Chapter 2. Preparing to deploy Red Hat Decision Manager in your OpenShift environment
Before deploying Red Hat Decision Manager in your OpenShift environment, you must complete several tasks. You do not need to repeat these tasks if you want to deploy additional images, for example, for new versions of decision services or for other decision services
2.1. Ensuring the availability of image streams and the image registry
To deploy Red Hat Decision Manager components on Red Hat OpenShift Container Platform, you must ensure that OpenShift can download the correct images from the Red Hat registry. To download the images, OpenShift requires image streams, which contain the information about the location of images. OpenShift also must be configured to authenticate with the Red Hat registry using your service account user name and password.
Some versions of the OpenShift environment include the required image streams. You must check if they are available. If image streams are available in OpenShift by default, you can use them if the OpenShift infrastructure is configured for registry authentication server. The administrator must complete the registry authentication configuration when installing the OpenShift environment.
Otherwise, you can configure registry authentication in your own project and install the image streams in that project.
Procedure
- Determine whether Red Hat OpenShift Container Platform is configured with the user name and password for Red Hat registry access. For details about the required configuration, see Configuring a Registry Location. If you are using an OpenShift Online subscription, it is configured for Red Hat registry access.
If Red Hat OpenShift Container Platform is configured with the user name and password for Red Hat registry access, enter the following commands:
$ oc get imagestreamtag -n openshift | grep rhdm74-decisioncentral-openshift $ oc get imagestreamtag -n openshift | grep rhdm74-kieserver-openshift
If the outputs of both commands are not empty, the required image streams are available in the
openshift
namespace and no further action is required.If the output of one or both of the commands is empty or if OpenShift is not configured with the user name and password for Red Hat registry access, complete the following steps:
-
Ensure you are logged in to OpenShift with the
oc
command and that your project is active. - Complete the steps documented in Registry Service Accounts for Shared Environments. You must log in to the Red Hat Customer Portal to access the document and to complete the steps to create a registry service account.
- Select the OpenShift Secret tab and click the link under Download secret to download the YAML secret file.
-
View the downloaded file and note the name that is listed in the
name:
entry. Enter the following commands:
oc create -f <file_name>.yaml oc secrets link default <secret_name> --for=pull oc secrets link builder <secret_name> --for=pull
Replace
<file_name>
with the name of the downloaded file and<secret_name>
with the name that is listed in thename:
entry of the file.-
Download the
rhdm-7.4.0-openshift-templates.zip
product deliverable file from the Software Downloads page and extract therhdm74-image-streams.yaml
file. Complete one of the following actions:
Enter the following command:
$ oc create -f rhdm74-image-streams.yaml
In the OpenShift Web UI, select Add to Project → Import YAML / JSON and then choose the file or paste its contents.
NoteIf you complete these steps, you install the image streams into the namespace of your project. In this case, when you deploy the templates, you must set the
IMAGE_STREAM_NAMESPACE
parameter to the name of this project.
-
Ensure you are logged in to OpenShift with the
2.2. Ensuring the availability of AMQ scaledown controller image streams for a high-availability deployment
If you want to deploy a Red Hat Decision Manager high-availability authoring environment, you must ensure that image streams for AMQ scaledown controller are available.
In Red Hat Decision Manager 7.4, high-availability Business Central functionality is for Technology Preview only. The AMQ scaledown controller image is also for Technology Preview only. For more information on Red Hat Technology Preview features, see Technology Preview Features Scope.
Prerequisites
- You ensured the availability of image streams and the image registry for Red Hat Decision Manager according to the instructions in Section 2.1, “Ensuring the availability of image streams and the image registry”.
Procedure
To ensure that image streams for AMQ scaledown controller are available, complete the following additional steps:
Verify if the AMQ scaledown controller image stream is present. Enter the following command:
$ oc get imagestreamtag -n openshift | grep amq-broker-72-scaledown-controller-openshift
If the output of the command is not empty, the required image stream is available in the
openshift
namespace and no further action is required.If the output of the commands is empty, complete the following steps:
- Download the amq-broker-7-scaledown-controller-image-streams.yaml file.
Complete one of the following actions:
Enter the following command:
$ oc create -f amq-broker-7-scaledown-controller-image-streams.yaml
In the OpenShift Web UI, select Add to Project → Import YAML / JSON and then choose the
amq-broker-7-scaledown-controller-image-streams.yaml
file or paste its contents.NoteIf you complete these steps, you install the image streams into the namespace of your project. In this case, when you deploy the templates, you must set the
AMQ_SCALEDOWN_CONTROLLER_IMAGE_STREAM_NAMESPACE
parameter to the name of this project.
2.3. Creating the secrets for Decision Server
OpenShift uses objects called secrets to hold sensitive information such as passwords or keystores. For more information about OpenShift secrets, see the Secrets chapter in the OpenShift documentation.
You must create an SSL certificate for HTTP access to Decision Server and provide it to your OpenShift environment as a secret.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Decision Server. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Decision Server.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Decision Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Decision Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedkieserver-app-secret
from the new keystore file:$ oc create secret generic kieserver-app-secret --from-file=keystore.jks
2.4. Creating the secrets for Business Central
You must create an SSL certificate for HTTP access to Business Central and provide it to your OpenShift environment as a secret.
Do not use the same certificate and keystore for Business Central and Decision Server.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Decision Server. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Business Central.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Decision Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Decision Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret nameddecisioncentral-app-secret
from the new keystore file:$ oc create secret generic decisioncentral-app-secret --from-file=keystore.jks
2.5. Preparing a Maven mirror repository for offline use
If your Red Hat OpenShift Container Platform environment does not have outgoing access to the public Internet, you must prepare a Maven repository with a mirror of all the necessary artifacts and make this repository available to your environment.
You do not need to complete this procedure if your Red Hat OpenShift Container Platform environment is connected to the Internet.
Prerequisites
- A computer that has outgoing access to the public Internet is available.
Procedure
Prepare a Maven release repository to which you can write. The repository must allow read access without authentication. Your OpenShift environment must have access to this repository. You can deploy a Nexus repository manager in the OpenShift environment. For instructions about setting up Nexus on OpenShift, see Setting up Nexus. Use this repository as a separate mirror repository.
Alternatively, if you use a custom external repository (for example, Nexus) for your services, you can use the same repository as a mirror repository.
On the computer that has an outgoing connection to the public Internet, complete the following steps:
- Download the latest version of the Offliner tool.
-
Download the
rhdm-7.4.0-offliner.txt
product deliverable file from the Software Downloads page of the Red Hat Customer Portal. Enter the following command to use the Offliner tool to download the required artifacts:
java -jar offliner-<version>.jar -r https://maven.repository.redhat.com/ga/ -r https://repo1.maven.org/maven2/ -d /home/user/temp rhdm-7.4.0-offliner.txt
Replace
/home/user/temp
with an empty temporary directory and<version>
with the version of the Offliner tool that you downloaded. The download can take a significant amount of time.If the tool reports failed downloads, enter the following commands to download the artifacts that failed to download the first time:
grep Path: errors.log | sed -n -e 's/^.*Path: //p' > failed-downloads.txt java -jar offliner-<version>.jar -r https://maven.repository.redhat.com/ga/ -r https://repo1.maven.org/maven2/ -d /home/user/temp failed-downloads.txt
If failures are reported again and are a minority of the total number downloaded the first time, you can proceed.
- Upload all artifacts from the temporary directory to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility to upload the artifacts.
If you developed services outside Business Central and they have additional dependencies, add the dependencies to the mirror repository. If you developed the services as Maven projects, you can use the following steps to prepare these dependencies automatically. Complete the steps on the computer that has an outgoing connection to the public Internet.
-
Create a backup of the local Maven cache directory (
~/.m2/repository
) and then clear the directory. -
Build the source of your projects using the
mvn clean install
command. For every project, enter the following command to ensure that Maven downloads all runtime dependencies for all the artifacts generated by the project:
mvn -e -DskipTests dependency:go-offline -f /path/to/project/pom.xml --batch-mode -Djava.net.preferIPv4Stack=true
Replace
/path/to/project/pom.xml
with the correct path to thepom.xml
file of the project.-
Upload all artifacts from the local Maven cache directory (
~/.m2/repository
) to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility to upload the artifacts.
-
Create a backup of the local Maven cache directory (
2.6. Changing GlusterFS configuration
You must check whether your OpenShift environment uses GlusterFS to provide permanent storage volumes. If it uses GlusterFS, to ensure optimal performance, you must tune your GlusterFS storage by changing the storage class configuration.
Procedure
To check whether your environment uses GlusterFS, enter the following command:
oc get storageclass
In the results, check whether the
(default)
marker is on the storage class that listsglusterfs
. For example, in the following output the default storage class isgluster-container
, which does listglusterfs
:NAME PROVISIONER AGE gluster-block gluster.org/glusterblock 8d gluster-container (default) kubernetes.io/glusterfs 8d
If the result has a default storage class that does not list
glusterfs
or if the result is empty, you do not need to make any changes. In this case, skip the rest of this procedure.To save the configuration of the default storage class into a YAML file, enter the following command:
oc get storageclass <class-name> -o yaml >storage_config.yaml
Replace
<class-name>
with the name of the default storage class. Example:oc get storageclass gluster-container -o yaml >storage_config.yaml
Edit the
storage_config.yaml
file:Remove the lines with the following keys:
-
creationTimestamp
-
resourceVersion
-
selfLink
-
uid
-
On the line with the
volumeoptions
key, add the following two options:features.cache-invalidation on, performance.nl-cache on
. Example:volumeoptions: client.ssl off, server.ssl off, features.cache-invalidation on, performance.nl-cache on
To remove the existing default storage class, enter the following command:
oc delete storageclass <class-name>
Replace
<class-name>
with the name of the default storage class. Example:oc delete storageclass gluster-container
To re-create the storage class using the new configuration, enter the following command:
oc create -f storage_config.yaml