--- kind: Template apiVersion: v1 metadata: annotations: iconClass: icon-jboss tags: rhpam,processserver,jboss,prod version: "7.6" openshift.io/display-name: Red Hat Process Automation Manager 7.6 managed production environment. openshift.io/provider-display-name: Red Hat, Inc. description: Application template for a managed HA production runtime environment, for Red Hat Process Automation Manager 7.6 - Deprecated template.openshift.io/long-description: This template defines resources needed for a HA production runtime environment for Red Hat Process Automation Manager 7.6, including application deployment configuration, secure and insecure http communication and persistent volume to store data that needs to survive to a restart. Template for Red Hat OpenShift Container Platform version 3.11. Deprecated since Red Hat Process Automation Manager version 7.5; consider using the Red Hat Business Automation Operator. template.openshift.io/documentation-url: https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.6/html/deploying_a_red_hat_process_automation_manager_7.6_authoring_environment_on_red_hat_openshift_container_platform/ template.openshift.io/support-url: https://access.redhat.com template.openshift.io/bindable: "false" name: rhpam76-managed labels: template: rhpam76-managed rhpam: "7.6" message: |- A new environment has been set up for Red Hat Process Automation Manager 7. The user name/password for accessing Business Central Monitoring is User name: ${KIE_ADMIN_USER} Password: ${KIE_ADMIN_PWD} KIE servers are configured with the user name/password User name: ${KIE_SERVER_USER} Password: ${KIE_SERVER_PWD} Please be sure to create the secrets named "${BUSINESS_CENTRAL_HTTPS_SECRET}" and "${KIE_SERVER_HTTPS_SECRET}" containing the ${BUSINESS_CENTRAL_HTTPS_KEYSTORE} and ${KIE_SERVER_HTTPS_KEYSTORE} files used for serving secure content. parameters: - displayName: Application Name description: The name for the application. name: APPLICATION_NAME value: myapp required: true - displayName: Maven mirror URL description: Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for deploying your services. name: MAVEN_MIRROR_URL required: false - displayName: Maven mirror of description: Maven mirror configuration for KIE server. name: MAVEN_MIRROR_OF value: "external:*" required: false - displayName: Maven repository ID description: "The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won't be usable in MAVEN_MIRROR_OF." name: MAVEN_REPO_ID value: repo-custom required: false - displayName: Maven repository URL description: Fully qualified URL to a Maven repository or service. name: MAVEN_REPO_URL example: http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/ required: true - displayName: Maven repository user name description: User name for accessing the Maven repository, if required. name: MAVEN_REPO_USERNAME required: false - displayName: Maven repository password description: Password to access the Maven repository, if required. name: MAVEN_REPO_PASSWORD required: false - displayName: Name of the Business Central service description: The Service name for the optional Business Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required. name: BUSINESS_CENTRAL_SERVICE example: "myapp-rhpamcentrmon" required: false - displayName: User name for the Maven service hosted by Business Central description: User name for accessing the Maven service hosted by Business Central inside EAP. name: BUSINESS_CENTRAL_MAVEN_USERNAME example: "mavenUser" required: false - displayName: Password for the Maven service hosted by Business Central description: Password to access the Maven service hosted by Business Central inside EAP. name: BUSINESS_CENTRAL_MAVEN_PASSWORD example: "maven1!" required: false - displayName: KIE Admin User description: KIE administrator user name. name: KIE_ADMIN_USER value: adminUser required: false - displayName: KIE Admin Password description: KIE administrator password. name: KIE_ADMIN_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server User description: KIE server user name. (Sets the org.kie.server.user system property) name: KIE_SERVER_USER value: executionUser required: false - displayName: KIE Server Password description: KIE server password. (Sets the org.kie.server.pwd system property) name: KIE_SERVER_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false ## OpenShift Enhancement BEGIN - displayName: Enable KIE server global discovery description: "If set to true, turns on KIE server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)" name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED value: "false" required: false - displayName: Prefer KIE Server OpenShift Service description: If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property) name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE value: "true" required: false - displayName: KIE ServerTemplate Cache TTL description: KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property) name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL value: "60000" required: false ## OpenShift Enhancement END - displayName: ImageStream Namespace description: Namespace in which the ImageStreams for Red Hat Process Automation Manager images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project. name: IMAGE_STREAM_NAMESPACE value: openshift required: true - displayName: KIE Server ImageStream Name description: The name of the image stream to use for KIE server. Default is "rhpam-kieserver-rhel8". name: KIE_SERVER_IMAGE_STREAM_NAME value: "rhpam-kieserver-rhel8" required: true - displayName: ImageStream Tag description: A named pointer to an image in an image stream. Default is "7.6.0". name: IMAGE_STREAM_TAG value: "7.6.0" required: true - displayName: KIE Server Controller User description: KIE server controller user name. (Sets the org.kie.server.controller.user system property) name: KIE_SERVER_CONTROLLER_USER value: controllerUser required: false - displayName: KIE Server Controller Password description: KIE server controller password. (Sets the org.kie.server.controller.pwd system property) name: KIE_SERVER_CONTROLLER_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server Controller Token description: KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property) name: KIE_SERVER_CONTROLLER_TOKEN required: false - displayName: KIE Server Persistence DS description: KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property) name: KIE_SERVER_PERSISTENCE_DS value: java:/jboss/datasources/rhpam required: false ## PostgreSQL database parameters BEGIN - displayName: PostgreSQL ImageStream Namespace description: Namespace in which the ImageStream for the PostgreSQL image is installed. The ImageStream is already installed in the openshift namespace. You should only need to modify this if you installed the ImageStream in a different namespace/project. Default is "openshift". name: POSTGRESQL_IMAGE_STREAM_NAMESPACE value: "openshift" required: false - displayName: PostgreSQL ImageStream Tag description: The PostgreSQL image version, which is intended to correspond to the PostgreSQL version. Default is "10". name: POSTGRESQL_IMAGE_STREAM_TAG value: "10" required: false - displayName: KIE Server PostgreSQL Database User description: KIE server PostgreSQL database user name. name: KIE_SERVER_POSTGRESQL_USER value: rhpam required: false - displayName: KIE Server PostgreSQL Database Password description: KIE server PostgreSQL database password. name: KIE_SERVER_POSTGRESQL_PWD from: "[a-zA-Z]{6}[0-9]{1}!" generate: expression required: false - displayName: KIE Server PostgreSQL Database Name description: KIE server PostgreSQL database name. name: KIE_SERVER_POSTGRESQL_DB value: rhpam7 required: false - displayName: PostgreSQL Database max prepared connections description: Allows the PostgreSQL to handle XA transactions. name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS value: '100' required: true - displayName: Database Volume Capacity description: Size of persistent storage for the database volume. name: DB_VOLUME_CAPACITY value: 1Gi required: true - displayName: KIE Server PostgreSQL Dialect description: KIE server PostgreSQL Hibernate dialect. name: KIE_SERVER_POSTGRESQL_DIALECT value: org.hibernate.dialect.PostgreSQLDialect required: true ## PostgreSQL database parameters END - displayName: KIE Server Mode description: "The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property)." name: KIE_SERVER_MODE value: "PRODUCTION" required: false - displayName: KIE MBeans description: KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties) name: KIE_MBEANS value: enabled required: false - displayName: Drools Server Filter Classes description: KIE server class filtering. (Sets the org.drools.server.filter.classes system property) name: DROOLS_SERVER_FILTER_CLASSES value: 'true' required: false - displayName: Prometheus Server Extension Disabled description: If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property) name: PROMETHEUS_SERVER_EXT_DISABLED example: 'false' required: false - displayName: Business Central Monitoring Custom http Route Hostname description: 'Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure--rhpamcentrmon-.' name: BUSINESS_CENTRAL_HOSTNAME_HTTP value: '' required: false - displayName: Business Central Monitoring Custom https Route Hostname description: 'Custom hostname for https service route. Leave blank for default hostname, e.g.: -rhpamcentrmon-.' name: BUSINESS_CENTRAL_HOSTNAME_HTTPS value: '' required: false - displayName: KIE Server Custom http Route Hostname description: 'Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure--kieserver-.' name: KIE_SERVER_HOSTNAME_HTTP value: '' required: false - displayName: KIE Server Custom https Route Hostname description: 'Custom hostname for https service route. Leave blank for default hostname, e.g.: -kieserver-.' name: KIE_SERVER_HOSTNAME_HTTPS value: '' required: false - displayName: Business Central Monitoring Server Keystore Secret Name description: The name of the secret containing the keystore file for Business Central. name: BUSINESS_CENTRAL_HTTPS_SECRET example: businesscentral-app-secret required: true - displayName: Business Central Monitoring Server Keystore Filename description: The name of the keystore file within the secret. name: BUSINESS_CENTRAL_HTTPS_KEYSTORE value: keystore.jks required: false - displayName: Business Central Monitoring Server Certificate Name description: The name associated with the server certificate. name: BUSINESS_CENTRAL_HTTPS_NAME value: jboss required: false - displayName: Business Central Monitoring Server Keystore Password description: The password for the keystore and certificate. name: BUSINESS_CENTRAL_HTTPS_PASSWORD value: mykeystorepass required: false - displayName: KIE Server Keystore Secret Name description: The name of the secret containing the keystore file for KIE server. name: KIE_SERVER_HTTPS_SECRET example: kieserver-app-secret required: true - displayName: KIE Server Keystore Filename description: The name of the keystore file within the secret. name: KIE_SERVER_HTTPS_KEYSTORE value: keystore.jks required: false - displayName: KIE Server Certificate Name description: The name associated with the server certificate. name: KIE_SERVER_HTTPS_NAME value: jboss required: false - displayName: KIE Server Keystore Password description: The password for the keystore and certificate. name: KIE_SERVER_HTTPS_PASSWORD value: mykeystorepass required: false - displayName: KIE Server Bypass Auth User description: Allows the KIE server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property) name: KIE_SERVER_BYPASS_AUTH_USER value: 'false' required: false - displayName: "Timer service data store refresh interval (in milliseconds)" description: "Sets refresh-interval for the EJB timer service database-data-store." name: TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL value: '30000' required: false - displayName: Business Central Monitoring Container Memory Limit description: Business Central Monitoring Container memory limit. name: BUSINESS_CENTRAL_MEMORY_LIMIT value: 2Gi required: false - displayName: KIE Server Container Memory Limit description: KIE server Container memory limit. name: KIE_SERVER_MEMORY_LIMIT value: 1Gi required: false - displayName: Business Central Monitoring Container Replicas description: Business Central Monitoring Container Replicas, will define how much Business Central Monitoring containers will be started. name: BUSINESS_CENTRAL_MONITORING_CONTAINER_REPLICAS value: '3' required: true - displayName: KIE Server Container Replicas description: KIE Server Container Replicas, will define how much KIE Server containers will be started. name: KIE_SERVER_CONTAINER_REPLICAS value: '3' required: true - displayName: RH-SSO URL description: RH-SSO URL. name: SSO_URL example: https://rh-sso.example.com/auth required: false - displayName: RH-SSO Realm name description: RH-SSO Realm name. name: SSO_REALM required: false - displayName: Business Central Monitoring RH-SSO Client name description: Business Central Monitoring RH-SSO Client name. name: BUSINESS_CENTRAL_SSO_CLIENT required: false - displayName: Business Central Monitoring RH-SSO Client Secret description: Business Central Monitoring RH-SSO Client Secret. name: BUSINESS_CENTRAL_SSO_SECRET example: "252793ed-7118-4ca8-8dab-5622fa97d892" required: false - displayName: KIE Server RH-SSO Client name description: KIE Server RH-SSO Client name. name: KIE_SERVER_SSO_CLIENT required: false - displayName: KIE Server RH-SSO Client Secret description: KIE Server RH-SSO Client Secret. name: KIE_SERVER_SSO_SECRET example: "252793ed-7118-4ca8-8dab-5622fa97d892" required: false - displayName: RH-SSO Realm admin user name description: RH-SSO Realm admin user name for creating the Client if it doesn't exist. name: SSO_USERNAME required: false - displayName: RH-SSO Realm Admin Password description: RH-SSO Realm Admin Password used to create the Client. name: SSO_PASSWORD required: false - displayName: RH-SSO Disable SSL Certificate Validation description: RH-SSO Disable SSL Certificate Validation. name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "false" required: false - displayName: RH-SSO Principal Attribute description: RH-SSO Principal Attribute to use as user name. name: SSO_PRINCIPAL_ATTRIBUTE value: preferred_username required: false - displayName: LDAP Endpoint description: LDAP Endpoint to connect for authentication. name: AUTH_LDAP_URL example: "ldap://myldap.example.com" required: false - displayName: LDAP Bind DN description: Bind DN used for authentication. name: AUTH_LDAP_BIND_DN example: "uid=admin,ou=users,ou=example,ou=com" required: false - displayName: LDAP Bind Credentials description: LDAP Credentials used for authentication. name: AUTH_LDAP_BIND_CREDENTIAL example: "Password" required: false - displayName: LDAP JAAS Security Domain description: The JMX ObjectName of the JaasSecurityDomain used to decrypt the password. name: AUTH_LDAP_JAAS_SECURITY_DOMAIN required: false - displayName: LDAP Base DN description: LDAP Base DN of the top-level context to begin the user search. name: AUTH_LDAP_BASE_CTX_DN example: "ou=users,ou=example,ou=com" required: false - displayName: LDAP Base Search filter description: LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}). name: AUTH_LDAP_BASE_FILTER example: "(uid={0})" required: false - displayName: LDAP Search scope description: The search scope to use. name: AUTH_LDAP_SEARCH_SCOPE example: "SUBTREE_SCOPE" required: false - displayName: LDAP Search time limit description: The timeout in milliseconds for user or role searches. name: AUTH_LDAP_SEARCH_TIME_LIMIT example: "10000" required: false - displayName: LDAP DN attribute description: The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used. name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE example: "distinguishedName" required: false - displayName: LDAP Parse username description: A flag indicating if the DN is to be parsed for the user name. If set to true, the DN is parsed for the user name. If set to false the DN is not parsed for the user name. This option is used together with usernameBeginString and usernameEndString. name: AUTH_LDAP_PARSE_USERNAME example: "true" required: false - displayName: LDAP Username begin string description: Defines the String which is to be removed from the start of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true. name: AUTH_LDAP_USERNAME_BEGIN_STRING required: false - displayName: LDAP Username end string description: Defines the String which is to be removed from the end of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true. name: AUTH_LDAP_USERNAME_END_STRING required: false - displayName: LDAP Role attributeID description: Name of the attribute containing the user roles. name: AUTH_LDAP_ROLE_ATTRIBUTE_ID example: memberOf required: false - displayName: LDAP Roles Search DN description: The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is. name: AUTH_LDAP_ROLES_CTX_DN example: "ou=groups,ou=example,ou=com" required: false - displayName: LDAP Role search filter description: A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}). name: AUTH_LDAP_ROLE_FILTER example: "(memberOf={1})" required: false - displayName: LDAP Role recursion description: The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0. name: AUTH_LDAP_ROLE_RECURSION example: "1" required: false - displayName: LDAP Default role description: A role included for all authenticated users name: AUTH_LDAP_DEFAULT_ROLE example: "user" required: false - displayName: LDAP Role name attribute ID description: Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute. name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID example: "name" required: false - displayName: LDAP Role DN contains roleNameAttributeID description: A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries. name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN example: "false" required: false - displayName: LDAP Role Attribute ID is DN description: Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true. name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN example: "false" required: false - displayName: LDAP Referral user attribute ID description: If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree. name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK required: false - displayName: RoleMapping rolesProperties file path description: When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3 name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES required: false - displayName: RoleMapping replaceRole property description: Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true. name: AUTH_ROLE_MAPPER_REPLACE_ROLE required: false objects: - kind: ServiceAccount apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamsvc" labels: application: "${APPLICATION_NAME}" - kind: RoleBinding apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamsvc-edit" labels: application: "${APPLICATION_NAME}" subjects: - kind: ServiceAccount name: "${APPLICATION_NAME}-rhpamsvc" roleRef: name: edit - kind: Service apiVersion: v1 spec: ports: - name: http port: 8080 targetPort: 8080 - name: https port: 8443 targetPort: 8443 selector: deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon" metadata: name: "${APPLICATION_NAME}-rhpamcentrmon" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" annotations: description: All the Business Central Monitoring web server's ports. - kind: Service apiVersion: v1 spec: clusterIP: "None" ports: - name: "ping" port: 8888 targetPort: 8888 selector: deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon" metadata: name: "${APPLICATION_NAME}-rhpamcentrmon-ping" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" annotations: service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" description: "The JGroups ping port for clustering." ## KIE server services BEGIN - kind: Service apiVersion: v1 spec: ports: - name: http port: 8080 targetPort: 8080 - name: https port: 8443 targetPort: 8443 selector: deploymentConfig: "${APPLICATION_NAME}-kieserver" sessionAffinity: ClientIP sessionAffinityConfig: clientIP: timeoutSeconds: 3600 metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: All the KIE server web server's ports. (First KIE server) - kind: Service apiVersion: v1 spec: clusterIP: "None" ports: - name: "ping" port: 8888 targetPort: 8888 selector: deploymentConfig: "${APPLICATION_NAME}-kieserver" metadata: name: "${APPLICATION_NAME}-kieserver-ping" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: service.alpha.kubernetes.io/tolerate-unready-endpoints: "true" description: "The JGroups ping port for clustering." ## KIE server services END ## PostgreSQL service BEGIN - apiVersion: v1 kind: Service metadata: annotations: description: The first database server's port. labels: application: ${APPLICATION_NAME} service: "${APPLICATION_NAME}-postgresql" name: ${APPLICATION_NAME}-postgresql spec: ports: - port: 5432 targetPort: 5432 selector: deploymentConfig: ${APPLICATION_NAME}-postgresql ## PostgreSQL service END - kind: Route apiVersion: v1 id: "insecure-${APPLICATION_NAME}-rhpamcentrmon-http" metadata: name: "insecure-${APPLICATION_NAME}-rhpamcentrmon" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" annotations: description: Route for Business Central Monitoring's http service. haproxy.router.openshift.io/timeout: 1h spec: host: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}" to: name: "${APPLICATION_NAME}-rhpamcentrmon" port: targetPort: http - kind: Route apiVersion: v1 id: "${APPLICATION_NAME}-rhpamcentrmon-https" metadata: name: "${APPLICATION_NAME}-rhpamcentrmon" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" annotations: description: Route for Business Central Monitoring's https service. haproxy.router.openshift.io/timeout: 1h spec: host: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}" to: name: "${APPLICATION_NAME}-rhpamcentrmon" port: targetPort: https tls: termination: passthrough ## KIE server routes BEGIN - kind: Route apiVersion: v1 id: "insecure-${APPLICATION_NAME}-kieserver-http" metadata: name: "insecure-${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: Route for First KIE server's http service. haproxy.router.openshift.io/balance: source spec: host: "${KIE_SERVER_HOSTNAME_HTTP}" to: name: "${APPLICATION_NAME}-kieserver" port: targetPort: http - kind: Route apiVersion: v1 id: "${APPLICATION_NAME}-kieserver-https" metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" annotations: description: Route for First KIE server's https service. spec: host: "${KIE_SERVER_HOSTNAME_HTTPS}" to: name: "${APPLICATION_NAME}-kieserver" port: targetPort: https tls: termination: passthrough ## KIE server routes END - kind: DeploymentConfig apiVersion: v1 metadata: name: "${APPLICATION_NAME}-rhpamcentrmon" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" annotations: template.alpha.openshift.io/wait-for-ready: "true" spec: strategy: rollingParams: maxSurge: 100% maxUnavailable: 0 type: Rolling triggers: - type: ImageChange imageChangeParams: automatic: true containerNames: - "${APPLICATION_NAME}-rhpamcentrmon" from: kind: ImageStreamTag namespace: "${IMAGE_STREAM_NAMESPACE}" name: "rhpam-businesscentral-monitoring-rhel8:${IMAGE_STREAM_TAG}" - type: ConfigChange replicas: "${{BUSINESS_CENTRAL_MONITORING_CONTAINER_REPLICAS}}" selector: deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon" template: metadata: name: "${APPLICATION_NAME}-rhpamcentrmon" labels: deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon" application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" spec: serviceAccountName: "${APPLICATION_NAME}-rhpamsvc" terminationGracePeriodSeconds: 60 containers: - name: "${APPLICATION_NAME}-rhpamcentrmon" image: rhpam-businesscentral-monitoring-rhel8 imagePullPolicy: Always resources: limits: memory: "${BUSINESS_CENTRAL_MEMORY_LIMIT}" volumeMounts: - name: businesscentral-keystore-volume mountPath: "/etc/businesscentral-secret-volume" readOnly: true - name: "${APPLICATION_NAME}-rhpamcentr-pvol" mountPath: "/opt/kie/data" livenessProbe: httpGet: path: /rest/healthy port: 8080 scheme: HTTP initialDelaySeconds: 180 timeoutSeconds: 2 periodSeconds: 15 readinessProbe: httpGet: path: /rest/ready port: 8080 scheme: HTTP initialDelaySeconds: 30 timeoutSeconds: 2 periodSeconds: 5 failureThreshold: 36 ports: - name: jolokia containerPort: 8778 protocol: TCP - name: http containerPort: 8080 protocol: TCP - name: https containerPort: 8443 protocol: TCP - name: ping containerPort: 8888 protocol: TCP env: - name: APPLICATION_USERS_PROPERTIES value: "/opt/kie/data/configuration/application-users.properties" - name: APPLICATION_ROLES_PROPERTIES value: "/opt/kie/data/configuration/application-roles.properties" - name: KIE_ADMIN_PWD value: "${KIE_ADMIN_PWD}" - name: KIE_ADMIN_USER value: "${KIE_ADMIN_USER}" - name: KIE_SERVER_PWD value: "${KIE_SERVER_PWD}" - name: KIE_SERVER_USER value: "${KIE_SERVER_USER}" - name: MAVEN_MIRROR_URL value: "${MAVEN_MIRROR_URL}" - name: MAVEN_REPO_ID value: "${MAVEN_REPO_ID}" - name: MAVEN_REPO_URL value: "${MAVEN_REPO_URL}" - name: MAVEN_REPO_USERNAME value: "${MAVEN_REPO_USERNAME}" - name: MAVEN_REPO_PASSWORD value: "${MAVEN_REPO_PASSWORD}" ## OpenShift Enhancement BEGIN - name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED}" - name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}" - name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL value: "${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}" - name: KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED value: "true" ## OpenShift Enhancement END - name: KIE_SERVER_CONTROLLER_USER value: "${KIE_SERVER_CONTROLLER_USER}" - name: KIE_SERVER_CONTROLLER_PWD value: "${KIE_SERVER_CONTROLLER_PWD}" - name: KIE_SERVER_CONTROLLER_TOKEN value: "${KIE_SERVER_CONTROLLER_TOKEN}" - name: HTTPS_KEYSTORE_DIR value: "/etc/businesscentral-secret-volume" - name: HTTPS_KEYSTORE value: "${BUSINESS_CENTRAL_HTTPS_KEYSTORE}" - name: HTTPS_NAME value: "${BUSINESS_CENTRAL_HTTPS_NAME}" - name: HTTPS_PASSWORD value: "${BUSINESS_CENTRAL_HTTPS_PASSWORD}" - name: JGROUPS_PING_PROTOCOL value: "openshift.DNS_PING" - name: OPENSHIFT_DNS_PING_SERVICE_NAME value: "${APPLICATION_NAME}-rhpamcentrmon-ping" - name: OPENSHIFT_DNS_PING_SERVICE_PORT value: "8888" - name: SSO_URL value: "${SSO_URL}" - name: SSO_OPENIDCONNECT_DEPLOYMENTS value: "ROOT.war" - name: SSO_REALM value: "${SSO_REALM}" - name: SSO_SECRET value: "${BUSINESS_CENTRAL_SSO_SECRET}" - name: SSO_CLIENT value: "${BUSINESS_CENTRAL_SSO_CLIENT}" - name: SSO_USERNAME value: "${SSO_USERNAME}" - name: SSO_PASSWORD value: "${SSO_PASSWORD}" - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}" - name: SSO_PRINCIPAL_ATTRIBUTE value: "${SSO_PRINCIPAL_ATTRIBUTE}" - name: HOSTNAME_HTTP value: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}" - name: HOSTNAME_HTTPS value: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}" - name: AUTH_LDAP_URL value: "${AUTH_LDAP_URL}" - name: AUTH_LDAP_BIND_DN value: "${AUTH_LDAP_BIND_DN}" - name: AUTH_LDAP_BIND_CREDENTIAL value: "${AUTH_LDAP_BIND_CREDENTIAL}" - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}" - name: AUTH_LDAP_BASE_CTX_DN value: "${AUTH_LDAP_BASE_CTX_DN}" - name: AUTH_LDAP_BASE_FILTER value: "${AUTH_LDAP_BASE_FILTER}" - name: AUTH_LDAP_SEARCH_SCOPE value: "${AUTH_LDAP_SEARCH_SCOPE}" - name: AUTH_LDAP_SEARCH_TIME_LIMIT value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}" - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}" - name: AUTH_LDAP_PARSE_USERNAME value: "${AUTH_LDAP_PARSE_USERNAME}" - name: AUTH_LDAP_USERNAME_BEGIN_STRING value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}" - name: AUTH_LDAP_USERNAME_END_STRING value: "${AUTH_LDAP_USERNAME_END_STRING}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}" - name: AUTH_LDAP_ROLES_CTX_DN value: "${AUTH_LDAP_ROLES_CTX_DN}" - name: AUTH_LDAP_ROLE_FILTER value: "${AUTH_LDAP_ROLE_FILTER}" - name: AUTH_LDAP_ROLE_RECURSION value: "${AUTH_LDAP_ROLE_RECURSION}" - name: AUTH_LDAP_DEFAULT_ROLE value: "${AUTH_LDAP_DEFAULT_ROLE}" - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}" - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}" - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}" - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}" - name: AUTH_ROLE_MAPPER_REPLACE_ROLE value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}" volumes: - name: businesscentral-keystore-volume secret: secretName: "${BUSINESS_CENTRAL_HTTPS_SECRET}" - name: "${APPLICATION_NAME}-rhpamcentr-pvol" persistentVolumeClaim: claimName: "${APPLICATION_NAME}-rhpamcentr-claim" ## KIE server deployment config BEGIN - kind: DeploymentConfig apiVersion: v1 metadata: name: "${APPLICATION_NAME}-kieserver" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver" annotations: template.alpha.openshift.io/wait-for-ready: "true" spec: revisionHistoryLimit: 10 strategy: rollingParams: maxSurge: 100% maxUnavailable: 0 type: Rolling triggers: - type: ImageChange imageChangeParams: automatic: true containerNames: - "${APPLICATION_NAME}-kieserver" from: kind: ImageStreamTag namespace: "${IMAGE_STREAM_NAMESPACE}" name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}" - type: ConfigChange replicas: "${{KIE_SERVER_CONTAINER_REPLICAS}}" selector: deploymentConfig: "${APPLICATION_NAME}-kieserver" template: metadata: name: "${APPLICATION_NAME}-kieserver" labels: deploymentConfig: "${APPLICATION_NAME}-kieserver" application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-kieserver" services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver" spec: serviceAccountName: "${APPLICATION_NAME}-rhpamsvc" terminationGracePeriodSeconds: 90 containers: - name: "${APPLICATION_NAME}-kieserver" image: "${KIE_SERVER_IMAGE_STREAM_NAME}" imagePullPolicy: Always lifecycle: postStart: exec: command: - /bin/sh - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh preStop: exec: command: - /bin/sh - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh resources: limits: memory: "${KIE_SERVER_MEMORY_LIMIT}" volumeMounts: - name: kieserver-keystore-volume mountPath: "/etc/kieserver-secret-volume" readOnly: true livenessProbe: httpGet: path: /services/rest/server/healthcheck port: 8080 scheme: HTTP initialDelaySeconds: 180 timeoutSeconds: 2 periodSeconds: 15 failureThreshold: 3 readinessProbe: httpGet: path: /services/rest/server/readycheck port: 8080 scheme: HTTP initialDelaySeconds: 30 timeoutSeconds: 2 periodSeconds: 5 failureThreshold: 36 ports: - name: jolokia containerPort: 8778 protocol: TCP - name: http containerPort: 8080 protocol: TCP - name: https containerPort: 8443 protocol: TCP - name: ping containerPort: 8888 protocol: TCP env: - name: WORKBENCH_SERVICE_NAME value: "${APPLICATION_NAME}-rhpamcentrmon" - name: KIE_ADMIN_USER value: "${KIE_ADMIN_USER}" - name: KIE_ADMIN_PWD value: "${KIE_ADMIN_PWD}" - name: KIE_SERVER_MODE value: "${KIE_SERVER_MODE}" - name: KIE_MBEANS value: "${KIE_MBEANS}" - name: DROOLS_SERVER_FILTER_CLASSES value: "${DROOLS_SERVER_FILTER_CLASSES}" - name: PROMETHEUS_SERVER_EXT_DISABLED value: "${PROMETHEUS_SERVER_EXT_DISABLED}" - name: KIE_SERVER_BYPASS_AUTH_USER value: "${KIE_SERVER_BYPASS_AUTH_USER}" - name: KIE_SERVER_ID valueFrom: fieldRef: fieldPath: metadata.labels['services.server.kie.org/kie-server-id'] - name: KIE_SERVER_ROUTE_NAME value: "${APPLICATION_NAME}-kieserver" - name: KIE_SERVER_STARTUP_STRATEGY value: "OpenShiftStartupStrategy" - name: KIE_SERVER_USER value: "${KIE_SERVER_USER}" - name: KIE_SERVER_PWD value: "${KIE_SERVER_PWD}" - name: MAVEN_MIRROR_URL value: "${MAVEN_MIRROR_URL}" - name: MAVEN_MIRROR_OF value: "${MAVEN_MIRROR_OF}" - name: MAVEN_REPOS value: "RHPAMCENTR,EXTERNAL" - name: RHPAMCENTR_MAVEN_REPO_ID value: "repo-rhpamcentr" - name: RHPAMCENTR_MAVEN_REPO_SERVICE value: "${BUSINESS_CENTRAL_SERVICE}" - name: RHPAMCENTR_MAVEN_REPO_PATH value: "/maven2/" - name: RHPAMCENTR_MAVEN_REPO_USERNAME value: "${BUSINESS_CENTRAL_MAVEN_USERNAME}" - name: RHPAMCENTR_MAVEN_REPO_PASSWORD value: "${BUSINESS_CENTRAL_MAVEN_PASSWORD}" - name: EXTERNAL_MAVEN_REPO_ID value: "${MAVEN_REPO_ID}" - name: EXTERNAL_MAVEN_REPO_URL value: "${MAVEN_REPO_URL}" - name: EXTERNAL_MAVEN_REPO_USERNAME value: "${MAVEN_REPO_USERNAME}" - name: EXTERNAL_MAVEN_REPO_PASSWORD value: "${MAVEN_REPO_PASSWORD}" - name: KIE_SERVER_PERSISTENCE_DS value: "${KIE_SERVER_PERSISTENCE_DS}" - name: DATASOURCES value: "RHPAM" - name: RHPAM_JNDI value: "${KIE_SERVER_PERSISTENCE_DS}" - name: RHPAM_JTA value: "true" ## PostgreSQL driver settings BEGIN - name: RHPAM_DATABASE value: "${KIE_SERVER_POSTGRESQL_DB}" - name: RHPAM_DRIVER value: "postgresql" - name: KIE_SERVER_PERSISTENCE_DIALECT value: "${KIE_SERVER_POSTGRESQL_DIALECT}" - name: RHPAM_USERNAME value: "${KIE_SERVER_POSTGRESQL_USER}" - name: RHPAM_PASSWORD value: "${KIE_SERVER_POSTGRESQL_PWD}" - name: RHPAM_SERVICE_HOST value: "${APPLICATION_NAME}-postgresql" - name: RHPAM_SERVICE_PORT value: "5432" ## PostgreSQL driver settings END - name: TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL value: "${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}" - name: HTTPS_KEYSTORE_DIR value: "/etc/kieserver-secret-volume" - name: HTTPS_KEYSTORE value: "${KIE_SERVER_HTTPS_KEYSTORE}" - name: HTTPS_NAME value: "${KIE_SERVER_HTTPS_NAME}" - name: HTTPS_PASSWORD value: "${KIE_SERVER_HTTPS_PASSWORD}" - name: JGROUPS_PING_PROTOCOL value: "openshift.DNS_PING" - name: OPENSHIFT_DNS_PING_SERVICE_NAME value: "${APPLICATION_NAME}-kieserver-ping" - name: OPENSHIFT_DNS_PING_SERVICE_PORT value: "8888" - name: SSO_URL value: "${SSO_URL}" - name: SSO_OPENIDCONNECT_DEPLOYMENTS value: "ROOT.war" - name: SSO_REALM value: "${SSO_REALM}" - name: SSO_SECRET value: "${KIE_SERVER_SSO_SECRET}" - name: SSO_CLIENT value: "${KIE_SERVER_SSO_CLIENT}" - name: SSO_USERNAME value: "${SSO_USERNAME}" - name: SSO_PASSWORD value: "${SSO_PASSWORD}" - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}" - name: SSO_PRINCIPAL_ATTRIBUTE value: "${SSO_PRINCIPAL_ATTRIBUTE}" - name: HOSTNAME_HTTP value: "${KIE_SERVER_HOSTNAME_HTTP}" - name: HOSTNAME_HTTPS value: "${KIE_SERVER_HOSTNAME_HTTPS}" - name: AUTH_LDAP_URL value: "${AUTH_LDAP_URL}" - name: AUTH_LDAP_BIND_DN value: "${AUTH_LDAP_BIND_DN}" - name: AUTH_LDAP_BIND_CREDENTIAL value: "${AUTH_LDAP_BIND_CREDENTIAL}" - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}" - name: AUTH_LDAP_BASE_CTX_DN value: "${AUTH_LDAP_BASE_CTX_DN}" - name: AUTH_LDAP_BASE_FILTER value: "${AUTH_LDAP_BASE_FILTER}" - name: AUTH_LDAP_SEARCH_SCOPE value: "${AUTH_LDAP_SEARCH_SCOPE}" - name: AUTH_LDAP_SEARCH_TIME_LIMIT value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}" - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}" - name: AUTH_LDAP_PARSE_USERNAME value: "${AUTH_LDAP_PARSE_USERNAME}" - name: AUTH_LDAP_USERNAME_BEGIN_STRING value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}" - name: AUTH_LDAP_USERNAME_END_STRING value: "${AUTH_LDAP_USERNAME_END_STRING}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}" - name: AUTH_LDAP_ROLES_CTX_DN value: "${AUTH_LDAP_ROLES_CTX_DN}" - name: AUTH_LDAP_ROLE_FILTER value: "${AUTH_LDAP_ROLE_FILTER}" - name: AUTH_LDAP_ROLE_RECURSION value: "${AUTH_LDAP_ROLE_RECURSION}" - name: AUTH_LDAP_DEFAULT_ROLE value: "${AUTH_LDAP_DEFAULT_ROLE}" - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}" - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}" - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}" - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}" - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}" - name: AUTH_ROLE_MAPPER_REPLACE_ROLE value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}" volumes: - name: kieserver-keystore-volume secret: secretName: "${KIE_SERVER_HTTPS_SECRET}" initContainers: - command: - /bin/bash - '-c' - >- replicas=$(oc get dc ${APPLICATION_NAME}-postgresql -o=jsonpath='{.status.availableReplicas}'); until "[" $replicas -gt 0 "]"; do echo waiting for ${APPLICATION_NAME}-postgresql; replicas=$(oc get dc ${APPLICATION_NAME}-postgresql -o=jsonpath='{.status.availableReplicas}'); sleep 2; done; image: registry.redhat.io/openshift3/ose-cli imagePullPolicy: IfNotPresent name: ${APPLICATION_NAME}-postgresql-init terminationMessagePolicy: FallbackToLogsOnError ## KIE server deployment config END ## PostgreSQL deployment config BEGIN - kind: DeploymentConfig apiVersion: v1 metadata: name: "${APPLICATION_NAME}-postgresql" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-postgresql" annotations: template.alpha.openshift.io/wait-for-ready: "true" spec: strategy: type: Recreate triggers: - type: ImageChange imageChangeParams: automatic: true containerNames: - "${APPLICATION_NAME}-postgresql" from: kind: ImageStreamTag namespace: "${POSTGRESQL_IMAGE_STREAM_NAMESPACE}" name: "postgresql:${POSTGRESQL_IMAGE_STREAM_TAG}" - type: ConfigChange replicas: 1 selector: deploymentConfig: "${APPLICATION_NAME}-postgresql" template: metadata: name: "${APPLICATION_NAME}-postgresql" labels: deploymentConfig: "${APPLICATION_NAME}-postgresql" application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-postgresql" spec: terminationGracePeriodSeconds: 60 containers: - name: "${APPLICATION_NAME}-postgresql" image: postgresql imagePullPolicy: Always livenessProbe: exec: command: - "/usr/libexec/check-container" - "--live" initialDelaySeconds: 120 timeoutSeconds: 10 readinessProbe: exec: command: - "/usr/libexec/check-container" initialDelaySeconds: 5 timeoutSeconds: 1 ports: - containerPort: 5432 protocol: TCP volumeMounts: - mountPath: "/var/lib/pgsql/data" name: "${APPLICATION_NAME}-postgresql-pvol" env: - name: POSTGRESQL_USER value: "${KIE_SERVER_POSTGRESQL_USER}" - name: POSTGRESQL_PASSWORD value: "${KIE_SERVER_POSTGRESQL_PWD}" - name: POSTGRESQL_DATABASE value: "${KIE_SERVER_POSTGRESQL_DB}" - name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS value: "${POSTGRESQL_MAX_PREPARED_TRANSACTIONS}" volumes: - name: "${APPLICATION_NAME}-postgresql-pvol" persistentVolumeClaim: claimName: "${APPLICATION_NAME}-postgresql-claim" ## PostgreSQL deployment config END ## PostgreSQL persistent volume claim BEGIN - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: "${APPLICATION_NAME}-postgresql-claim" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-postgresql" spec: accessModes: - ReadWriteOnce resources: requests: storage: "${DB_VOLUME_CAPACITY}" ## PostgreSQL persistent volume claim END - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: "${APPLICATION_NAME}-rhpamcentr-claim" labels: application: "${APPLICATION_NAME}" service: "${APPLICATION_NAME}-rhpamcentrmon" spec: accessModes: - ReadWriteMany resources: requests: storage: "64Mi"