As we posted earlier on this blog here, IBM PureApplication firmware version 2.2.6.0 was released just over a month ago. Exactly one week ago IBM launched IBM Cloud Pak System, which builds on IBM PureApplication and ships with firmware version 2.2.3.0. Existing IBM PureApplication clients can upgrade to 2.2.6.0 or 2.3.0.0, from a technical point there are no differences.
Both these firmware versions have one thing in common though, and that is a significant focus on making these appliances more secure. IBM published this support document, detailing the APARs and security fixes included in firmware version 2.2.6.0. You can see that 30 CVEs (Common Vulnerabilities and Exposures) were addressed. This is good news, however there is one thing that clients should be aware of prior to planning a firmware upgrade to 2.2.6.0 or higher.
IBM addressed CVE-2019-4235 by enforcing a password policy on all password parameters used by Virtual System Patterns. At deployment time of a Virtual System Pattern, the system simply mandates that every password parameters contains at least 8 characters with a minimum of one alphanumeric character and one number. If one or more passwords do not meet this policy, it will block the deployment with one of these two errors:
CMPRE0015E: The given password violates password policy for pattern deployments. Password must contain at least one numeric and one alphabet characters
CMPRE0016E: The given password violates password policy for pattern deployments. The password length must be at least 8.
Unfortunately this password policy cannot be disabled, configured or customised today. Therefor IBM strongly recommends client to evaluate any password parameters they use in their existing Virtual System Patterns prior to upgrading to 2.2.6.0 or higher.
Note: Password parameters can be found in a Virtual System Patterns itself, but also in Script Packages or Software Components used in that Virtual System Pattern.
On Friday 31st May 2019, IBM released firmware version 2.2.6.0 for PureApplication System, PureApplication Platform and PureApplication Software. Among many enhancements, this firmware version also comes with new patterns to deploy, which are:
IBM Cloud Automation Manager V3.1.2.0
Red Hat OpenShift Container Platform pattern v1.0.0.0
One of the biggest changes bought by PureApplication System and PureApplication Platform on Intel is the support of VMWare vCenter and ESXi v6.5.
You can find more details on the firmware release here, including a list of included APARs.
This firmware version comes with a full refresh of the hardware firmware for PureApplication System and PureApplication Platform clients. For example, clients using a W3550 PureApplication Platform machine can find details about the new hardware firmware here.
With the above in mind, there is even more reason for clients to start planning this firmware upgrade. Here’s a screen capture for your reference:
IBM released IBM Cloud Private 3.1.2 on 13th February, see also this blog post. We recently documented here on this blog how to deploy ICP 3.1.1 on PureApplication 2.2.5, so many of you are probably wondering how to deploy ICP 3.1.2 with that pattern type on PureApplication.
The good news is that you can deploy ICP 3.1.2 with that pattern type, however there are a number of known limitations that IBM is addressing as we speak. Please refer to this link for details on those limitations as well as some workarounds.
This blog post was written by Jonathan Deberdt (jonathan.deberdt@fr.ibm.com) and Hendrik van Run (hvanrun@nl.ibm.com).
As briefly mentioned in this blog post, the new 2.2.5.3 firmware for PureApplication includes a new IBM Cloud Private (ICP) pattern type. With the ICP pattern type 1.0.1.2, you can now install ICP 3.1.0 or ICP 3.1.1. You can read more about that below. However, what is also very important to know is that you do not need to have 2.2.5.3 firmware installed in order to use this new ICP pattern type. Clients who are running 2.2.5.1 or 2.2.5.2 can simply download the actual pattern type from IBM FixCentral and get IBM Cloud Private up and running!
Uploading the ICP 1.0.1.2 Pattern Type and ICP 3.1.1 Enterprise Edition binaries
Import ICP 1.0.1.2 and Docker 1.0.7.0 Pattern Types
In IBM Fix Central, select “PureApplication Software” as product, “2.2.5.3” as version and “all” as platform. Filter down the results by setting fix type to “group_”, or look for the 2.2.5.3 group fix for your platform in the list.
Note: You can also use this link to directly access the list of fixes:
It can be more convenient to just download the ICP 1.0.1.2 and Docker 1.0.7.0 pattern types as it’s just 1.34 MB in size for ICP and 146.5 MB for Docker (whereas the group fix is typically 40 GB). In order to do so, click “Show contained fixes” and look for the ICP 1.0.1.2 pattern type and Docker 1.0.7.0 as shown below.
