Prerequisites
Workstation requirements, required tools and access, OpenShift cluster dependencies, and LLM configuration required before installing IBM Bob on-premises.
To install IBM Bob on-premises, you require a dedicated administrative workstation with network connectivity to the OpenShift cluster. The workstation must have the required CLI tools installed and access to download the Bob release bundle and associated deployment assets.
Download the Bob release bundle
Before you begin, ensure that you have:
- A valid IBM Bob on-premises entitlement.
- Access to IBM Passport Advantage to download the IBM Bob release bundle.
- Access to the IBM Entitled Container Registry (
cp.icr.io) to obtain entitled container images. - An administrative workstation with network connectivity to the target OpenShift cluster.
The release bundle contains the Kubernetes manifests, Helm charts, configuration templates, and the bobctl installation script required for deployment.
Obtain the release bundle from one of the following sources:
- Open VSX Registry — use this option to download publicly available Bob client assets, extensions, and supporting packages.
- Passport Advantage — use this option to download entitled Bob release bundles and installation assets associated with your IBM license agreement.
The following table describes the installation assets and their distribution channels.
| Component | Description | Distribution channel |
|---|---|---|
| Bob release bundle | Deployment manifests, Helm charts, configuration templates, and installation scripts | IBM Passport Advantage |
| Bob backend container images | Runtime services deployed to the OpenShift cluster | IBM Entitled Container Registry (cp.icr.io) |
| Bob IDE extensions and add-ons | IDE integrations and optional client-side components | Open VSX Registry |
The release bundle does not contain the backend container images. Before you begin the installation, obtain both the release bundle and the corresponding container images separately.
After downloading the release bundle, extract the archive and navigate to the release directory:
tar -xvf ibm-bob-bundle-<version>.tar.gz
cd ibm-bob-bundle/releaseThe extracted release directory contains the files and scripts required to configure and deploy IBM Bob on-premises.
Required workstation tools
Ensure that your workstation has the following tools installed and available in the system PATH before installing the release bundle. These tools are used throughout the installation, configuration, and management lifecycle.
| Tool | Version | Purpose |
|---|---|---|
bobctl | Included in the release bundle (./bobctl) | Primary Bob CLI used to install, configure, update, and manage the deployment. Run from the release/ directory as ./bobctl. |
oc | Compatible with your OCP cluster version (minimum OCP 4.20) | OpenShift CLI used to authenticate with and manage the target cluster. The oc client version should match, or be within one minor version of, the cluster version. |
helm | 3.14.0 or later | Kubernetes package manager used by bobctl during deployment and configuration operations. |
bash | 3.2 or later | Shell interpreter required to run bobctl and supporting scripts. Must be available in $PATH as bash. On macOS, where zsh is the default shell, install bash (for example, with brew install bash) and ensure it is accessible from $PATH. |
openssl | 3.5 or later (or the OS-provided version) | Used for certificate-related operations including bobctl get-ca-cert, setup-route, and reset-route. Must be available in $PATH. |
Run the following commands to verify that all tools are installed and accessible:
bobctl --help
oc version
helm version
bash --version
openssl versionEnsure that each command completes successfully before proceeding with the installation.
Access and permissions
Ensure that you have the following access and permissions before starting the installation.
| Requirement | Description |
|---|---|
| GitHub access | Access to download the Bob release bundle from the IBM Bob repository. |
| Cluster permissions | cluster-admin privileges, or equivalent RBAC permissions, on the target OpenShift cluster. |
| IBM Container Registry entitlement | Access to IBM Container Registry (cp.icr.io or icr.io) and the required entitlement credentials to pull Bob container images. |
| Cluster resources | Sufficient CPU, memory, storage, and worker node capacity to support Bob and any optional components you plan to deploy. See Cluster sizing. |
Before installation, confirm that you can:
- Download the Bob release bundle.
- Authenticate to the target OpenShift cluster.
- Access IBM Container Registry and pull container images.
- Create and manage cluster-scoped resources using an account with
cluster-adminprivileges. - Allocate the required compute, storage, and networking resources for the deployment.
Role-based access control (RBAC) and permission separation
The Bob release bundle separates cluster-scoped resources from namespace-scoped resources. This design lets security and platform administrators review and approve cluster-wide resources independently from the Bob operator and application deployment.
