--- kind: Template apiVersion: v1 metadata: annotations: iconClass: icon-jboss tags: rhpam,processserver,jboss,authoring version: "7.6" openshift.io/display-name: Red Hat Process Automation Manager 7.6 authoring environment (non-HA, persistent, with https) openshift.io/provider-display-name: Red Hat, Inc. description: Application template for a non-HA persistent authoring environment, for Red Hat Process Automation Manager 7.6 - Deprecated template.openshift.io/long-description: This template defines resources needed to develop and execute Rules and Processes on Red Hat Process Automation Manager 7.6, including application deployment configuration, secure and insecure http communication and persistent volume to store data that needs to survive a restart. Template for Red Hat OpenShift Container Platform version 3.11. Deprecated since Red Hat Process Automation Manager version 7.5; consider using the Red Hat Business Automation Operator. template.openshift.io/documentation-url: https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.6/html/deploying_a_red_hat_process_automation_manager_7.6_authoring_environment_on_red_hat_openshift_container_platform/ template.openshift.io/support-url: https://access.redhat.com template.openshift.io/bindable: "false" name: rhpam76-authoring labels: template: rhpam76-authoring rhpam: "7.6" message: |- A new persistent Process Automation Manager application have been created in your project. The user name/password for accessing the Business Central interface is User name: ${KIE_ADMIN_USER} Password: ${KIE_ADMIN_PWD} The user name/password for calls to the KIE server is User name: ${KIE_SERVER_USER} Password: ${KIE_SERVER_PWD} Please be sure to create the secrets named "${BUSINESS_CENTRAL_HTTPS_SECRET}" and "${KIE_SERVER_HTTPS_SECRET}" containing the ${BUSINESS_CENTRAL_HTTPS_KEYSTORE} and ${KIE_SERVER_HTTPS_KEYSTORE} files used for serving secure content. parameters: - displayName: Application Name description: The name for the application. name: APPLICATION_NAME value: myapp required: true - displayName: KIE Admin User description: KIE administrator user name. name: KIE_ADMIN_USER value: adminUser required: false - displayName: KIE Admin Password description: KIE administrator password. name: KIE_ADMIN_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server Controller User description: KIE server controller user name. (Sets the org.kie.server.controller.user system property) name: KIE_SERVER_CONTROLLER_USER value: controllerUser required: false - displayName: KIE Server Controller Password description: KIE server controller password. (Sets the org.kie.server.controller.pwd system property) name: KIE_SERVER_CONTROLLER_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server Controller Token description: KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property) name: KIE_SERVER_CONTROLLER_TOKEN required: false - displayName: KIE Server User description: KIE server user name. (Sets the org.kie.server.user system property) name: KIE_SERVER_USER value: executionUser required: false - displayName: KIE Server Password description: KIE server password. (Sets the org.kie.server.pwd system property) name: KIE_SERVER_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server Bypass Auth User description: Allows the KIE server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property) name: KIE_SERVER_BYPASS_AUTH_USER value: 'false' required: false - displayName: KIE Server Persistence DS description: KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property) name: KIE_SERVER_PERSISTENCE_DS value: java:/jboss/datasources/rhpam required: false ## H2 database parameters BEGIN - displayName: KIE Server H2 Database User description: KIE server H2 database user name. name: KIE_SERVER_H2_USER value: sa required: false - displayName: KIE Server H2 Database Password description: KIE server H2 database password. name: KIE_SERVER_H2_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false ## H2 database parameters END - displayName: KIE Server Mode description: "The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property)" name: KIE_SERVER_MODE value: "DEVELOPMENT" required: false - displayName: KIE MBeans description: KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties) name: KIE_MBEANS value: enabled required: false - displayName: Drools Server Filter Classes description: KIE server class filtering. (Sets the org.drools.server.filter.classes system property) name: DROOLS_SERVER_FILTER_CLASSES value: 'true' required: false - displayName: Prometheus Server Extension Disabled description: If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property) name: PROMETHEUS_SERVER_EXT_DISABLED example: 'false' required: false - displayName: Business Central Custom http Route Hostname description: 'Custom hostname for the http service route for Business Central. Leave blank for default hostname, e.g.: insecure--rhpamcentr-.' name: BUSINESS_CENTRAL_HOSTNAME_HTTP value: '' required: false - displayName: Business Central Custom https Route Hostname description: 'Custom hostname for the https service route for Business Central. Leave blank for default hostname, e.g.: -rhpamcentr-.' name: BUSINESS_CENTRAL_HOSTNAME_HTTPS value: '' required: false - displayName: KIE Server Custom http Route Hostname description: 'Custom hostname for the http service route for KIE Server. Leave blank for default hostname, e.g.: insecure--kieserver-.' name: KIE_SERVER_HOSTNAME_HTTP value: '' required: false - displayName: KIE Server Custom https Route Hostname description: 'Custom hostname for the https service route for KIE Server. Leave blank for default hostname, e.g.: -kieserver-.' name: KIE_SERVER_HOSTNAME_HTTPS value: '' required: false - displayName: Business Central Server Keystore Secret Name description: The name of the secret containing the keystore file for Business Central. name: BUSINESS_CENTRAL_HTTPS_SECRET example: businesscentral-app-secret required: true - displayName: Business Central Server Keystore Filename description: The name of the keystore file within the secret. name: BUSINESS_CENTRAL_HTTPS_KEYSTORE value: keystore.jks required: false - displayName: Business Central Server Certificate Name description: The name associated with the server certificate. name: BUSINESS_CENTRAL_HTTPS_NAME value: jboss required: false - displayName: Business Central Server Keystore Password description: The password for the keystore and certificate. name: BUSINESS_CENTRAL_HTTPS_PASSWORD value: mykeystorepass required: false - displayName: KIE Server Keystore Secret Name description: The name of the secret containing the keystore file for KIE server. name: KIE_SERVER_HTTPS_SECRET example: kieserver-app-secret required: true - displayName: KIE Server Keystore Filename description: The name of the keystore file within the secret. name: KIE_SERVER_HTTPS_KEYSTORE value: keystore.jks required: false - displayName: KIE Server Certificate Name description: The name associated with the server certificate. name: KIE_SERVER_HTTPS_NAME value: jboss required: false - displayName: KIE Server Keystore Password description: The password for the keystore and certificate. name: KIE_SERVER_HTTPS_PASSWORD value: mykeystorepass required: false - displayName: Database Volume Capacity description: Size of persistent storage for the database volume. name: DB_VOLUME_CAPACITY value: 1Gi required: true ## OpenShift Enhancement BEGIN - displayName: Enable KIE server global discovery description: "If set to true, turns on KIE server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)" name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED value: "false" required: false - displayName: Prefer KIE Server OpenShift Service description: If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property) name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE value: "true" required: false - displayName: KIE ServerTemplate Cache TTL description: KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property) name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL value: "60000" required: false ## OpenShift Enhancement END - displayName: ImageStream Namespace description: Namespace in which the ImageStreams for Red Hat Process Automation Manager images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project. name: IMAGE_STREAM_NAMESPACE value: openshift required: true - displayName: KIE Server ImageStream Name description: The name of the image stream to use for KIE server. Default is "rhpam-kieserver-rhel8". name: KIE_SERVER_IMAGE_STREAM_NAME value: "rhpam-kieserver-rhel8" required: true - displayName: ImageStream Tag description: A named pointer to an image in an image stream. Default is "7.6.0". name: IMAGE_STREAM_TAG value: "7.6.0" required: true - displayName: Maven mirror URL description: Maven mirror that Business Central and KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services. name: MAVEN_MIRROR_URL required: false - displayName: Maven mirror of description: Maven mirror configuration for KIE server. name: MAVEN_MIRROR_OF value: "external:*,!repo-rhpamcentr" required: false - displayName: Maven repository ID description: "The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won't be usable in MAVEN_MIRROR_OF." name: MAVEN_REPO_ID value: repo-custom required: false - displayName: Maven repository URL description: Fully qualified URL to a Maven repository or service. name: MAVEN_REPO_URL example: http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/ required: false - displayName: Maven repository user name description: User name for accessing the Maven repository, if required. name: MAVEN_REPO_USERNAME required: false - displayName: Maven repository password description: Password to access the Maven repository, if required. name: MAVEN_REPO_PASSWORD required: false - displayName: User name for the Maven service hosted by Business Central description: User name for accessing the Maven service hosted by Business Central inside EAP. name: BUSINESS_CENTRAL_MAVEN_USERNAME required: true value: mavenUser - displayName: Password for the Maven service hosted by Business Central description: Password to access the Maven service hosted by Business Central inside EAP. name: BUSINESS_CENTRAL_MAVEN_PASSWORD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: true - displayName: Git hooks directory description: The directory to use for git hooks, if required. name: GIT_HOOKS_DIR example: /opt/kie/data/git/hooks required: false - displayName: Business Central Volume Capacity description: Size of the persistent storage for Business Central runtime data. name: BUSINESS_CENTRAL_VOLUME_CAPACITY value: 1Gi required: true - displayName: Business Central Container Memory Limit description: Business Central Container memory limit name: BUSINESS_CENTRAL_MEMORY_LIMIT value: 2Gi required: false - displayName: KIE Server Container Memory Limit description: KIE server Container memory limit name: KIE_SERVER_MEMORY_LIMIT value: 1Gi required: false - displayName: RH-SSO URL description: RH-SSO URL. name: SSO_URL example: https://rh-sso.example.com/auth required: false - displayName: RH-SSO Realm name description: RH-SSO Realm name. name: SSO_REALM required: false - displayName: Business Central RH-SSO Client name description: Business Central RH-SSO Client name. name: BUSINESS_CENTRAL_SSO_CLIENT required: false - displayName: Business Central RH-SSO Client Secret description: Business Central RH-SSO Client Secret. name: BUSINESS_CENTRAL_SSO_SECRET example: "252793ed-7118-4ca8-8dab-5622fa97d892" required: false - displayName: KIE Server RH-SSO Client name description: KIE Server RH-SSO Client name. name: KIE_SERVER_SSO_CLIENT required: false - displayName: KIE Server RH-SSO Client Secret description: KIE Server RH-SSO Client Secret. name: KIE_SERVER_SSO_SECRET example: "252793ed-7118-4ca8-8dab-5622fa97d892" required: false - displayName: RH-SSO Realm admin user name description: RH-SSO Realm admin user name for creating the Client if it doesn't exist. name: SSO_USERNAME required: false - displayName: RH-SSO Realm Admin Password description: RH-SSO Realm Admin Password used to create the Client. name: SSO_PASSWORD required: false - displayName: RH-SSO Disable SSL Certificate Validation description: RH-SSO Disable SSL Certificate Validation. name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "false" required: false - displayName: RH-SSO Principal Attribute description: RH-SSO Principal Attribute to use as user name. name: SSO_PRINCIPAL_ATTRIBUTE value: preferred_username required: false - displayName: LDAP Endpoint description: LDAP Endpoint to connect for authentication name: AUTH_LDAP_URL example: "ldap://myldap.example.com" required: false - displayName: LDAP Bind DN description: Bind DN used for authentication. name: AUTH_LDAP_BIND_DN example: "uid=admin,ou=users,ou=example,ou=com" required: false - displayName: LDAP Bind Credentials description: LDAP Credentials used for authentication. name: AUTH_LDAP_BIND_CREDENTIAL example: "Password" required: false - displayName: LDAP JAAS Security Domain description: The JMX ObjectName of the JaasSecurityDomain used to decrypt the password. name: AUTH_LDAP_JAAS_SECURITY_DOMAIN required: false - displayName: LDAP Base DN description: LDAP Base DN of the top-level context to begin the user search. name: AUTH_LDAP_BASE_CTX_DN example: "ou=users,ou=example,ou=com" required: false - displayName: LDAP Base Search filter description: LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}). name: AUTH_LDAP_BASE_FILTER example: "(uid={0})" required: false - displayName: LDAP Search scope description: The search scope to use. name: AUTH_LDAP_SEARCH_SCOPE example: "SUBTREE_SCOPE" required: false - displayName: LDAP Search time limit description: The timeout in milliseconds for user or role searches. name: AUTH_LDAP_SEARCH_TIME_LIMIT example: "10000" required: false - displayName: LDAP DN attribute description: The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used. name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE example: "distinguishedName" required: false - displayName: LDAP Parse username description: A flag indicating if the DN is to be parsed for the user name. If set to true, the DN is parsed for the user name. If set to false the DN is not parsed for the user name. This option is used together with usernameBeginString and usernameEndString. name: AUTH_LDAP_PARSE_USERNAME example: "true" required: false - displayName: LDAP Username begin string description: Defines the String which is to be removed from the start of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true. name: AUTH_LDAP_USERNAME_BEGIN_STRING required: false - displayName: LDAP Username end string description: Defines the String which is to be removed from the end of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true. name: AUTH_LDAP_USERNAME_END_STRING required: false - displayName: LDAP Role attributeID description: Name of the attribute containing the user roles. name: AUTH_LDAP_ROLE_ATTRIBUTE_ID example: memberOf required: false - displayName: LDAP Roles Search DN description: The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is. name: AUTH_LDAP_ROLES_CTX_DN example: "ou=groups,ou=example,ou=com" required: false - displayName: LDAP Role search filter description: A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}). name: AUTH_LDAP_ROLE_FILTER example: "(memberOf={1})" required: false - displayName: LDAP Role recursion description: The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0. name: AUTH_LDAP_ROLE_RECURSION example: "1" required: false - displayName: LDAP Default role description: A role included for all authenticated users name: AUTH_LDAP_DEFAULT_ROLE example: "user" required: false - displayName: LDAP Role name attribute ID description: Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute. name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID example: "name" required: false - displayName: LDAP Role DN contains roleNameAttributeID description: A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries. name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN example: "false" required: false - displayName: LDAP Role Attribute ID is DN description: Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true. name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN example: "false" required: false - displayName: LDAP Referral user attribute ID description: If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree. name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK required: false - displayName: RoleMapping rolesProperties file path description: When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3 name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES required: false - displayName: RoleMapping replaceRole property description: Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true. name: AUTH_ROLE_MAPPER_REPLACE_ROLE required: false objects: - kind: ServiceAccount apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamsvc" labels: application: "${APPLICATION_NAME}" - kind: RoleBinding apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamsvc-edit" labels: application: "${APPLICATION_NAME}" subjects: - kind: ServiceAccount name: "${APPLICATION_NAME}-rhpamsvc" roleRef: name: edit - kind: Service apiVersion: v1 spec: ports: - name: http port: 8080 targetPort: 8080 - name: https port: 8443 targetPort: 8443 selector: deploymentConfig: "${APPLICATION_NAME}-rhpamcentr" metadata: name: "${APPLICATION_NAME}-rhpamcentr" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" annotations: description: All the Business Central web server's ports. - kind: Service apiVersion: v1 spec: ports: - name: http port: 8080 targetPort: 8080 - name: https port: 8443 targetPort: 8443 selector: deploymentConfig: "${APPLICATION_NAME}-kieserver" sessionAffinity: ClientIP sessionAffinityConfig: clientIP: timeoutSeconds: 3600 metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: All the KIE server web server's ports. ## Place to add database service - kind: Route apiVersion: v1 id: "insecure-${APPLICATION_NAME}-rhpamcentr-http" metadata: name: "insecure-${APPLICATION_NAME}-rhpamcentr" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" annotations: description: Route for Business Central's http service. haproxy.router.openshift.io/timeout: 1h spec: host: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}" to: name: "${APPLICATION_NAME}-rhpamcentr" port: targetPort: http - kind: Route apiVersion: v1 id: "${APPLICATION_NAME}-rhpamcentr-https" metadata: name: "${APPLICATION_NAME}-rhpamcentr" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" annotations: description: Route for Business Central's https service. haproxy.router.openshift.io/timeout: 1h spec: host: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}" to: name: ${APPLICATION_NAME}-rhpamcentr port: targetPort: https tls: termination: passthrough - kind: Route apiVersion: v1 id: "insecure-${APPLICATION_NAME}-kieserver-http" metadata: name: "insecure-${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: Route for KIE server's http service. haproxy.router.openshift.io/balance: source spec: host: "${KIE_SERVER_HOSTNAME_HTTP}" to: name: "${APPLICATION_NAME}-kieserver" port: targetPort: http - kind: Route apiVersion: v1 id: "${APPLICATION_NAME}-kieserver-https" metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: Route for KIE server's https service. spec: host: "${KIE_SERVER_HOSTNAME_HTTPS}" to: name: ${APPLICATION_NAME}-kieserver port: targetPort: https tls: termination: passthrough - kind: DeploymentConfig apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamcentr" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" annotations: template.alpha.openshift.io/wait-for-ready: "true" spec: strategy: type: Recreate triggers: - type: ImageChange imageChangeParams: automatic: true containerNames: - "${APPLICATION_NAME}-rhpamcentr" from: kind: ImageStreamTag namespace: "${IMAGE_STREAM_NAMESPACE}" name: "rhpam-businesscentral-rhel8:${IMAGE_STREAM_TAG}" - type: ConfigChange replicas: 1 selector: deploymentConfig: "${APPLICATION_NAME}-rhpamcentr" template: metadata: name: "${APPLICATION_NAME}-rhpamcentr" labels: deploymentConfig: "${APPLICATION_NAME}-rhpamcentr" application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" spec: serviceAccountName: "${APPLICATION_NAME}-rhpamsvc" terminationGracePeriodSeconds: 60 containers: - name: "${APPLICATION_NAME}-rhpamcentr" image: rhpam-businesscentral-rhel8 imagePullPolicy: Always resources: limits: memory: "${BUSINESS_CENTRAL_MEMORY_LIMIT}" volumeMounts: - name: businesscentral-keystore-volume mountPath: "/etc/businesscentral-secret-volume" readOnly: true - name: "${APPLICATION_NAME}-rhpamcentr-pvol" mountPath: "/opt/kie/data" livenessProbe: httpGet: path: /rest/healthy port: 8080 scheme: HTTP initialDelaySeconds: 180 timeoutSeconds: 2 periodSeconds: 15 readinessProbe: httpGet: path: /rest/ready port: 8080 scheme: HTTP initialDelaySeconds: 30 timeoutSeconds: 2 periodSeconds: 5 failureThreshold: 36 ports: - name: jolokia containerPort: 8778 protocol: TCP - name: http containerPort: 8080 protocol: TCP - name: https containerPort: 8443 protocol: TCP env: - name: APPLICATION_USERS_PROPERTIES value: "/opt/kie/data/configuration/application-users.properties" - name: APPLICATION_ROLES_PROPERTIES value: "/opt/kie/data/configuration/application-roles.properties" - name: KIE_ADMIN_USER value: "${KIE_ADMIN_USER}" - name: KIE_ADMIN_PWD value: "${KIE_ADMIN_PWD}" - name: KIE_MBEANS value: "${KIE_MBEANS}" ## OpenShift Enhancement BEGIN - name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED}" - name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}" - name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL value: "${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}" - name: KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED value: "true" ## OpenShift Enhancement END - name: KIE_SERVER_CONTROLLER_USER value: "${KIE_SERVER_CONTROLLER_USER}" - name: KIE_SERVER_CONTROLLER_PWD value: "${KIE_SERVER_CONTROLLER_PWD}" - name: KIE_SERVER_CONTROLLER_TOKEN value: "${KIE_SERVER_CONTROLLER_TOKEN}" - name: KIE_SERVER_USER value: "${KIE_SERVER_USER}" - name: KIE_SERVER_PWD value: "${KIE_SERVER_PWD}" - name: MAVEN_MIRROR_URL value: "${MAVEN_MIRROR_URL}" - name: MAVEN_REPO_ID value: "${MAVEN_REPO_ID}" - name: MAVEN_REPO_URL value: "${MAVEN_REPO_URL}" - name: MAVEN_REPO_USERNAME value: "${MAVEN_REPO_USERNAME}" - name: MAVEN_REPO_PASSWORD value: "${MAVEN_REPO_PASSWORD}" - name: KIE_MAVEN_USER value: "${BUSINESS_CENTRAL_MAVEN_USERNAME}" - name: KIE_MAVEN_PWD value: "${BUSINESS_CENTRAL_MAVEN_PASSWORD}" - name: GIT_HOOKS_DIR value: "${GIT_HOOKS_DIR}" - name: HTTPS_KEYSTORE_DIR value: "/etc/businesscentral-secret-volume" - name: HTTPS_KEYSTORE value: "${BUSINESS_CENTRAL_HTTPS_KEYSTORE}" - name: HTTPS_NAME value: "${BUSINESS_CENTRAL_HTTPS_NAME}" - name: HTTPS_PASSWORD value: "${BUSINESS_CENTRAL_HTTPS_PASSWORD}" - name: WORKBENCH_ROUTE_NAME value: "${APPLICATION_NAME}-rhpamcentr" - name: SSO_URL value: "${SSO_URL}" - name: SSO_OPENIDCONNECT_DEPLOYMENTS value: "ROOT.war" - name: SSO_REALM value: "${SSO_REALM}" - name: SSO_SECRET value: "${BUSINESS_CENTRAL_SSO_SECRET}" - name: SSO_CLIENT value: "${BUSINESS_CENTRAL_SSO_CLIENT}" - name: SSO_USERNAME value: "${SSO_USERNAME}" - name: SSO_PASSWORD value: "${SSO_PASSWORD}" - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}" - name: SSO_PRINCIPAL_ATTRIBUTE value: "${SSO_PRINCIPAL_ATTRIBUTE}" - name: HOSTNAME_HTTP value: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}" - name: HOSTNAME_HTTPS value: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}" - name: AUTH_LDAP_URL value: "${AUTH_LDAP_URL}" - name: AUTH_LDAP_BIND_DN value: "${AUTH_LDAP_BIND_DN}" - name: AUTH_LDAP_BIND_CREDENTIAL value: "${AUTH_LDAP_BIND_CREDENTIAL}" - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}" - name: AUTH_LDAP_BASE_CTX_DN value: "${AUTH_LDAP_BASE_CTX_DN}" - name: AUTH_LDAP_BASE_FILTER value: "${AUTH_LDAP_BASE_FILTER}" - name: AUTH_LDAP_SEARCH_SCOPE value: "${AUTH_LDAP_SEARCH_SCOPE}" - name: AUTH_LDAP_SEARCH_TIME_LIMIT value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}" - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}" - name: AUTH_LDAP_PARSE_USERNAME value: "${AUTH_LDAP_PARSE_USERNAME}" - name: AUTH_LDAP_USERNAME_BEGIN_STRING value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}" - name: AUTH_LDAP_USERNAME_END_STRING value: "${AUTH_LDAP_USERNAME_END_STRING}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}" - name: AUTH_LDAP_ROLES_CTX_DN value: "${AUTH_LDAP_ROLES_CTX_DN}" - name: AUTH_LDAP_ROLE_FILTER value: "${AUTH_LDAP_ROLE_FILTER}" - name: AUTH_LDAP_ROLE_RECURSION value: "${AUTH_LDAP_ROLE_RECURSION}" - name: AUTH_LDAP_DEFAULT_ROLE value: "${AUTH_LDAP_DEFAULT_ROLE}" - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}" - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}" - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}" - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}" - name: AUTH_ROLE_MAPPER_REPLACE_ROLE value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}" volumes: - name: businesscentral-keystore-volume secret: secretName: "${BUSINESS_CENTRAL_HTTPS_SECRET}" - name: "${APPLICATION_NAME}-rhpamcentr-pvol" persistentVolumeClaim: claimName: "${APPLICATION_NAME}-rhpamcentr-claim" - kind: DeploymentConfig apiVersion: v1 metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver" annotations: template.alpha.openshift.io/wait-for-ready: "true" spec: revisionHistoryLimit: 10 strategy: rollingParams: maxSurge: 100% maxUnavailable: 0 type: Rolling triggers: - type: ImageChange imageChangeParams: automatic: true containerNames: - "${APPLICATION_NAME}-kieserver" from: kind: ImageStreamTag namespace: "${IMAGE_STREAM_NAMESPACE}" name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}" - type: ConfigChange replicas: 1 selector: deploymentConfig: "${APPLICATION_NAME}-kieserver" template: metadata: name: "${APPLICATION_NAME}-kieserver" labels: deploymentConfig: "${APPLICATION_NAME}-kieserver" application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver" spec: serviceAccountName: "${APPLICATION_NAME}-rhpamsvc" terminationGracePeriodSeconds: 90 containers: - name: "${APPLICATION_NAME}-kieserver" image: "${KIE_SERVER_IMAGE_STREAM_NAME}" imagePullPolicy: Always lifecycle: postStart: exec: command: - /bin/sh - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh preStop: exec: command: - /bin/sh - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh resources: limits: memory: "${KIE_SERVER_MEMORY_LIMIT}" volumeMounts: - name: kieserver-keystore-volume mountPath: "/etc/kieserver-secret-volume" readOnly: true ## H2 volume mount BEGIN - name: "${APPLICATION_NAME}-kie-pvol" mountPath: "/opt/kie/data" ## H2 volume mount END livenessProbe: httpGet: path: /services/rest/server/healthcheck port: 8080 scheme: HTTP initialDelaySeconds: 180 timeoutSeconds: 2 periodSeconds: 15 failureThreshold: 3 readinessProbe: httpGet: path: /services/rest/server/readycheck port: 8080 scheme: HTTP initialDelaySeconds: 30 timeoutSeconds: 2 periodSeconds: 5 failureThreshold: 36 ports: - name: jolokia containerPort: 8778 protocol: TCP - name: http containerPort: 8080 protocol: TCP - name: https containerPort: 8443 protocol: TCP env: - name: WORKBENCH_SERVICE_NAME value: "${APPLICATION_NAME}-rhpamcentr" - name: DATASOURCES value: "RHPAM" - name: RHPAM_DATABASE value: "rhpam7" - name: RHPAM_JNDI value: "${KIE_SERVER_PERSISTENCE_DS}" - name: RHPAM_JTA value: "true" ## H2 driver settings BEGIN - name: RHPAM_DRIVER value: "h2" - name: RHPAM_USERNAME value: "${KIE_SERVER_H2_USER}" - name: RHPAM_PASSWORD value: "${KIE_SERVER_H2_PWD}" - name: RHPAM_NONXA value: "false" - name: RHPAM_XA_CONNECTION_PROPERTY_URL value: "jdbc:h2:/opt/kie/data/h2/rhpam;AUTO_SERVER=TRUE" - name: KIE_SERVER_PERSISTENCE_DIALECT value: "org.hibernate.dialect.H2Dialect" ## H2 driver settings END - name: KIE_ADMIN_USER value: "${KIE_ADMIN_USER}" - name: KIE_ADMIN_PWD value: "${KIE_ADMIN_PWD}" - name: KIE_SERVER_MODE value: "${KIE_SERVER_MODE}" - name: KIE_MBEANS value: "${KIE_MBEANS}" - name: DROOLS_SERVER_FILTER_CLASSES value: "${DROOLS_SERVER_FILTER_CLASSES}" - name: PROMETHEUS_SERVER_EXT_DISABLED value: "${PROMETHEUS_SERVER_EXT_DISABLED}" - name: KIE_SERVER_BYPASS_AUTH_USER value: "${KIE_SERVER_BYPASS_AUTH_USER}" - name: KIE_SERVER_ID valueFrom: fieldRef: fieldPath: metadata.labels['services.server.kie.org/kie-server-id'] - name: KIE_SERVER_ROUTE_NAME value: "${APPLICATION_NAME}-kieserver" - name: KIE_SERVER_PERSISTENCE_DS value: "${KIE_SERVER_PERSISTENCE_DS}" - name: KIE_SERVER_STARTUP_STRATEGY value: "OpenShiftStartupStrategy" - name: KIE_SERVER_USER value: "${KIE_SERVER_USER}" - name: KIE_SERVER_PWD value: "${KIE_SERVER_PWD}" - name: MAVEN_MIRROR_URL value: "${MAVEN_MIRROR_URL}" - name: MAVEN_MIRROR_OF value: "${MAVEN_MIRROR_OF}" - name: MAVEN_REPOS value: "RHPAMCENTR,EXTERNAL" - name: RHPAMCENTR_MAVEN_REPO_ID value: "repo-rhpamcentr" - name: RHPAMCENTR_MAVEN_REPO_SERVICE value: "${APPLICATION_NAME}-rhpamcentr" - name: RHPAMCENTR_MAVEN_REPO_PATH value: "/maven2/" - name: RHPAMCENTR_MAVEN_REPO_USERNAME value: "${BUSINESS_CENTRAL_MAVEN_USERNAME}" - name: RHPAMCENTR_MAVEN_REPO_PASSWORD value: "${BUSINESS_CENTRAL_MAVEN_PASSWORD}" - name: EXTERNAL_MAVEN_REPO_ID value: "${MAVEN_REPO_ID}" - name: EXTERNAL_MAVEN_REPO_URL value: "${MAVEN_REPO_URL}" - name: EXTERNAL_MAVEN_REPO_USERNAME value: "${MAVEN_REPO_USERNAME}" - name: EXTERNAL_MAVEN_REPO_PASSWORD value: "${MAVEN_REPO_PASSWORD}" - name: HTTPS_KEYSTORE_DIR value: "/etc/kieserver-secret-volume" - name: HTTPS_KEYSTORE value: "${KIE_SERVER_HTTPS_KEYSTORE}" - name: HTTPS_NAME value: "${KIE_SERVER_HTTPS_NAME}" - name: HTTPS_PASSWORD value: "${KIE_SERVER_HTTPS_PASSWORD}" - name: SSO_URL value: "${SSO_URL}" - name: SSO_OPENIDCONNECT_DEPLOYMENTS value: "ROOT.war" - name: SSO_REALM value: "${SSO_REALM}" - name: SSO_SECRET value: "${KIE_SERVER_SSO_SECRET}" - name: SSO_CLIENT value: "${KIE_SERVER_SSO_CLIENT}" - name: SSO_USERNAME value: "${SSO_USERNAME}" - name: SSO_PASSWORD value: "${SSO_PASSWORD}" - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}" - name: SSO_PRINCIPAL_ATTRIBUTE value: "${SSO_PRINCIPAL_ATTRIBUTE}" - name: HOSTNAME_HTTP value: "${KIE_SERVER_HOSTNAME_HTTP}" - name: HOSTNAME_HTTPS value: "${KIE_SERVER_HOSTNAME_HTTPS}" - name: AUTH_LDAP_URL value: "${AUTH_LDAP_URL}" - name: AUTH_LDAP_BIND_DN value: "${AUTH_LDAP_BIND_DN}" - name: AUTH_LDAP_BIND_CREDENTIAL value: "${AUTH_LDAP_BIND_CREDENTIAL}" - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}" - name: AUTH_LDAP_BASE_CTX_DN value: "${AUTH_LDAP_BASE_CTX_DN}" - name: AUTH_LDAP_BASE_FILTER value: "${AUTH_LDAP_BASE_FILTER}" - name: AUTH_LDAP_SEARCH_SCOPE value: "${AUTH_LDAP_SEARCH_SCOPE}" - name: AUTH_LDAP_SEARCH_TIME_LIMIT value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}" - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}" - name: AUTH_LDAP_PARSE_USERNAME value: "${AUTH_LDAP_PARSE_USERNAME}" - name: AUTH_LDAP_USERNAME_BEGIN_STRING value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}" - name: AUTH_LDAP_USERNAME_END_STRING value: "${AUTH_LDAP_USERNAME_END_STRING}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}" - name: AUTH_LDAP_ROLES_CTX_DN value: "${AUTH_LDAP_ROLES_CTX_DN}" - name: AUTH_LDAP_ROLE_FILTER value: "${AUTH_LDAP_ROLE_FILTER}" - name: AUTH_LDAP_ROLE_RECURSION value: "${AUTH_LDAP_ROLE_RECURSION}" - name: AUTH_LDAP_DEFAULT_ROLE value: "${AUTH_LDAP_DEFAULT_ROLE}" - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}" - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}" - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}" - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}" - name: AUTH_ROLE_MAPPER_REPLACE_ROLE value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}" volumes: - name: kieserver-keystore-volume secret: secretName: "${KIE_SERVER_HTTPS_SECRET}" ## H2 volume settings BEGIN - name: "${APPLICATION_NAME}-kie-pvol" persistentVolumeClaim: claimName: "${APPLICATION_NAME}-kie-claim" ## H2 volume settings END ## Place to add database deployment config - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: "${APPLICATION_NAME}-rhpamcentr-claim" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentr" spec: accessModes: - ReadWriteOnce resources: requests: storage: "${BUSINESS_CENTRAL_VOLUME_CAPACITY}" ## H2 persistent volume claim BEGIN - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: "${APPLICATION_NAME}-kie-claim" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" spec: accessModes: - ReadWriteMany resources: requests: storage: "${DB_VOLUME_CAPACITY}" ## H2 persistent volume claim END