Once downloaded, you can simply import the ICP 1.0.1.2 pattern type and the Docker 1.0.7.0 pattern type as documented here in the IBM Knowledge Center. Once imported successfully, you should see the new ICP pattern type as shown below (and likewise for the Docker 1.0.7.0 pattern type).
Note: Do not forget to enable both the ICP 1.0.1.2 and Docker 1.0.7.0 pattern types!
Downloading the ICP 3.1.1 binaries
The Docker 1.0.7.0 pattern type already contains the required Docker binaries but the ICP 1.0.1.2 does not contain the ICP binaries that needs to be downloaded from IBM and then uploaded to PureApplication separately.
Assuming you are entitled, you can download ICP 3.1.1 Enterprise Edition binaries from IBM Passport Advantage. Search for part number CNZ4WEN:
IBM Cloud Private 3.1.1 for Linux (x86_64) Docker (CNZ4WEN) Size 10,535MB Date posted 11 Jan 2019
Note: You can also download ICP 3.1.1 Community Edition free of charge from Dockerhub, refer to this post on the IBM Cloud Private community for more details. Note that the Community Edition restricts the ICP topologies you can deploy as it only supports a single master node.
Uploading ICP 3.1.1 binaries to PureApplication StoreHouse
IBM provides, as part of pattern types, a utility script called “phuploader”, available both for Linux (*.sh) and Windows (*.bat). If you don’t have it, you can also find it as part of the ICP 1.0.1.2 pattern type. To get it, you must extract the ICP pattern type file (icp-1.0.1.2.tgz) and some embedded archives. You should find it in icp-1.0.1.2/plugins/plugin.com.ibm.icp-1.0.1.2/parts/icp.scripts/scripts/ICp/shell/binaries/ee (or icp-1.0.1.2/plugins/plugin.com.ibm.icp-1.0.1.2/parts/icp.scripts/scripts/ICp/shell/binaries/ce for the Community Edition).
Copy the following files in the same directory where you have downloaded the ICP 3.1.1 binaries:
phupload-config.json
phuploader.bat
phuploader.py
phuploader.sh
readme.md
Edit or review the phupload-config.json file as follows:
Should you get the error “SSL: CERTIFICATE_VERIFY_FAILED”, it means that you are most likely running an older version of the phuploader.py script (which does not support self-signed SSL certificates on the PSM). In this case, get the version provided with ICP pattern type as described earlier.
Assuming you are use the correct version of phuploader.py, it should work as shown below.
Pattern Name: IBM Cloud Private Pattern Type
****** IBM Pattern Hub upload utility ******
*********************************************
Pattern: IBM Cloud Private Pattern Type
Version: 1.0.1.2
*********************************************
Checking pattern binaries
Verifying files
config_sum=2d0820440b21da1e8fcb0412f7fd9ddf
sample_storehouse_path=https://pureApplicationHostname/storehouse/admin/files/ICp/ee/ibm-cloud-private-x86_64-3.1.1.tar.gz?meta
Verifying PureApplication pattern binaries
1) ibm-cloud-private-x86_64-3.1.1.tar.gz: found locally but not on server
Uploading needed files...
- ibm-cloud-private-x86_64-3.1.1.tar.gz uploaded
Verifying files on remote PureApplication
Verifying files
config_sum=2d0820440b21da1e8fcb0412f7fd9ddf
sample_storehouse_path=https://pureApplicationHostname/storehouse/admin/files/ICp/ee/ibm-cloud-private-x86_64-3.1.1.tar.gz?meta
response_md5sum=2d0820440b21da1e8fcb0412f7fd9ddf
file_sum=2d0820440b21da1e8fcb0412f7fd9ddf
config_sum=2d0820440b21da1e8fcb0412f7fd9ddf
- MD5 match: ibm-cloud-private-x86_64-3.1.1.tar.gz
Verifying PureApplication pattern binaries
1) ibm-cloud-private-x86_64-3.1.1.tar.gz: verified successfully
All binaries verified successfully.
Make sure that the “response_md5sum” and the “file_sum” values are equal. If it’s not the case, delete the file from the storehouse using the curl command below and then retry to upload with phuploader:
The response_md5sum also matches the checksum that is visible in the PureApp Storehouse Browser.
