Choose the installation method that matches your network environment and deploy IBM Bob to your OpenShift cluster using bobctl.

Before you use any installation method, log in to the target OpenShift cluster with an account that has cluster-admin privileges and verify that the correct cluster context is active:

oc login <api-server> --token=<cluster-admin-token>

Choosing an installation method

Aspect	Connected	Air-gapped (direct mirroring)	Air-gapped (indirect mirroring)
Image source	Pulled directly from IBM Container Registry	Mirrored to an internal registry	Mirrored to an internal registry
Model inference	Hosted or on-premises inference services	On-premises inference services only	On-premises inference services only
Updates	Downloaded directly from external sources	Imported through offline update bundles	Imported through offline update bundles
Certificate issuance	Public certificate authorities (for example, ACME)	Internal or private certificate authorities	Internal or private certificate authorities
Telemetry	Enabled by default (can be disabled)	Disabled	Disabled

Use this method when the OpenShift cluster can directly access the IBM Container Registry. Images are downloaded during installation and no image mirroring is required.

Configure the installation

Create and update the deployment configuration file with values specific to your environment:

cp config-template.yaml config.yaml
# Edit config.yaml with your specific values

For more information, see Configure the cluster installation.

Generate cluster resources

Generate the cluster-scoped resources required for the installation. This lets you review the generated artifacts before they are applied to the cluster.

./bobctl generate-cluster-resources

The command generates the work/cluster-resources.yaml file. Review the file, then apply it to the cluster:

oc apply -f work/cluster-resources.yaml --force-conflicts --server-side

The generated oc apply command is also displayed in the command output.

Install Bob

Deploy Bob using the configuration values and registry credentials:

./bobctl install --registry-creds <username:password> --accept-license

During installation, bobctl creates the required resources and deploys all Bob components into the target namespace.

Option	Required	Description
`--registry-creds <username:password>`	Yes	Registry credentials used to create image pull secrets.
`--accept-license`	Yes	Confirms acceptance of the IBM license terms. Installation does not proceed unless this option is specified.
`--model-config <file>`	No	Path to the model gateway configuration file. If omitted, Bob installs without model access; use `bobctl update-model-config` post-install to add it.
`--dry-run`	No	Displays planned changes without applying them.

Use this method when your workstation can access both the IBM Container Registry and the destination private registry. Images are copied directly between registries without requiring offline transfer.

Mirror images

Mirror the required Bob images from the IBM Container Registry into your private registry:

./bobctl mirror-images \
  --dest-registry <your-registry> \
  --src-creds <username:password> \
  --dest-creds <username:password> \
  --arch amd64

This command copies all required images and updates repository references for the target environment.

Option	Required	Description
`--dest-registry <registry>`	Yes	Destination registry.
`--src-creds <username:password>`	Yes	IBM registry credentials.
`--dest-creds <username:password>`	No	Destination registry credentials.
`--arch amd64`	No	Filters images by architecture.

Verify mirrored images

After mirroring completes, verify that all required images are accessible in the target registry:

./bobctl verify-images \
  --creds <username:password> \
  --arch amd64

bobctl verify-images reads global.imagePullPrefix from config.yaml to locate the target registry. This command cannot be used with the IBM public registry (icr.io).

Option	Description
`--creds <username:password>`	Credentials for the target registry. Use the same value as `--dest-creds` in the `mirror-images` command.
`--arch amd64`	Filters images by cluster architecture.

Generate cluster resources

./bobctl generate-cluster-resources

Review the generated work/cluster-resources.yaml file, then apply it to the cluster:

oc apply -f work/cluster-resources.yaml --force-conflicts --server-side

Install Bob

Update config.yaml to reference your private registry. See Configure the cluster installation.

After the configuration is updated, install the product:

./bobctl install --registry-creds <username:password> --accept-license

To include a model gateway configuration, add --model-config <file>. If omitted, use bobctl update-model-config post-install to add model access. See Configuring the Model Gateway.

Use this method when your workstation cannot access the IBM Container Registry and the private registry at the same time. Images are downloaded on an internet-connected workstation, transferred into the air-gapped environment, and then uploaded to the private registry.

Download images

Run the following command from an internet-connected workstation:

./bobctl download-images \
  --to-dir /path/to/images \
  --src-creds <username:password> \
  --arch amd64

Option	Required	Description
`--to-dir <directory>`	Yes	Local image download location.
`--src-creds <username:password>`	Yes	IBM registry credentials.
`--arch amd64`	No	Architecture filter.

Transfer images

Transfer the downloaded image directory to the air-gapped environment using your organization's approved transfer mechanism, such as removable media or a secure file-transfer appliance.

Upload images to the private registry

./bobctl upload-images \
  --from-dir /path/to/images \
  --dest-registry <your-registry> \
  --dest-creds <username:password>

Option	Required	Description
`--from-dir <directory>`	Yes	Directory containing downloaded images.
`--dest-registry <registry>`	Yes	Target registry.
`--dest-creds <username:password>`	No	Registry credentials.

Verify uploaded images

After uploading completes, verify that all required images are accessible in the target registry:

./bobctl verify-images \
  --creds <username:password> \
  --arch amd64

bobctl verify-images reads global.imagePullPrefix from config.yaml to locate the target registry. This command cannot be used with the IBM public registry (icr.io).

Option	Description
`--creds <username:password>`	Credentials for the target registry. Use the same value as `--dest-creds` in the `upload-images` command.
`--arch amd64`	Filters images by cluster architecture.

Generate cluster resources

./bobctl generate-cluster-resources

Review the generated work/cluster-resources.yaml file, then apply it to the cluster:

oc apply -f work/cluster-resources.yaml --force-conflicts --server-side

Install Bob

Update config.yaml to reference your private registry. See Configure the cluster installation.

After the configuration is updated, install the product:

./bobctl install --registry-creds <username:password> --accept-license

To include a model gateway configuration, add --model-config <file>. If omitted, use bobctl update-model-config post-install to add model access. See Configuring the Model Gateway.

Install Bob

On this page