBinding=true" \
    --set "domainNamespaceSelectionStrategy=LabelSelector" \
    --set "domainNamespaceLabelSelector=weblogic-operator\=enabled" \
    --set "javaLoggingLevel=FINE" --wait
    

    The output will look similar to the following:

    NAME: weblogic-kubernetes-operator
    LAST DEPLOYED: <DATE>
    NAMESPACE: opns
    STATUS: deployed
    REVISION: 1
    TEST SUITE: None
    
  4. Verify that the operator’s pod and services are running by executing the following command:

    $ kubectl get all -n <sample-kubernetes-operator-ns>
    

    For example:

    $ kubectl get all -n opns
    

    The output will look similar to the following:

    NAME                                             READY   STATUS    RESTARTS   AGE
    pod/weblogic-operator-b7d6df78c-vxnpt            1/1     Running   0          33s
    pod/weblogic-operator-webhook-7996b8b58b-68l8s   1/1     Running   0          33s
    
    NAME                                     TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)             AGE
    service/weblogic-operator-webhook-svc    ClusterIP   10.109.163.130   <none>        8083/TCP,8084/TCP   34s
    
    NAME                                        READY   UP-TO-DATE   AVAILABLE   AGE
    deployment.apps/weblogic-operator           1/1     1            1           33s
    deployment.apps/weblogic-operator-webhook   1/1     1            1           33s
    
    NAME                                                   DESIRED   CURRENT   READY   AGE
    replicaset.apps/weblogic-operator-b7d6df78c            1         1         1       33s
    replicaset.apps/weblogic-operator-webhook-7996b8b58b   1         1         1       33s
    
  5. Verify the operator pod’s log:

    $ kubectl logs -n <sample-kubernetes-operator-ns> -c weblogic-operator deployments/weblogic-operator
    

    For example:

    $ kubectl logs -n opns -c weblogic-operator deployments/weblogic-operator
    

    The output will look similar to the following:

    {"timestamp":"<DATE>","thread":37,"fiber":"","namespace":"","domainUID":"","level":"FINE","class":"oracle.kubernetes.operator.DeploymentLiveness","method":"run","timeInMillis":1678902295852,"message":"Liveness file last modified time set","exception":"","code":"","headers":{},"body":""}
    {"timestamp":"<DATE>","thread":42,"fiber":"","namespace":"","domainUID":"","level":"FINE","class":"oracle.kubernetes.operator.DeploymentLiveness","method":"run","timeInMillis":1678902300853,"message":"Liveness file last modified time set","exception":"","code":"","headers":{},"body":""}
    {"timestamp":"<DATE>","thread":21,"fiber":"","namespace":"","domainUID":"","level":"FINE","class":"oracle.kubernetes.operator.DeploymentLiveness","method":"run","timeInMillis":1678902305854,"message":"Liveness file last modified time set","exception":"","code":"","headers":{},"body":""}
    

Create a namespace for Oracle Identity Governance

  1. Run the following command to create a namespace for the domain:

    $ kubectl create namespace <domain_namespace>
    

    For example:

    $ kubectl create namespace oigns
    

    The output will look similar to the following:

    namespace/oigns created
    
  2. Run the following command to tag the namespace so the WebLogic Kubernetes Operator can manage it:

    $ kubectl label namespaces <domain_namespace> weblogic-operator=enabled
    

    For example:

    $ kubectl label namespaces oigns weblogic-operator=enabled
    

    The output will look similar to the following:

    namespace/oigns labeled
    
  3. Run the following command to check the label was created:

    $ kubectl describe namespace <domain_namespace>
    

    For example:

    $ kubectl describe namespace oigns
    

    The output will look similar to the following:

    Name:         oigns
    Labels:       kubernetes.io/metadata.name=oigns
                  weblogic-operator=enabled
    Annotations:  <none>
    Status:       Active
       
    No resource quota.
    
    No LimitRange resource.
    

Create a Kubernetes secret for the container registry

In this section you create a secret that stores the credentials for the container registry where the OIG image is stored.

If you are not using a container registry and have loaded the images on each of the master and worker nodes, then there is no need to create the registry secret.

  1. Run the following command to create the secret:

    kubectl create secret docker-registry "orclcred" --docker-server=<CONTAINER_REGISTRY> \
    --docker-username="<USER_NAME>" \
    --docker-password=<PASSWORD> --docker-email=<EMAIL_ID> \
    --namespace=<domain_namespace>
    

    For example, if using Oracle Container Registry:

    kubectl create secret docker-registry "orclcred" --docker-server=container-registry.oracle.com \
    --docker-username="user@example.com" \
    --docker-password=password --docker-email=user@example.com \
    --namespace=oigns
    

    Replace <USER_NAME> and <PASSWORD> with the credentials for the registry with the following caveats:

    • If using Oracle Container Registry to pull the OIG container image, this is the username and password used to login to Oracle Container Registry. Before you can use this image you must login to Oracle Container Registry, navigate to Middleware > oig_cpu and accept the license agreement.

    • If using your own container registry to store the OIG container image, this is the username and password (or token) for your container registry.

    The output will look similar to the following:

    secret/orclcred created
    

Create OIG Domains Using WDT Models

If you want to create an OIG domain using WDT models, ignore everything else on this page and move directly to Create OIG Domains Using WDT Models.

Create OIG Domains Using WLST Scripts

If you want to create an OIG domain using WLST scripts, follow the rest of the instructions below.

a. RCU schema creation

b. Creating Kubernetes secrets for the domain and RCU

c. Create a Kubernetes persistent volume and persistent volume claim

RCU schema creation

In this section you create the RCU schemas in the Oracle Database.

Before following the steps in this section, make sure that the database and listener are up and running and you can connect to the database via SQL*Plus or other client tool.

  1. If using Oracle Container Registry or your own container registry for your OIG container image, run the following command to create a helper pod to run RCU:

    $ kubectl run --image=<image_name-from-registry> --image-pull-policy="IfNotPresent" --overrides='{"apiVersion": "v1", "spec":{"imagePullSecrets": [{"name": "orclcred"}]}}' helper -n <domain_namespace> -- sleep infinity
    

    For example:

    $ kubectl run --image=container-registry.oracle.com/middleware/oig_cpu:12.2.1.4-jdk8-ol8-<April`24> --image-pull-policy="IfNotPresent" --overrides='{"apiVersion": "v1","spec":{"imagePullSecrets": [{"name": "orclcred"}]}}' helper -n oigns -- sleep infinity
    

    If you are not using a container registry and have loaded the image on each of the master and worker nodes, run the following command:

    $ kubectl run helper --image <image> -n oigns -- sleep infinity
    

    For example:

    $ kubectl run helper --image oracle/oig:12.2.1.4-jdk8-ol8-<April`24> -n oigns -- sleep infinity
    

    The output will look similar to the following:

    pod/helper created
    
  2. Run the following command to check the pod is running:

    $ kubectl get pods -n <domain_namespace>
    

    For example:

    $ kubectl get pods -n oigns
    

    The output will look similar to the following:

    NAME     READY   STATUS    RESTARTS   AGE
    helper   1/1     Running   0          3m
    

    Note: If you are pulling the image from a container registry it may take several minutes before the pod has a STATUS of 1\1. While the pod is starting you can check the status of the pod, by running the following command:

    $ kubectl describe pod helper -n oigns
    
  3. Run the following command to start a bash shell in the helper pod:

    $ kubectl exec -it helper -n <domain_namespace> -- /bin/bash
    

    For example:

    $ kubectl exec -it helper -n oigns -- /bin/bash
    

    This will take you into a bash shell in the running helper pod:

    [oracle@helper oracle]$
    
  4. In the helper bash shell run the following commands to set the environment:

    [oracle@helper oracle]$ export DB_HOST=<db_host.domain>
    [oracle@helper oracle]$ export DB_PORT=<db_port>
    [oracle@helper oracle]$ export DB_SERVICE=<service_name>
    [oracle@helper oracle]$ export RCUPREFIX=<rcu_schema_prefix>
    [oracle@helper oracle]$ export RCU_SCHEMA_PWD=<rcu_schema_pwd>
    [oracle@helper oracle]$ echo -e <db_pwd>"\n"<rcu_schema_pwd> > /tmp/pwd.txt
    [oracle@helper oracle]$ cat /tmp/pwd.txt
    

    where:

    <db_host.domain> is the database server hostname

    <db_port> is the database listener port

    <service_name> is the database service name

    <rcu_schema_prefix> is the RCU schema prefix you want to set

    <rcu_schema_pwd> is the password you want to set for the <rcu_schema_prefix>

    <db_pwd> is the SYS password for the database

    For example:

    [oracle@helper oracle]$ export DB_HOST=mydatabasehost.example.com
    [oracle@helper oracle]$ export DB_PORT=1521
    [oracle@helper oracle]$ export DB_SERVICE=orcl.example.com
    [oracle@helper oracle]$ export RCUPREFIX=OIGK8S
    [oracle@helper oracle]$ export RCU_SCHEMA_PWD=<password>
    [oracle@helper oracle]$ echo -e <password>"\n"<password> > /tmp/pwd.txt
    [oracle@helper oracle]$ cat /tmp/pwd.txt
    <password>
    <password>
    
  5. In the helper bash shell run the following commands to create the RCU schemas in the database:

    [oracle@helper oracle]$ /u01/oracle/oracle_common/bin/rcu -silent -createRepository -databaseType ORACLE -connectString \
    $DB_HOST:$DB_PORT/$DB_SERVICE -dbUser sys -dbRole sysdba -useSamePasswordForAllSchemaUsers true \
    -selectDependentsForComponents true -schemaPrefix $RCUPREFIX -component OIM -component MDS -component SOAINFRA -component OPSS \
    -f < /tmp/pwd.txt
    

    The output will look similar to the following:

    RCU Logfile: /tmp/RCU<DATE>/logs/rcu.log
    
    Processing command line ....
    Repository Creation Utility - Checking Prerequisites
    Checking Global Prerequisites
    
    
    Repository Creation Utility - Checking Prerequisites
    Checking Component Prerequisites
    Repository Creation Utility - Creating Tablespaces
    Validating and Creating Tablespaces
    Create tablespaces in the repository database
    Repository Creation Utility - Create
    Repository Create in progress.
            Percent Complete: 10
    Executing pre create operations
            Percent Complete: 25
            Percent Complete: 25
            Percent Complete: 26
            Percent Complete: 27
            Percent Complete: 28
            Percent Complete: 28
            Percent Complete: 29
            Percent Complete: 29
    Creating Common Infrastructure Services(STB)
            Percent Complete: 36
            Percent Complete: 36
            Percent Complete: 44
            Percent Complete: 44
            Percent Complete: 44
    Creating Audit Services Append(IAU_APPEND)
            Percent Complete: 51
            Percent Complete: 51
            Percent Complete: 59
            Percent Complete: 59
            Percent Complete: 59
    Creating Audit Services Viewer(IAU_VIEWER)
            Percent Complete: 66
            Percent Complete: 66
            Percent Complete: 67
            Percent Complete: 67
            Percent Complete: 68
            Percent Complete: 68
    Creating Metadata Services(MDS)
            Percent Complete: 76
            Percent Complete: 76
            Percent Complete: 76
            Percent Complete: 77
            Percent Complete: 77
            Percent Complete: 78
            Percent Complete: 78
            Percent Complete: 78
    Creating Weblogic Services(WLS)
            Percent Complete: 82
            Percent Complete: 82
            Percent Complete: 83
            Percent Complete: 84
            Percent Complete: 86
            Percent Complete: 88
            Percent Complete: 88
            Percent Complete: 88
    Creating User Messaging Service(UCSUMS)
            Percent Complete: 92
            Percent Complete: 92
            Percent Complete: 95
            Percent Complete: 95
            Percent Complete: 100
    Creating Audit Services(IAU)
    Creating Oracle Platform Security Services(OPSS)
    Creating SOA Infrastructure(SOAINFRA)
    Creating Oracle Identity Manager(OIM)
    Executing post create operations
    