Default ICP 3.1.1 patterns
The ICP 1.0.1.2 pattern type includes several sample patterns that provide different topologies for ICP 3.1.1:
“IBM Cloud private v1.0.1.2”: installs IBM Cloud Private CE or EE, each node on a separate VM, with 3 worker nodes. The cluster is deployed in Non HA mode but is ready for HA. If you wish to deploy cluster in HA mode, add 3 or 5 Master nodes and Proxy nodes using scaling policy while deploying the pattern. There’s no storage provider included in this pattern.
“IBM Cloud private – GlusterFS v1.0.1.2”: same as previous but adds 3 VMs for GlusterFS.
“IBM Cloud Private – GPFS v1.0.1.2”: Set up high availability (HA) IBM Cloud Private master, worker, and proxy nodes in your cluster. The Master and Proxy nodes are installed on separate virtual machines. GPFS is used on worker nodes to define hostPath for Persistent Volumes. GPFS is also used to provide shared storage across your master nodes for /var/log/audit, /var/lib/registry and /var/lib/icp/audit, to be used by the private image registry. You must have a GPFS Shared Service instance deployed in the same environment profile with this deployment.
“IBM Cloud Private – Multi node HA cluster with Storage Provider v1.0.1.2”: same as “IBM Cloud private – GlusterFS v1.0.1.2” but HA is enabled by default.
“IBM Cloud private Boot Master Proxy same host v1.0.1.2”: installs ICP CE or EE on 3 VMs. The Boot, Master and Proxy nodes are deployed on the same VM. There is one additional VM for Vulnerability Advisor and one more VM for Worker. You can add VA or Worker nodes at deployment time using the scaling policy.
“IBM Cloud private Master Proxy same host v1.0.1.2”: same as the first pattern but Master and Proxy nodes are deployed on the same VM.
“IBM Cloud Private Master Proxy same host – GPFS v1.0.1.2”: same as 3rd pattern but Master and Proxy nodes are deployed on the same VM.
“IBM Cloud private Test Environment v1.0.1.2”: sets up a test environment for IBM Cloud Private ce or ee by using a single host. A single host environment has boot, master, management, worker, and proxy nodes, all running on the same VM.
Note: By default the ICP patterns specify a relatively large number of virtual CPUs and amount of memory for the VMs. We recommend that you consider reducing these, please always refer to the recommendations for IBM Cloud Private 3.1 as documented in the IBM Cloud Private Knowledge Center here.
As you can read in more detail here, IBM Support has been in the process of transforming. As a result, clients using PureApplication Platform, PureApplication System or PureApplication Software sometimes struggle to find the correct place to open a ticket with IBM Support. Those products continue to use the IBM Service Request and PMR tool, unlike most other IBM (cloud) software products which have transitioned to IBM Support Cases.
When opening tickets with IBM Support for PureApplication, clients should use the links highlighted below to go directly to the IBM Service Request and PMR tool.
Today IBM released firmware version 2.2.5.3 for PureApplication System, PureApplication Platform and PureApplication Software. Amongst many things, this firmware version also comes with a new pattern to deploy IBM Cloud Private 3.1.1. You can find more details on the firmware release here, including a list of included APARs.
This firmware version comes with a full refresh of the hardware firmware for PureApplication System and PureApplication Platform clients. For example, clients using a W3550 PureApplication Platform machine can find details about the new hardware firmware here.
With the above in mind, there is even more reason for clients to start planning this firmware upgrade!
This Blog post is relevant for clients using Workload Environments on PureApplication platform. A Workload Environment is an isolated instance of PureApplication Software that runs on a Virtual Manager Cloud Group. In this blog post, we will explain how to perform an upgrade of the firmware version of a Workload Environment on the PureApplication Platform. Effectively this implies an upgrade to a newer version of PureApplication Software that is installed within that Workload Environment. In particular, upgrading Workload Environments from 2.2.3 or 2.2.4 to 2.2.5 requires a number of additional steps to be completed towards the end of the upgrade process.
Before you begin
Not every version of PureApplication Software is supported on every version of the underlying (physical) PureApplication Platform. Please refer to the table below to confirm your upgrade plans are valid.
PureApplication Platform
PureApplication Software of Workload Environment
Supported?
2.2.3.1
2.2.3.1
Yes
2.2.3.1
2.2.4.0
Yes
2.2.3.1
2.2.5.1
No
2.2.3.1
2.2.5.2
No
2.2.4.0
2.2.4.0
Yes
2.2.4.0
2.2.5.1
No
2.2.4.0
2.2.5.2
No
2.2.5.1
2.2.5.1
Yes
2.2.5.1
2.2.5.2
Yes
2.2.5.2
2.2.5.2
Yes
Download the fixpack for IBM PureApplication Software
You should be able to download the appropriate fixpack for IBM PureApplication Software from IBM FixCentral. Note that your IBMid account needs to be associated with an IBM Subscription and Support contract for IBM PureApplication Software. The links below will take you directly to a number of popular fixpacks:
Note: Each fixpack contains two files that need to be downloaded (.ifp and .chksum). You will have to make sure to make both files available to PureApplication Software in the Workload Environment you intend to upgrade!
Prerequisites
Root password of the Operating System hosting the PureApplication Software installation of the corresponding Workload Environment.
Please ensure that the underling (physical) PureApplication Platform is 2.2.5.x before you proceed with an upgrade of the Workload Environment 2.2.5!
Admin Privileges account for IBM Pureapplication Software.
There is no need to have IBM CE (ibmeng) access for the upgrade.
Downloaded copy of the IBM PureApplication Software fixpack you need
Performing the upgrade
1. Logon with a user that has full administrative permissions within Workload Environment.
2. Add the fixpack to the PureApplication Software installation. Navigate to System > System maintenance and click Add a fix pack. Make sure the .chksum file is also present on the source with the .ifp file.
3. When completed, you should see the new fix pack appear in the list as shown below.
Note: If the Upload fails go to System > Job queue, find the failed job called “fix packs create” and review the errors.
4. It is a best practice to ensure that the PureApplication Software environment is healthy before you start the upgrade. Navigate to System > System Troubleshooting and select System Health Report. Note – This is on PureApplication Software environment.
5. After the Upload the successful and complete. Before you launch the upgrade. Verify the health status of the Pureapplication Software workload enviornment. Navigate to System > System Maintance and click Check as shown below.
6. After the Check completes it will Result if it passed or failed system health for upgrade. If the system health check “fails” Please click on the icon highlighted in yellow below to determine the cause of failure.
Here is an example of an error message:
If your check was successful, you should see the result shown below. Note the green checkmark, you are now ready to apply the fixpack to upgrade your Workload Environment.
7. You can now start the fixpack installation by clicking Update System as shown below.
A window will appear, click OK to proceed with the upgrade.
8. You will be shown the license agreement. Click Accept to start the upgrade.
9. The upgrade should take about 45 to 120 minutes to complete. You can track the progress by monitoring the logs in /var/log/pureapp_software or run the command “psm info all” to verify all the services are up after the upgrade is complete.
Additional steps when upgrading to 2.2.5.1 or higher
PureApplication Software 2.2.5 has introduced support for running multiple Workload Environments within a single Virtual Manager Cloud Group. In prior versions, every Workload Environment required its own dedicated Virtual Manager Cloud Group. To facilitate this, each data store used within a Virtual Manager Cloud Group is now mapped to one specific Workload Environment. So when upgrading from 2.2.4.0 or earlier to 2.2.5.1 or higher, you must manually configure this after the upgrade of the Workload Environment.
To map a data store of the PureApplication Platform to a particular Workload environment, each Workload Environment needs to be given a unique name first. This name must be unique across all Workload Environments on that particular (physical) PureApplication Platform. This is called the “System Unique Name”, which in turn must be mapped to each data store used by that Workload Environment on PureApplication Platform.
1. Configuring “System Unique Name” within Workload Environment. Navigate to System > System settings and expand “Customize Name”. Here you will find the System Unique Name, change it to something that is unique as explained earlier.
2. Mapping data stores of Workload Environment within PureApplication Platform While logged onto the PureApplication Platform interface, navigate to Cloud > Volumes and identify each of the the volumes associated with the particular Workload Environment you upgraded. For each volume, select it and look for the field Associate System. Change that to match the System Unique Name you configured for this Workload Environment earlier.
Select a Volume and scroll down and you will a field Associate System and enter the hostname.
3. Run Discovery within Workload Environment. Go to Hardware –>Storage Resources and click the “discover” icon shown below.
4. Repeat steps 1,2 and 3 for each Workload Environment that you upgraded.
IBM just published a developerWorks article on how to get started with the IBM Cloud Private Pattern for IBM PureApplication. This pattern has been available for some time now and comes free of charge for all IBM PureApplication clients. It can be used to deploy IBM Cloud Private Community Edition and Enterprise Edition, Community Edition is provided free of charge. You can find more details about IBM Cloud Private here on ibm.com.
These security vulnerabilities also impact clients running PureApplication environments. IBM has released two technotes last week, detailing how to mitigate against these security vulnerabilities:
IBM recently shipped PureApplication 2.2.5, in fact 2.2.5.1 became generally available on Friday 13th April. You can read about some of the new features and capabilities here in IBM the Knowledge Center. However I wanted to take the opportunity to provide an update, as not all changes are covered there.
In addition IBM added support for the following within the platform:
Improved VMware license handling The PureApplication Platform comes with built-in VMware licenses for both ESX and vSphere. Even though the VMware licenses are included, those licenses do expire and clients will have to obtain new licenses through VMware (at no cost). IBM has introduced a mechanism to issue events to warn administrators about VMware licenses that are getting close to their expiry date. This helps prevent surprises and gives clients plenty of time to obtain new licenses ahead of time.
Support to increase size of VMFS disks for existing VMs Up until PureApplication 2.2.4, only increasing the size of Block Storage Volume disks attached to VMs was supported. Normal disks (of type VMFS) could not be increased in size, which included the boot disk of each VM. In PureApplication 2.2.5, it is now possible to increase the size of VMFS disks through the UI, which makes the administration of deployed VMs considerably easier.
Note that on this page in the Knowledge Center, IBM specifically states that increasing the size of (internal) Storage Volumes is now also supported for internal VMFS volumes:
“You can resize (expand) internal VMFS, Block, Block Shared or Block VMFS volumes.”
Also refer to this page in the Knowledge Center on how to increase the size of Operating System Volumes for existing VMs.
New version of built-in ITM within System Monitoring shared service The built-in ITM runtime that comes with the System Monitoring shared service used to be on version 6.2.3.5. On Intel based PureApplication 2.2.5 environments, IBM has refreshed this to version 6.3.0.7. This applies to the internal System Monitoring shared service deployment, where the full ITM stack is installed on the PureApplication platform. For external System Monitoring shared service deployments, PureApplication already supported integration with an external ITM stack up to 6.3.0.5.
Note that a similar refresh on Power based PureApplication environments is planned for a future release.
Workload Environment no longer requires a dedicated Virtual Manager Cloud Group Support for Workload Environments was introduced in PureApplication Platform 2.2.3. One drawback was that you had to dedicated a Virtual Manager Cloud Group to each Workload Environment. And since each cloud group must contain at least one compute node, this directly limited the number of Workload Environments that could be deployed. PureApplication Platform 2.2.5 allows multiple Workload Environments to be deployed within the same Virtual Manager Cloud Group. This allows for a more flexibility and a higher number of Workload Environments within a given system’s capacity.
Furthermore a number of new PureApplication patterns have been released in Q1 2018. All these patterns are available to clients who hold licenses for the corresponding IBM software (no subscription to IBM Pattern Hub is required).
IBM Cloud Private 1.0.0.2 for Linux IBM introduced a new version of the IBM Cloud Private pattern, which supports IBM Cloud Private up to 2.1.0.2. IBM Cloud Private Community Edition and Enterprise Edition can be installed with this pattern an a PureApplication environment, on both x86-64 and ppc64le Red Hat Enterprise Linux.
Docker on ppc64le Red Hat Enterprise Linux Previously Docker was only available for x86-64 Red Hat Enterprise Linux on Intel based PureApplication environments. We now also support Docker on ppc64le Red Hat Enterprise Linux, which can run on Power based PureApplication environments.
IBM GPFS 4.2 Supports the latest version of GPFS; note that GPFS is now known as IBM Spectrum Scale.
Load balancer pattern 1.0 As you can read here in the Knowledge Center, the ELB proxy shared service is no longer supported starting with PureApplication 2.2.5. As a replacement IBM has introduced the Load Balancer Pattern Type, which provides the load balancing solution to route and load balance your web applications.
WAS 8.5.5.12, 9.0.0.6, Liberty 17.0.0.4 Support was added for the latest fix packs of WebSphere Network Deployment 8.5.5, 9.0.0 and WebSphere Liberty 17.0.0. PureApplication 2.2.5 firmware comes with the appropriate content for the built-in IBM Installation Manager repository.
IBM Operational Decision Manager (ODM) 8.9.2 IBM ODM 8.9.2 was released on 13 March 2018, refer to the IBM ODM Knowledge Center here for more information regarding the new ODM 8.9.2 PureApplication pattern.
IBM Cloud Pak System 