Create the configuration files that define deployment settings, model connections, and optional authentication integrations before installing IBM Bob on-premises.

Note:

Plan certificate trust before installation. Decide whether users will access Bob through a customer-provided certificate that is already trusted by workstation trust stores, or through the default self-signed certificate authority (CA) generated during installation.

The bob-ide and bob-shell clients cannot communicate with the Bob backend until the certificate presented by the external endpoint is trusted by the client workstation. Establish your certificate and CA distribution strategy before exposing the service to users.

For more information, see TLS certificates. If you choose a customer-managed certificate, apply it after installation using the bobctl setup-route command.

The following configurations must be reviewed before running the installation:

Cluster installation configuration

Model configuration

LDAP configuration

Configure the cluster installation

The config.yaml file contains the deployment settings used by bobctl. Review and customize this file before running any installation commands.

Create a working configuration file from the provided template:

cp config-template.yaml config.yaml

Update the values in config.yaml to match your environment.

Global settings

The global section contains cluster-wide deployment settings.

Field	Default value	Description
`operatorNamespace`	`ibm-bob-operators`	Namespace where the Bob operator is deployed. Created automatically by `bobctl`. Do not create it manually.
`instanceNamespace`	`ibm-bob`	Namespace where the Bob custom resource and workloads are deployed. Created automatically by `bobctl`. Do not create it manually.
`fileStorageClass`	Cluster default	A `ReadWriteMany` storage class used for shared volumes, such as `ocs-storagecluster-cephfs`.
`blockStorageClass`	Cluster default	A `ReadWriteOnce` storage class used for database volumes, such as `ocs-storagecluster-ceph-rbd`.
`imagePullPrefix`	`icr.io`	Registry prefix used for container images. For air-gapped deployments, specify the hostname of your private container registry.
`imagePullSecretName`	`ibm-entitlement-key`	Name of the image pull secret created by the `bobctl install --registry-creds` command.

Bob instance settings

The bob section controls model gateway configuration and optional add-on deployment.

Core settings

Field	Default value	Description
`modelGateway.modelConfig`	None	Path to the model configuration file that defines available model endpoints. Leave empty to use the default configuration.
`modelGateway.secrets.AWS_ACCESS_KEY`	None	AWS access key used to access Amazon Bedrock models.
`modelGateway.secrets.AWS_SECRET_ACCESS_KEY`	None	AWS secret access key used to access Amazon Bedrock models.
`modelGateway.secrets.BOB_AZURE_API_KEY`	None	API key used to access Azure OpenAI models.
`modelGateway.secrets.BOB_GEMINI_CREDENTIALS`	None	Credentials used to access Google Gemini models.

Optional IBM Z add-on settings

The following settings enable IBM Z-specific capabilities. They are not required for a Bob Core deployment. Only enabled add-ons are deployed during installation. Users can access an add-on only when it is installed in the cluster and assigned to them as an entitlement. For more information, see Managing entitlements.

Field	Default value	Description
`rag.enabled`	`false`	Enables the Bob Premium Package for Z (RAG) add-on. When enabled, OpenSearch is automatically included in the deployment.
`zProxy.enabled`	`false`	Enables the Bob Premium Package for Z (Proxy) add-on. Requires `rag.enabled: true`.
`understand.enabled`	`false`	Enables the Z Understand and Refactor add-on. See Z Understand and Refactor.

For a complete list of available configuration options, see the config-template.yaml file.

Warning:

Enabling add-ons increases cluster resource usage. Each enabled add-on deploys additional workloads and increases resource consumption. Before enabling add-ons, review the cluster sizing requirements to verify the cluster has sufficient capacity.

Note:

The config.yaml file does not include certificate configuration settings. Configure external TLS after installation using the bobctl setup-route command. See TLS certificates.

Configure credentials and endpoints

IBM Bob must be able to authenticate to and communicate with the configured inference and guardrail model endpoints. Configure the required credentials and endpoint information before starting the installation.

For detailed instructions, see Configuring the Model Gateway.

Create and update the LDAP configuration file

LDAP integration is configured after the Bob installation completes using the bobctl add-ldap command. No LDAP configuration is required before running bobctl install. However, you can prepare the configuration file in advance so it is ready when user federation is enabled.

To create an LDAP configuration file from the template:

cp config-ldap-template.yaml my-ldap.yaml

Edit the file and specify the details of your LDAP or Active Directory server, including connection information, search settings, and user mappings.

For complete configuration details, see LDAP integration.

Configuration