Chapter 4. OpenShift template reference information

Red Hat Process Automation Manager provides the following OpenShift templates. To access the templates, download and extract the rhpam-7.3.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat customer portal.

  • rhpam73-prod-immutable-monitor.yaml provides a Business Central Monitoring instance and a Smart Router that you can use with immutable Process Servers. When you deploy this template, OpenShift displays the settings that you must then use for deploying the rhpam73-prod-immutable-kieserver.yaml template. For details about this template, see Section 4.1, “rhpam73-prod-immutable-monitor.yaml template”.
  • rhpam73-prod-immutable-kieserver.yaml provides an immutable Process Server. When you deploy this template, a source-to-image (S2I) build is triggered for one or several services that are to run on the Process Server. The Process Server can optionally be configured to connect to the Business Central Monitoring and Smart Router provided by rhpam73-prod-immutable-monitor.yaml. For details about this template, see Section 4.2, “rhpam73-prod-immutable-kieserver.yaml template”.
  • rhpam73-kieserver-externaldb.yaml provides a Process Server that uses an external database. You can configure the Process Server to connect to a Business Central. Also, you can copy sections from this template into another template to configure a Process Server in the other template to use an external database. For details about this template, see Section 4.3, “rhpam73-kieserver-externaldb.yaml template”.
  • rhpam73-kieserver-mysql.yaml provides a Process Server and a MySQL instance that the Process Server uses. You can configure the Process Server to connect to a Business Central. Also, you can copy sections from this template into another template to configure a Process Server in the other template to use MySQL and to provide the MySQL instance. For details about this template, see Section 4.4, “rhpam73-kieserver-mysql.yaml template”.
  • rhpam73-kieserver-postgresql.yaml provides a Process Server and a PostgreSQL instance that the Process Server uses. You can configure the Process Server to connect to a Business Central. Also, you can copy sections from this template into another template to configure a Process Server in the other template to use PostgreSQL and to provide the PostgreSQL instance. For details about this template, see Section 4.4, “rhpam73-kieserver-mysql.yaml template”.

4.1. rhpam73-prod-immutable-monitor.yaml template

Application template for a router and monitoring console in a production environment, for Red Hat Process Automation Manager 7.3

4.1.1. Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable nameImage Environment VariableDescriptionExample valueRequired

APPLICATION_NAME

 — 

The name for the application.

myapp

True

MAVEN_REPO_ID

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository, if set. Default is generated randomly.

repo-custom

False

MAVEN_REPO_URL

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/

False

MAVEN_REPO_USERNAME

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

 — 

False

MAVEN_REPO_PASSWORD

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

 — 

False

BUSINESS_CENTRAL_MAVEN_SERVICE

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required

myapp-rhpamcentr

False

BUSINESS_CENTRAL_MAVEN_USERNAME

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

False

BUSINESS_CENTRAL_MAVEN_PASSWORD

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

maven1!

False

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password

 — 

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password, used to connect to KIE servers. Generated value can be a suggestion to use for thew s2i various (Sets the org.kie.server.pwd system property)

 — 

False

KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE

KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE

If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)

false

False

KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL

KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL

KIE ServerTemplate Cache TTL in milliseconds (Sets the org.kie.server.controller.template.cache.ttl system property)

60000

False

KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED

KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED

If set to true, turns on OpenShift integration feature in Business Central. With OpenShift integration, Business Central automatically discovers and connects to any KIE server in the same namespace, provided that OpenShift integration (OpenShiftStartupStrategy) is enabled on the KIE server. (Sets the org.kie.workbench.controller.openshift.enabled system property)

false

False

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.

openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

False

SMART_ROUTER_HOSTNAME_HTTP

 — 

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-smartrouter-<project>.<default-domain-suffix>

 — 

False

SMART_ROUTER_HOSTNAME_HTTPS

 — 

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-smartrouter-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_ROUTER_ID

KIE_SERVER_ROUTER_ID

Router ID used when connecting to the controller. (Router property org.kie.server.router.id)

kie-server-router

True

KIE_SERVER_ROUTER_PROTOCOL

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

http

False

KIE_SERVER_ROUTER_URL_EXTERNAL

KIE_SERVER_ROUTER_URL_EXTERNAL

Public URL where the router can be found. Format http://<host>:<port> (Router property org.kie.server.router.url.external)

 — 

False

KIE_SERVER_ROUTER_NAME

KIE_SERVER_ROUTER_NAME

Router name used when connecting to the controller. (Router property org.kie.server.router.name)

KIE Server Router

True

KIE_SERVER_ROUTER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

smartrouter-app-secret

True

KIE_SERVER_ROUTER_HTTPS_KEYSTORE

 — 

The name of the keystore file within the secret.

keystore.jks

False

KIE_SERVER_ROUTER_HTTPS_NAME

KIE_SERVER_ROUTER_TLS_KEYSTORE_KEYALIAS

The name associated with the server certificate.

jboss

False

KIE_SERVER_ROUTER_HTTPS_PASSWORD

KIE_SERVER_ROUTER_TLS_KEYSTORE_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

KIE_SERVER_MONITOR_USER

KIE_SERVER_CONTROLLER_USER

KIE server monitor username. (Sets the org.kie.server.controller.user system property)

monitorUser

False

KIE_SERVER_MONITOR_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server monitor password. (Sets the org.kie.server.controller.pwd system property)

 — 

False

KIE_SERVER_MONITOR_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server monitor token for bearer authentication. (Sets the org.kie.server.controller.token system property)

 — 

False

BUSINESS_CENTRAL_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentrmon-<project>.<default-domain-suffix>

 — 

False

BUSINESS_CENTRAL_HOSTNAME_HTTPS

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentrmon-<project>.<default-domain-suffix>

 — 

False

BUSINESS_CENTRAL_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

businesscentral-app-secret

True

BUSINESS_CENTRAL_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret.

keystore.jks

False

BUSINESS_CENTRAL_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate.

jboss

False

BUSINESS_CENTRAL_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

BUSINESS_CENTRAL_MEMORY_LIMIT

 — 

Business Central Container memory limit.

2Gi

False

SMART_ROUTER_MEMORY_LIMIT

 — 

Smart Router Container memory limit.

512Mi

False

SSO_URL

SSO_URL

RH-SSO URL.

https://rh-sso.example.com/auth

False

SSO_REALM

SSO_REALM

RH-SSO Realm name.

 — 

False

BUSINESS_CENTRAL_SSO_CLIENT

SSO_CLIENT

Business Central Monitoring RH-SSO Client name.

 — 

False

BUSINESS_CENTRAL_SSO_SECRET

SSO_SECRET

Business Central Monitoring RH-SSO Client Secret.

252793ed-7118-4ca8-8dab-5622fa97d892

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

 — 

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

 — 

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

ldap://myldap.example.com

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

uid=admin,ou=users,ou=exmample,ou=com

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

Password

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

 — 

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

ou=users,ou=example,ou=com

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

(uid={0})

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

SUBTREE_SCOPE

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

10000

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

distinguishedName

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

true

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

memberOf

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

ou=groups,ou=example,ou=com

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

(memberOf={1})

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

1

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

guest

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

name

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

false

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

false

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

 — 

False

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

 — 

False

AUTH_ROLE_MAPPER_REPLACE_ROLE

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

 — 

False

4.1.2. Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

4.1.2.1. Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

ServicePortNameDescription

${APPLICATION_NAME}-rhpamcentrmon

8080

http

All the Business Central Monitoring web server’s ports.

8443

https

${APPLICATION_NAME}-rhpamcentrmon-ping

8888

ping

The JGroups ping port for clustering.

${APPLICATION_NAME}-smartrouter

9000

http

The smart router server http and https ports.

