In IBM Cloud Pak for Integration (CP4I) v2021.2, when deploying API Connect on OpenShift or within the Cloud Pak for Integration framework, there are different deployment methods:

Single Top-Level Custom Resource (CR) – This method deploys all API Connect subsystems as a single unit, meaning they are managed together. Removing individual subsystems is not supported when using this deployment method. If you need to remove a subsystem, you must delete the entire API Connect instance.

Multiple Independent Custom Resources (CRs) – This method allows more granular control, enabling the deletion of individual subsystems without affecting the entire deployment.

Since the question specifically asks about API Connect deployed using a single top-level CR , it is not possible to delete individual subsystems. The entire deployment must be deleted and reconfigured if changes are required.

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM API Connect v10 Documentation: IBM Docs - API Connect on OpenShift

IBM Cloud Pak for Integration Knowledge Center: IBM CP4I Documentation

API Connect Deployment Guide: Managing API Connect Subsystems

In IBM Cloud Pak for Integration (CP4I) v2021.2, the Automation Assets (formerly known as Asset Repository ) is managed through the IBM Automation Foundation Assets Operator . When manually upgrading Automation Assets, you need to update the Custom Resource (CR) associated with the Asset Repository.

The correct approach to manually upgrading the Automation Assets CR is to:

Navigate to the OpenShift Web Console .

Go to Operators → Installed Operators .

Find and select IBM Automation Foundation Assets Operator .

Locate the Asset Repository operand managed by this operator.

Edit the YAML definition of the Asset Repository CR to reflect the new version or required configuration changes.

Save the changes, which will trigger the update process.

This approach ensures that the Automation Assets component is upgraded correctly without disrupting the overall IBM Cloud Pak for Integration environment.

B. In OpenShift web console, navigate to the OperatorHub and edit the Automation foundation assets definition.

The OperatorHub is used for installing and subscribing to operators but does not provide direct access to modify Custom Resources (CRs) related to operands.

C. Open the terminal window and run " oc upgrade ... " command.

There is no oc upgrade command in OpenShift. Upgrades in OpenShift are typically managed through CR updates or Operator Lifecycle Manager (OLM).

D. Use the OpenShift web console to edit the YAML definition of the IBM Automation foundation assets operator.

Editing the operator’s YAML would affect the operator itself, not the Asset Repository operand , which is what needs to be upgraded.

Why Other Options Are Incorrect: IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM Cloud Pak for Integration Knowledge Center

IBM Automation Foundation Assets Documentation

OpenShift Operator Lifecycle Manager (OLM) Guide

In IBM Cloud Pak for Integration (CP4I) v2021.2 , workloads requiring authentication with Identity and Access Management (IAM) need an OAuth secret for secure access. One way to obtain this secret and register a workload is through the OperandConfig API file .

OperandConfig API is used in Cloud Pak for Integration to configure operands (software components).

It provides a mechanism to retrieve secrets, including the OAuth secret necessary for authentication with IBM IAM.

The OAuth secret is stored in a Kubernetes secret, and OperandConfig API helps configure and retrieve it dynamically for a registered workload.

Why Option D is Correct:

A. Extracting the ibm-entitlement-key secret. → Incorrect

The ibm-entitlement-key is used for entitlement verification when pulling IBM container images from IBM Container Registry.

It is not related to OAuth authentication or IAM registration.

B. Through the Red Hat Marketplace. → Incorrect

The Red Hat Marketplace is for purchasing and deploying OpenShift-based applications but does not provide OAuth secrets for IAM authentication in Cloud Pak for Integration.

C. Using a Custom Resource Definition (CRD) file. → Incorrect

CRDs define Kubernetes API extensions, but they do not directly handle OAuth secret retrieval for IAM registration.

The OperandConfig API is specifically designed for managing operand configurations, including authentication details.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Identity and Access Management

IBM OperandConfig API Documentation

IBM Cloud Pak for Integration Security Configuration

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2 , Identity and Access Management (IAM) is part of Foundational Services , which provides authentication and authorization across different modules within CP4I.

When configuring IAM for single sign-on (SSO) , the administrator must have administrator access to the IAM service . This is essential for:

Integrating external identity providers (IdPs) such as LDAP, SAML, or OIDC .

Managing user roles and access control policies across the Cloud Pak environment.

Configuring SSO settings for seamless authentication across all IBM Cloud Pak services.

IAM service administrators have full control over authentication and SSO settings .

They can configure and integrate identity providers for authentication.

This level of access is required to modify IAM settings in Cloud Pak for Integration.

Why Answer D (Access to IAM service as administrator) is Correct?

A. Access to the OpenShift Container Platform console as kubeadmin. → Incorrect

While kubeadmin is a cluster-wide OpenShift administrator, this role does not grant IAM administrative privileges in Cloud Pak Foundational Services.

