Understand the roles involved and the four phases required to install IBM Bob on-premises on Red Hat OpenShift Container Platform.

Roles and responsibilities

Role Responsibilities

Cluster administrator Deploys, configures, and maintains Bob. Performs all tasks in this guide: validating cluster prerequisites, mirroring container images, installing and configuring the application, extracting certificates, configuring LDAP federation, and running administrative commands using bobctl, oc, and helm. Requires cluster-admin privileges. Also responsible for configuring and maintaining platform-level security logging, monitoring, and audit controls for the OpenShift environment in accordance with organizational security, compliance, and governance requirements. Security event logging is provided through the underlying OpenShift platform and is not managed by Bob.

User After deployment is complete, uses the endpoint URL and CA certificate (if applicable) provided by the cluster administrator to configure their Bob IDE extension or bob-shell and connect to the deployed instance. See Accessing Bob on-premises.

Installation roadmap

Complete the following phases in order. Each phase must be finished before starting the next.

Verify prerequisites

Installing Bob on-premises on an OpenShift Container Platform (OCP) environment requires:

An OpenShift Container Platform (OCP) cluster
A cluster administrator workstation
Access to required container registries
Supported large language model (LLM) endpoints
Installation configuration files

The installation is performed using the bobctl command-line interface. See Prerequisites.

Prepare configuration files

Before running any installation commands, prepare the required configuration files on your workstation.

Configuration file	Purpose
`config.yaml`	Created from `config-template.yaml`. Defines installation settings such as namespaces, storage classes, registry configuration, and optional Premium Package add-ons. See Configure the cluster installation.
Model gateway configuration	Defines the LLM endpoints that Bob connects to, including inference and guardrail services. See Configure credentials and endpoints.
LDAP configuration file (optional; can be deferred)	Created from `config-ldap-template.yaml`. Configure this file if LDAP federation is required. Can be prepared before installation and applied after the core platform is deployed. See Create and update the LDAP configuration file.
Certificate trust configuration	Determine whether to use a customer-provided TLS certificate or the default self-signed CA. Required because `bob-ide` and `bob-shell` cannot connect until the endpoint certificate is trusted by client workstations. See TLS certificates.

Install Bob

After the configuration files are completed, use bobctl to deploy the operator and Bob services to the cluster. Choose the installation method that matches your network environment:

Method	Use when
Direct installation	The cluster has outbound access to the IBM Container Registry.
Air-gapped (direct mirroring)	Your workstation can access both the internet and the private registry.
Air-gapped (indirect mirroring)	Internet-connected and air-gapped environments are separated and require image transfer between systems.

See Install Bob.

Post-installation setup and user onboarding

After deployment is complete, perform the remaining setup tasks and provide connection details to users.

Role	Task
Cluster administrator	Certificate management: export or configure TLS certificates and distribute any required CA certificates to users.
Cluster administrator	User management: configure LDAP federation or create user accounts in Keycloak.
User	Client onboarding: import the CA certificate if required, configure the IDE extension or `bob-shell` endpoint, and sign in. See Accessing Bob on-premises.

See Post-installation tasks.

Installation overview