Bob uses two namespaces:
| Namespace | Purpose |
|---|---|
| Operator namespace | Hosts the ibm-bob-operator, which manages the Bob lifecycle and reconciliation processes. |
| Operand namespace | Hosts the Bob application workloads, including services, pods, and supporting components managed by the operator. |
Both namespaces are created and managed by bobctl install. All RBAC resources created during installation — including Role, RoleBinding, and ServiceAccount objects — are limited to these two namespaces.
Release bundle structure
The release bundle is organized into separate cluster-scoped and namespace-scoped components.
| Directory | Scope | Contents |
|---|---|---|
ibm-bob-cluster-scoped/ | Cluster-scoped | Custom resource definitions (CRDs), ClusterRole, ClusterRoleBinding, and other cluster-wide resources that require administrative review and approval. |
ibm-bob/ | Namespace-scoped | Operator deployment, namespace-level RBAC resources, service accounts, and Bob application workloads. |
Installation workflow
Deploy Bob using the following two-step process:
| Step | Action | Scope | Required privileges |
|---|---|---|---|
| 1 | Generate and apply cluster-scoped resources | Cluster-wide | cluster-admin, or a role with permissions to create CRDs, ClusterRole, and ClusterRoleBinding resources |
| 2 | Run bobctl install | Operator and operand namespaces only | Namespace administrator permissions on the target namespaces |
Generate and apply the cluster-scoped resources:
./bobctl generate-cluster-resources
oc apply -f work/cluster-resources.yamlThe generated work/cluster-resources.yaml file contains only the cluster-scoped resources from the ibm-bob-cluster-scoped/ directory. After the cluster-scoped resources are applied, bobctl install runs entirely within the two Bob namespaces and does not require additional cluster-wide privileges.
IBM recommends that a cluster administrator or security team review the generated work/cluster-resources.yaml file before applying it to the cluster. The resources deployed from the ibm-bob/ directory do not require a separate cluster-level security review because all RBAC permissions are restricted to the operator and operand namespaces.
Cluster prerequisites
Before installing Bob, ensure that the target OpenShift cluster meets the following software, connectivity, and service prerequisites.
Install cert-manager
Bob uses cert-manager v1.14 or later to issue and manage TLS certificates for components running in the cluster. Install and validate cert-manager before deployment.
What happens if cert-manager is missing?
The bobctl install command validates the presence of cert-manager CRDs during startup. If cert-manager is not installed or the required CRDs cannot be found, the installation terminates immediately with a clear error message and no deployment actions are performed.
Install cert-manager using one of the following options:
Option 1: Red Hat cert-manager Operator for OpenShift (recommended)
Install the Red Hat cert-manager Operator for OpenShift from OperatorHub using the stable-v1 channel. This is recommended for OpenShift environments because it is supported and maintained through the OpenShift operator lifecycle. For instructions, see cert-manager Operator for Red Hat OpenShift.
Option 2: Upstream cert-manager
Install the upstream cert-manager release using Helm charts or Kubernetes manifests. Ensure the deployed version is v1.14 or later. For instructions, see cert-manager Installation.
If cert-manager is already installed on the cluster at v1.14 or later, it can be reused — no additional installation is required.
Verify that cert-manager is installed and healthy:
# Verify that all cert-manager pods are running
oc get pods -n cert-manager
# Verify that the required cert-manager CRDs exist
oc get crd | grep cert-manager.ioA successful validation shows the cert-manager controller pods in the Running state and the core cert-manager CRDs present on the cluster.
Provision and configure a large language model
Bob on-premises requires access to one or more supported large language models (LLMs). Bob manages the connection to the model endpoint, but provisioning, hosting, scaling, and maintaining the model infrastructure is outside the scope of the Bob core installation.
Configure the following model endpoints before installation:
- Core inference model — processes user requests and generates responses. Deploy one supported model from the approved inference model list (for example, Mistral 3.5).
- Guardrail model — applies safety, policy, and content-governance checks to requests and responses. Deploy one guardrail model for request and response moderation (for example,
openai/gpt-oss-20b).
For more information about model configuration, see Model gateway configuration.
Ensure that the Bob backend and the configured model services can communicate over the network. Verify that firewalls, network policies, security groups, proxies, and routing rules allow traffic between the OpenShift cluster and the model endpoints before proceeding with the installation.
Bob does not provide security event logging capabilities. You are responsible for configuring security logging, audit logging, and monitoring through OpenShift and any associated enterprise security tooling.
Installation overview
Understand the roles involved and the four phases required to install IBM Bob on-premises on Red Hat OpenShift Container Platform.
Model serving infrastructure
Deploy and configure model endpoints for IBM Bob on-premises when your environment does not already provide a model-serving solution.