IAM settings are managed within IBM Cloud Pak , not solely through OpenShift.

B. Access to IBM Cloud Pak for Integration as kubeadmin. → Incorrect

kubeadmin can manage OpenShift resources , but IAM requires specific access to the IAM service within Cloud Pak.

IAM administrators are responsible for configuring authentication, SSO, and identity providers .

C. Access to OpenShift cluster as root. → Incorrect

Root access is not relevant here because OpenShift does not use root users for administration.

IAM configurations are done within Cloud Pak, not at the OpenShift OS level.

Explanation of Incorrect Answers:

IBM Cloud Pak Foundational Services - IAM Configuration

Configuring Single Sign-On (SSO) in IBM Cloud Pak

IBM Cloud Pak for Integration Security Overview

OpenShift Authentication and Identity Management

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2 , the Platform Navigator is the central UI for managing integration capabilities, including user and access control. To add users and user groups , the required permission level is Administrator .

User Management Capabilities:

The Administrator role in Platform Navigator has full access to user and group management functions , including:

Adding new users

Assigning roles

Managing access policies

RBAC (Role-Based Access Control) Enforcement:

CP4I enforces RBAC to restrict actions based on roles.

Only Administrators can modify user access, ensuring security compliance.

Access Control via OpenShift and IAM Integration:

User management in CP4I integrates with IBM Cloud IAM or OpenShift User Management .

The Administrator role ensures correct permissions for authentication and authorization .

Why is " Administrator " the Correct Answer?

Why Not the Other Options? Option

Reason for Exclusion

A. root

" root " is a Linux system user and not a role in Platform Navigator . CP4I does not grant UI-based root access.

B. Super-user

No predefined " Super-user " role exists in CP4I. If referring to an elevated user, it still does not match the Administrator role in Platform Navigator.

D. User

Regular " User " roles have view-only or limited permissions and cannot manage users or groups.

Thus, the Administrator role is the correct choice for adding users and user groups in Platform Navigator .

IBM Cloud Pak for Integration - Platform Navigator Overview

Managing Users in Platform Navigator

Role-Based Access Control in CP4I

OpenShift User Management and Authentication

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

IBM Cloud Pak for Integration (CP4I) is licensed based on Virtual Processor Cores (VPCs) , and administrators must ensure that CP4I does not exceed the entitled number of VPCs when deployed on a shared OpenShift cluster.

One of the official methods to enforce license usage limits in CP4I is by setting the MaxLicenseDeployment environment variable in the CP4I Operator.

MaxLicenseDeployment is an environment variable that can be set in the CP4I operator.

This restricts the CP4I components to only consume the specified number of Virtual Processor Cores (VPCs) , ensuring compliance with licensing terms.

The value assigned should be less than or equal to the entitled VPCs to prevent over-deployment.

How This Works: Configuration Example: To enforce a maximum VPC limit of 16 , update the CP4I Operator ' s environment variables:

env:

- name: MaxLicenseDeployment

value: " 16 "

IBM officially recommends using MaxLicenseDeployment to enforce VPC limits.

It is a built-in mechanism for Cloud Pak licensing enforcement.

Ensures compliance without affecting other Cloud Paks running on the same OpenShift cluster.

Why Answer A is Correct?

B. VPCs are shared across all IBM Cloud Paks, so this is not necessary. → Incorrect

While VPCs are shared at the cluster level , IBM provides per-Pak license enforcement mechanisms like MaxLicenseDeployment .

Without setting limits, CP4I could consume more than its entitled VPCs .

C. Only deploy CP4I to a namespace enforced by Kubernetes CPU quota limits, where the limit is less than the VPCs of license entitlement. → Incorrect

Kubernetes CPU quotas control resource allocation but do not enforce IBM licensing.

This does not track VPC consumption for licensing compliance .

D. More information is required. → Incorrect

The IBM licensing model is well-documented, and IBM provides clear guidance on using MaxLicenseDeployment .

No additional information is needed to determine the best approach.

Explanation of Incorrect Answers:

IBM Cloud Pak for Integration Licensing

IBM License Service for OpenShift

IBM Cloud Pak Virtual Processor Core (VPC) Enforcement

OpenShift Resource Quotas and Limits

IBM Cloud Pak for Integration (CP4I) v2021.2 Administration References:

In IBM Cloud Pak for Integration (CP4I) v2021.2 , App Connect Designer is a low-code integration tool that enables users to design and deploy integrations between applications and services. It runs as a containerized service within OpenShift.

OpenShift supports multi-instance deployments , allowing users to create multiple instances of App Connect Designer within the same namespace .

This flexibility enables organizations to run separate designer instances for different projects, teams, or environments within the same namespace.

Each instance operates independently, and users can configure them with different settings and access controls.

Why Option C is Correct:

Explanation of Incorrect Answers: