Perform entitlement check and install latest fixes during cloud-init

[git4rk]

• What software must exist before doing the patching/entitlement (p/e) check
• What software is dynamically installed during p/e:
• What are the inputs to p/e?
  • Hard coded?
  • Dynamic?
• How to handle
  • Success
  • Failure

[git4rk]

Sample code snippet to perform entitlement check/patch the software (this code will not work as is, requires setting right values):

• Params needed:
  • IBM_ID and IBM_ID_PASSWORD
  • IM_INSTALL_DIR (can be hardcoded/generated)
  • KEYSTORE_FILE (can be hardcoded/generated)
  • LOG_FILE (can be hardcoded/generated)

SSLPREF="com.ibm.cic.common.core.preferences.ssl.nonsecureMode=false"
DOWNLOADPREF="com.ibm.cic.common.core.preferences.preserveDownloadedArtifacts=false"
IM_INSTALL_DIR=
KEYSTORE_FILE=
LOG_FILE=

####################################################################
# Create keystore file
####################################################################
$IM_INSTALL_DIR/eclipse/tools/imutilsc saveCredential -passportAdvantage -userName $IBM_ID -userPassword "$IBM_ID_PASSWORD" -secureStorageFile $KEYSTORE_FILE

####################################################################
# Update all packages
####################################################################
echo "Updating all installed packages to latest fixpack level"
echo "$IM_INSTALL_DIR/eclipse/tools/imcl updateAll -repositories https://www.ibm.com/software/repositorymanager/entitled -acceptLicense -log $LOG_FILE -installFixes none -secureStorageFile $KEYSTORE_FILE -preferences $SSLPREF,$DOWNLOADPREF"
"$IM_INSTALL_DIR/eclipse/tools/imcl updateAll -repositories https://www.ibm.com/software/repositorymanager/entitled -acceptLicense -log $LOG_FILE -installFixes none -secureStorageFile $KEYSTORE_FILE -preferences $SSLPREF,$DOWNLOADPREF"

RESULT=$?
echo “RESULT: $RESULT"
if [ $RESULT -ne 0 ]; then
  // Handle failure
fi

[edburns]

AB#1296614

[git4rk]

@edburns @majguo Please review the updated script and let me know if you have any questions.

[majguo]

Thanks @git4rk . Today I tried the updated script and find a problem that I can successfully update all packages with my personal IBMid, which is supposed to fail as my IBMid should be "unentitled".

Here are the reproducible steps:

• Download IBM Installation Manager Install Kit agent.installer.linux.gtk.x86_64_1.9.1005.20210309_1755.zip from FixCentral after signing in with my personal IBMid;
• Deploy an Azure VM with RHEL 8.2 installed using the ARM template (I'll share the VM info in the Slack channel);
• Upload the agent.installer.linux.gtk.x86_64_1.9.1005.20210309_1755.zip to the VM;
• Install IBM Installation Manager using the uploaded install kit in directory /datadrive/IBM/InstallationManager/V1.9

  mkdir -p /datadrive/IBM/InstallationManager/V1.9
  mkdir im_installer
  unzip -q agent.installer.linux.gtk.x86_64_1.9.1005.20210309_1755.zip -d im_installer
  ./im_installer/userinstc -log log_file -acceptLicense -installationDirectory /datadrive/IBM/InstallationManager/V1.9
  

• Run the following commands to install & update IBM tWAS & JDK in directory /datadrive/IBM/WebSphere/ND/V9:

  # Variables
  IBM_ID=<specify_ibm_id>
  IBM_ID_PASSWORD=<specify_ibm_id_pwd>
  SSLPREF="com.ibm.cic.common.core.preferences.ssl.nonsecureMode=false"
  DOWNLOADPREF="com.ibm.cic.common.core.preferences.preserveDownloadedArtifacts=false"
  repositoryUrl=https://www.ibm.com/software/repositorymanager/entitled
  wasNDTraditional=com.ibm.websphere.ND.v90_9.0.5001.20190828_0616
  ibmJavaSDK=com.ibm.java.jdk.v8_8.0.5040.20190808_0919
  
  # Create installation directories
  mkdir -p /datadrive/IBM/WebSphere/ND/V9 && mkdir -p /datadrive/IBM/IMShared
  
  # Install IBM WebSphere Application Server Network Deployment V9 using IBM Instalation Manager
  /datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imutilsc saveCredential -secureStorageFile storage_file \
      -userName "$IBM_ID" -userPassword "$IBM_ID_PASSWORD" -passportAdvantage
  /datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imcl install "$wasNDTraditional" "$ibmJavaSDK" -repositories "$repositoryUrl" \
      -installationDirectory /datadrive/IBM/WebSphere/ND/V9/ -sharedResourcesDirectory /datadrive/IBM/IMShared/ \
      -secureStorageFile storage_file -acceptLicense -preferences $SSLPREF,$DOWNLOADPREF -showProgress
  
  # Update all packages along with entitlement check
  /datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imcl updateAll -repositories "$repositoryUrl" -acceptLicense -log log_file -installFixes none -secureStorageFile storage_file -preferences $SSLPREF,$DOWNLOADPREF -showProgress
  

The expected result is that updating all packages should fail, but it succeeded with the following output:

Updated to com.ibm.java.jdk.v8_8.0.6026.20210226_0840 in the /datadrive/IBM/WebSphere/ND/V9/ directory.
Updated to com.ibm.websphere.ND.v90_9.0.5006.20201109_1605 in the /datadrive/IBM/WebSphere/ND/V9/ directory.

I'm not sure what's the root cause. Here're other questions in my mind which may relate to the issue:

• Is it related to the fact that the IBM Installation Manager Install Kit agent.installer.linux.gtk.x86_64_1.9.1005.20210309_1755.zip is downloaded from FixCentral instead of Passport Advantage?
• Based on this article Determining if a WebSphere Application Server installation is fully-licensed or trial version, I haven't found install.license.runtime.component from /datadrive/IBM/WebSphere/ND/V9/properties/version. Does it mean the installed tWAS is a trial version? Is there any relationship between entitlement check & full licensed/trial version?

Cloud you pls help take a look? Thanks.

[git4rk]

@majguo Entitlement check is not related to the Installation Manager version or where it was downloaded from. Also, entitlement check is not enabled for 9.0.5.6 and older versions. Please use these latest versions to build the image:

wasNDTraditional=com.ibm.websphere.ND.v90_9.0.5007.20210301_1241
ibmJavaSDK=com.ibm.java.jdk.v8_8.0.6026.20210226_0840

To verify the entitlement, you can also run this command with entitled and un-entitled credentials:
/datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imcl listAvailablePackages -cPA -secureStorageFile <storage_file> | grep ND.v90_9.0.5007.
You should only be able to get 9.0.5.7 when you use your entitled IBM id.

[majguo]

@git4rk Thanks for your response. I'll take a look at it today and respond with the update later.

[majguo]

I tried to run your method with Ed's IBMid account (suppose entitled), but failed when I tried to save @edburns ’s IBMid credential to a keystore file:

• Sign into one Azure VM located at East US:

  ssh [email protected], pwd is WasAdmin123456
  

• Running the following commands:

  [email protected]
  IBM_ID_PASSWORD="ed_ibm_id_pwd"
  /datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imutilsc saveCredential -secureStorageFile storage_file_ed -userName "$IBM_ID" -userPassword "$IBM_ID_PASSWORD" -passportAdvantage
  

• The command failed:

  Cannot connect to Passport Advantage.
    - Verify that the user name and password are correct.
    - Verify that you can access the network.
  00:02.75 ERROR [main] com.ibm.cic.agent.core.application.HeadlessApplication run
    saveCredential error
  

We need to triage if the error is caused by:

• Ed's account is locked?
• If not, is there something wrong with Ed's account when connecting to Passport Advantage?

I'll work with @edburns to verify if his account is locked or not first.

[majguo]

@git4rk I'm happy to report that the previous issue was caused by the fact that @edburns 's IBMid was locked. After his IBMid account is unlocked, I'm able to successfully run your suggested command to check entitlement:

• /datadrive/IBM/InstallationManager/V1.9/eclipse/tools/imcl listAvailablePackages -cPA -secureStorageFile <storage_file> | grep ND.v90_9.0.5007

[git4rk]

PR: WASdev/azure.websphere-traditional.image#13