    Repository Creation Utility: Create - Completion Summary
    
    Database details:
    -----------------------------
    Host Name                                    : mydatabasehost.example.com
    Port                                         : 1521
    Service Name                                 : ORCL.EXAMPLE.COM
    Connected As                                 : sys
    Prefix for (prefixable) Schema Owners        : OIGK8S
    RCU Logfile                                  : /tmp/RCU<DATE>/logs/rcu.log
    
    Component schemas created:
    -----------------------------
    Component                                    Status         Logfile
    
    Common Infrastructure Services               Success        /tmp/RCU<DATE>/logs/stb.log
    Oracle Platform Security Services            Success        /tmp/RCU<DATE>/logs/opss.log
    SOA Infrastructure                           Success        /tmp/RCU<DATE>/logs/soainfra.log
    Oracle Identity Manager                      Success        /tmp/RCU<DATE>/logs/oim.log
    User Messaging Service                       Success        /tmp/RCU<DATE>/logs/ucsums.log
    Audit Services                               Success        /tmp/RCU<DATE>/logs/iau.log
    Audit Services Append                        Success        /tmp/RCU<DATE>/logs/iau_append.log
    Audit Services Viewer                        Success        /tmp/RCU<DATE>/logs/iau_viewer.log
    Metadata Services                            Success        /tmp/RCU<DATE>/logs/mds.log
    WebLogic Services                            Success        /tmp/RCU<DATE>/logs/wls.log
    
    Repository Creation Utility - Create : Operation Completed
    [oracle@helper oracle]$
    
  6. Run the following command to patch schemas in the database:

    This command should be run if you are using an OIG image that contains OIG bundle patches. If using an OIG image without OIG bundle patches, then you can skip this step.

    [oracle@helper oracle]$ /u01/oracle/oracle_common/modules/thirdparty/org.apache.ant/1.10.5.0.0/apache-ant-1.10.5/bin/ant \
    -f /u01/oracle/idm/server/setup/deploy-files/automation.xml \
    run-patched-sql-files \
    -logger org.apache.tools.ant.NoBannerLogger \
    -logfile /u01/oracle/idm/server/bin/patch_oim_wls.log \
    -DoperationsDB.host=$DB_HOST \
    -DoperationsDB.port=$DB_PORT \
    -DoperationsDB.serviceName=$DB_SERVICE \
    -DoperationsDB.user=${RCUPREFIX}_OIM \
    -DOIM.DBPassword=$RCU_SCHEMA_PWD \
    -Dojdbc=/u01/oracle/oracle_common/modules/oracle.jdbc/ojdbc8.jar
    

    The output will look similar to the following:

    Buildfile: /u01/oracle/idm/server/setup/deploy-files/automation.xml
    
  7. Verify the database was patched successfully by viewing the patch_oim_wls.log:

    [oracle@helper oracle]$ cat /u01/oracle/idm/server/bin/patch_oim_wls.log
    

    The output should look similar to below:

    ...
    [sql] Executing resource: /u01/oracle/idm/server/db/oim/oracle/Upgrade/oim12cps4/list/oim12cps4_upg_ent_trg_bkp.sql
    [sql] Executing resource: /u01/oracle/idm/server/db/oim/oracle/Upgrade/oim12cps4/list/oim12cps4_upg_ent_trg_fix.sql
    [sql] Executing resource: /u01/oracle/idm/server/db/oim/oracle/Upgrade/oim12cps4/list/oim12cps4_upg_ent_trg_restore_bkp.sql
    [sql] Executing resource: /u01/oracle/idm/server/db/oim/oracle/Upgrade/oim12cps4/list/oim12cps4_ddl_alter_pwr_add_column.sql
    [sql] 74 of 74 SQL statements executed successfully
    
    BUILD SUCCESSFUL
    Total time: 6 seconds
    
  8. Exit the helper bash shell by issuing the command exit.

Creating Kubernetes secrets for the domain and RCU

  1. Create a Kubernetes secret for the domain using the create-weblogic-credentials script in the same Kubernetes namespace as the domain:

    $ cd $WORKDIR/kubernetes/create-weblogic-domain-credentials
    $ ./create-weblogic-credentials.sh -u weblogic -p <pwd> -n <domain_namespace> -d <domain_uid> -s <kubernetes_domain_secret>
    

    where:

    -u weblogic is the WebLogic username

    -p <pwd> is the password for the WebLogic user

    -n <domain_namespace> is the domain namespace

    -d <domain_uid> is the domain UID to be created. The default is domain1 if not specified

    -s <kubernetes_domain_secret> is the name you want to create for the secret for this namespace. The default is to use the domainUID if not specified

    For example:

    $ cd $WORKDIR/kubernetes/create-weblogic-domain-credentials
    $ ./create-weblogic-credentials.sh -u weblogic -p <password> -n oigns -d governancedomain -s oig-domain-credentials
    

    The output will look similar to the following:

    secret/oig-domain-credentials created
    secret/oig-domain-credentials labeled
    The secret oig-domain-credentials has been successfully created in the oigns namespace.
    
  2. Verify the secret is created using the following command:

    $ kubectl get secret <kubernetes_domain_secret> -o yaml -n <domain_namespace>
    

    For example:

    $ kubectl get secret oig-domain-credentials -o yaml -n oigns
    

    The output will look similar to the following:

    $ kubectl get secret oig-domain-credentials -o yaml -n oigns
    apiVersion: v1
    data:
      password: V2VsY29tZTE=
      username: d2VibG9naWM=
    kind: Secret
    metadata:
      creationTimestamp: "<DATE>"
      labels:
        weblogic.domainName: governancedomain
        weblogic.domainUID: governancedomain
      name: oig-domain-credentials
      namespace: oigns
      resourceVersion: "3216738"
      uid: c2ec07e0-0135-458d-bceb-c648d2a9ac54
    type: Opaque
    
  3. Create a Kubernetes secret for RCU in the same Kubernetes namespace as the domain, using the create-rcu-credentials.sh script:

    $ cd $WORKDIR/kubernetes/create-rcu-credentials
    $ ./create-rcu-credentials.sh -u <rcu_prefix> -p <rcu_schema_pwd> -a sys -q <sys_db_pwd> -d <domain_uid> -n <domain_namespace> -s <kubernetes_rcu_secret>
    

    where:

    -u <rcu_prefix> is the name of the RCU schema prefix created previously

    -p <rcu_schema_pwd> is the password for the RCU schema prefix

    -a <sys_db_user> is the database user with sys dba privilege

    -q <sys_db_pwd> is the sys database password

    -d <domain_uid> is the domain_uid that you created earlier

    -n <domain_namespace> is the domain namespace

    -s <kubernetes_rcu_secret> is the name of the rcu secret to create

    For example:

    $ cd $WORKDIR/kubernetes/create-rcu-credentials
    $ ./create-rcu-credentials.sh -u OIGK8S -p <password> -a sys -q <password> -d governancedomain -n oigns -s oig-rcu-credentials
    

    The output will look similar to the following:

    secret/oig-rcu-credentials created
    secret/oig-rcu-credentials labeled
    The secret oig-rcu-credentials has been successfully created in the oigns namespace.
    
  4. Verify the secret is created using the following command:

    $ kubectl get secret <kubernetes_rcu_secret> -o yaml -n <domain_namespace>
    

    For example:

    $ kubectl get secret oig-rcu-credentials -o yaml -n oigns
    

    The output will look similar to the following:

    apiVersion: v1
    data:
      password: V2VsY29tZTE=
      sys_password: V2VsY29tZTE=
      sys_username: c3lz
      username: T0lHSzhT
    kind: Secret
    metadata:
      creationTimestamp: "<DATE>"
      labels:
        weblogic.domainName: governancedomain
        weblogic.domainUID: governancedomain
      name: oig-rcu-credentials
      namespace: oigns
      resourceVersion: "3217023"
      uid: ce70b91a-fbbc-4839-9616-4cc2c1adeb4f
    type: Opaque
    

Create a Kubernetes persistent volume and persistent volume claim

As referenced in Prerequisites the nodes in the Kubernetes cluster must have access to a persistent volume such as a Network File System (NFS) mount or a shared file system.

A persistent volume is the same as a disk mount but is inside a container. A Kubernetes persistent volume is an arbitrary name (determined in this case, by Oracle) that is mapped to a physical volume on a disk.

When a container is started, it needs to mount that volume. The physical volume should be on a shared disk accessible by all the Kubernetes worker nodes because it is not known on which worker node the container will be started. In the case of Identity and Access Management, the persistent volume does not get erased when a container stops. This enables persistent configurations.

The example below uses an NFS mounted volume (<persistent_volume>/governancedomainpv). Other volume types can also be used. See the official Kubernetes documentation for Volumes.

Note: The persistent volume directory needs to be accessible to both the master and worker node(s). In this example /scratch/shared/governancedomainpv is accessible from all nodes via NFS.

  1. Make a backup copy of the create-pv-pvc-inputs.yaml file and create required directories:

    $ cd $WORKDIR/kubernetes/create-weblogic-domain-pv-pvc
    $ cp create-pv-pvc-inputs.yaml create-pv-pvc-inputs.yaml.orig
    $ mkdir output
    $ mkdir -p <persistent_volume>/governancedomainpv
    $ sudo chown -R 1000:0 <persistent_volume>/governancedomainpv
    

    For example:

    $ cd $WORKDIR/kubernetes/create-weblogic-domain-pv-pvc
    $ cp create-pv-pvc-inputs.yaml create-pv-pvc-inputs.yaml.orig
    $ mkdir output
    $ mkdir -p /scratch/shared/governancedomainpv
    $ sudo chown -R 1000:0 /scratch/shared/governancedomainpv
    
  2. On the master node run the following command to ensure it is possible to read and write to the persistent volume:

    cd <persistent_volume>/governancedomainpv
    touch file.txt
    ls filemaster.txt
    

    For example:

    cd /scratch/shared/governancedomainpv
    touch filemaster.txt
    ls filemaster.txt
    

    On the first worker node run the following to ensure it is possible to read and write to the persistent volume:

    cd /scratch/shared/governancedomainpv
    ls filemaster.txt
    touch fileworker1.txt
    ls fileworker1.txt
    

    Repeat the above for any other worker nodes e.g fileworker2.txt etc. Once proven that it’s possible to read and write from each node to the persistent volume, delete the files created.

  3. Navigate to $WORKDIR/kubernetes/create-weblogic-domain-pv-pvc:

    $ cd $WORKDIR/kubernetes/create-weblogic-domain-pv-pvc
    

    and edit the create-pv-pvc-inputs.yaml file and update the following parameters to reflect your settings. Save the file when complete:

    baseName: <domain>
    domainUID: <domain_uid>
    namespace: <domain_namespace>
    weblogicDomainStorageType: NFS
    weblogicDomainStorageNFSServer: <nfs_server>
    weblogicDomainStoragePath: <physical_path_of_persistent_storage>
    weblogicDomainStorageSize: 10Gi
    

    For example:

    # The base name of the pv and pvc
    baseName: domain
    
    # Unique ID identifying a domain.
    # If left empty, the generated pv can be shared by multiple domains
    # This ID must not contain an underscope ("_"), and must be lowercase and unique across all domains in a Kubernetes cluster.
    domainUID: governancedomain
    
    # Name of the namespace for the persistent volume claim
    namespace: oigns
    
    # Persistent volume type for the persistent storage.
    # The value must be 'HOST_PATH' or 'NFS'.
    # If using 'NFS', weblogicDomainStorageNFSServer must be specified.
    weblogicDomainStorageType: NFS
    
    # The server name or ip address of the NFS server to use for the persistent storage.
    # The following line must be uncomment and customized if weblogicDomainStorateType is NFS:
    weblogicDomainStorageNFSServer: mynfsserver
    
    # Physical path of the persistent storage.
    # When weblogicDomainStorageType is set to HOST_PATH, this value should be set the to path to the
    # domain storage on the Kubernetes host.
    # When weblogicDomainStorageType is set to NFS, then weblogicDomainStorageNFSServer should be set
    # to the IP address or name of the DNS server, and this value should be set to the exported path
    # on that server.
    # Note that the path where the domain is mounted in the WebLogic containers is not affected by this
    # setting, that is determined when you create your domain.
    # The following line must be uncomment and customized:
    weblogicDomainStoragePath: /scratch/shared/governancedomainpv
         
    # Reclaim policy of the persistent storage
    # The valid values are: 'Retain', 'Delete', and 'Recycle'
    weblogicDomainStorageReclaimPolicy: Retain
    
    # Total storage allocated to the persistent storage.
    weblogicDomainStorageSize: 10Gi
    
  4. Execute the create-pv-pvc.sh script to create the PV and PVC configuration files:

    $ ./create-pv-pvc.sh -i create-pv-pvc-inputs.yaml -o output
    

    The output will be similar to the following:

    Input parameters being used
    export version="create-weblogic-sample-domain-pv-pvc-inputs-v1"
    export baseName="domain"
    export domainUID="governancedomain"
    export namespace="oigns"
    export weblogicDomainStorageType="NFS"
    export weblogicDomainStorageNFSServer="mynfsserver"
    export weblogicDomainStoragePath="/scratch/shared/governancedomainpv"
    export weblogicDomainStorageReclaimPolicy="Retain"
    export weblogicDomainStorageSize="10Gi"
    
    Generating output/pv-pvcs/governancedomain-domain-pv.yaml
    Generating output/pv-pvcs/governancedomain-domain-pvc.yaml
    The following files were generated:
      output/pv-pvcs/governancedomain-domain-pv.yaml
      output/pv-pvcs/governancedomain-domain-pvc.yaml
    
    Completed
    
  5. Run the following to show the files are created:

    $ ls output/pv-pvcs
    create-pv-pvc-inputs.yaml  governancedomain-domain-pv.yaml  governancedomain-domain-pvc.yaml
    
  6. Run the following kubectl command to create the PV and PVC in the domain namespace:

    $ kubectl create -f output/pv-pvcs/governancedomain-domain-pv.yaml -n <domain_namespace>
    $ kubectl create -f output/pv-pvcs/governancedomain-domain-pvc.yaml -n <domain_namespace>
    

    For example:

    $ kubectl create -f output/pv-pvcs/governancedomain-domain-pv.yaml -n oigns
    $ kubectl create -f output/pv-pvcs/governancedomain-domain-pvc.yaml -n oigns
    

    The output will look similar to the following:

    persistentvolume/governancedomain-domain-pv created
    persistentvolumeclaim/governancedomain-domain-pvc created
    
  7. Run the following commands to verify the PV and PVC were created successfully:

    $ kubectl describe pv <pv_name> 
    $ kubectl describe pvc <pvc_name> -n <domain_namespace>
    

    For example:

    $ kubectl describe pv governancedomain-domain-pv 
    $ kubectl describe pvc governancedomain-domain-pvc -n oigns
    

    The output will look similar to the following:

    $ kubectl describe pv governancedomain-domain-pv
       
    Name:            governancedomain-domain-pv
    Labels:          weblogic.domainUID=governancedomain
    Annotations:     pv.kubernetes.io/bound-by-controller: yes
    Finalizers:      [kubernetes.io/pv-protection]
    StorageClass:    governancedomain-domain-storage-class
    Status:          Bound
    Claim:           oigns/governancedomain-domain-pvc
    Reclaim Policy:  Retain
    Access Modes:    RWX
    VolumeMode:      Filesystem
    Capacity:        10Gi
    Node Affinity:   <none>
    Message:
    Source:
        Type:      NFS (an NFS mount that lasts the lifetime of a pod)
        Server:    mynfsserver
        Path:      /scratch/shared/governancedomainpv
        ReadOnly:  false
    Events:        <none>
    
    $ kubectl describe pvc governancedomain-domain-pvc -n oigns
    
    Name:          governancedomain-domain-pvc
    Namespace:     oigns
    StorageClass:  governancedomain-domain-storage-class
    Status:        Bound
    Volume:        governancedomain-domain-pv
    Labels:        weblogic.domainUID=governancedomain
    Annotations:   pv.kubernetes.io/bind-completed: yes
                   pv.kubernetes.io/bound-by-controller: yes
    Finalizers:    [kubernetes.io/pvc-protection]
    Capacity:      10Gi
    Access Modes:  RWX
    VolumeMode:    Filesystem
    Mounted By:    <none>
    Events:        <none>
    

    You are now ready to create the OIG domain as per Create OIG Domains