9443

https

4.1.2.2. Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

ServiceSecurityHostname

${APPLICATION_NAME}-rhpamcentrmon-http

none

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

${APPLICATION_NAME}-rhpamcentrmon-https

TLS passthrough

${BUSINESS_CENTRAL_HOSTNAME_HTTPS}

${APPLICATION_NAME}-smartrouter-http

none

${SMART_ROUTER_HOSTNAME_HTTP}

${APPLICATION_NAME}-smartrouter-https

TLS passthrough

${SMART_ROUTER_HOSTNAME_HTTPS}

4.1.2.3. Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

4.1.2.3.1. Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

DeploymentTriggers

${APPLICATION_NAME}-rhpamcentrmon

ImageChange

${APPLICATION_NAME}-smartrouter

ImageChange

4.1.2.3.2. Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

DeploymentReplicas

${APPLICATION_NAME}-rhpamcentrmon

1

${APPLICATION_NAME}-smartrouter

2

4.1.2.3.3. Pod Template
4.1.2.3.3.1. Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

DeploymentService Account

${APPLICATION_NAME}-rhpamcentrmon

${APPLICATION_NAME}-rhpamsvc

4.1.2.3.3.2. Image
DeploymentImage

${APPLICATION_NAME}-rhpamcentrmon

rhpam73-businesscentral-monitoring-openshift

${APPLICATION_NAME}-smartrouter

rhpam73-smartrouter-openshift

4.1.2.3.3.3. Readiness Probe

${APPLICATION_NAME}-rhpamcentrmon

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/kie-wb.jsp

4.1.2.3.3.4. Liveness Probe

${APPLICATION_NAME}-rhpamcentrmon

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/kie-wb.jsp

4.1.2.3.3.5. Exposed Ports
DeploymentsNamePortProtocol

${APPLICATION_NAME}-rhpamcentrmon

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

ping

8888

TCP

${APPLICATION_NAME}-smartrouter

http

9000

TCP

4.1.2.3.3.6. Image Environment Variables
DeploymentVariable nameDescriptionExample value

${APPLICATION_NAME}-rhpamcentrmon

KIE_ADMIN_PWD

KIE administrator password

${KIE_ADMIN_PWD}

KIE_ADMIN_USER

KIE administrator username

${KIE_ADMIN_USER}

KIE_SERVER_PWD

KIE server password, used to connect to KIE servers. Generated value can be a suggestion to use for thew s2i various (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

KIE_SERVER_USER

KIE server username (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_ID

 — 

repo-rhpamcentr

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required

${BUSINESS_CENTRAL_MAVEN_SERVICE}

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository, if set. Default is generated randomly.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE

If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)

${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}

KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL

KIE ServerTemplate Cache TTL in milliseconds (Sets the org.kie.server.controller.template.cache.ttl system property)

${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}

KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED

If set to true, turns on OpenShift integration feature in Business Central. With OpenShift integration, Business Central automatically discovers and connects to any KIE server in the same namespace, provided that OpenShift integration (OpenShiftStartupStrategy) is enabled on the KIE server. (Sets the org.kie.workbench.controller.openshift.enabled system property)

${KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED}

KIE_SERVER_CONTROLLER_USER

KIE server monitor username. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_MONITOR_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server monitor password. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_MONITOR_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server monitor token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_MONITOR_TOKEN}

HTTPS_KEYSTORE_DIR

 — 

/etc/businesscentral-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret.

${BUSINESS_CENTRAL_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate.

${BUSINESS_CENTRAL_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate.

${BUSINESS_CENTRAL_HTTPS_PASSWORD}

JGROUPS_PING_PROTOCOL

 — 

openshift.DNS_PING

OPENSHIFT_DNS_PING_SERVICE_NAME

 — 

${APPLICATION_NAME}-rhpamcentrmon-ping

OPENSHIFT_DNS_PING_SERVICE_PORT

 — 

8888

SSO_URL

RH-SSO URL.

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name.

${SSO_REALM}

SSO_SECRET

Business Central Monitoring RH-SSO Client Secret.

${BUSINESS_CENTRAL_SSO_SECRET}

SSO_CLIENT

Business Central Monitoring RH-SSO Client name.

${BUSINESS_CENTRAL_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentrmon-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentrmon-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

${AUTH_ROLE_MAPPER_REPLACE_ROLE}

${APPLICATION_NAME}-smartrouter

KIE_SERVER_ROUTER_HOST

 — 

 — 

KIE_SERVER_ROUTER_PORT

 — 

9000

KIE_SERVER_ROUTER_PORT_TLS

 — 

9443

KIE_SERVER_ROUTER_URL_EXTERNAL

Public URL where the router can be found. Format http://<host>:<port> (Router property org.kie.server.router.url.external)

${KIE_SERVER_ROUTER_URL_EXTERNAL}

KIE_SERVER_ROUTER_ID

Router ID used when connecting to the controller. (Router property org.kie.server.router.id)

${KIE_SERVER_ROUTER_ID}

KIE_SERVER_ROUTER_NAME

Router name used when connecting to the controller. (Router property org.kie.server.router.name)

${KIE_SERVER_ROUTER_NAME}

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

${KIE_SERVER_ROUTER_PROTOCOL}

KIE_SERVER_ROUTER_TLS_KEYSTORE_KEYALIAS

The name associated with the server certificate.

${KIE_SERVER_ROUTER_HTTPS_NAME}

KIE_SERVER_ROUTER_TLS_KEYSTORE_PASSWORD

The password for the keystore and certificate.

${KIE_SERVER_ROUTER_HTTPS_PASSWORD}

KIE_SERVER_ROUTER_TLS_KEYSTORE

 — 

/etc/smartrouter-secret-volume/${KIE_SERVER_ROUTER_HTTPS_KEYSTORE}

KIE_SERVER_CONTROLLER_USER

KIE server monitor username. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_MONITOR_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server monitor password. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_MONITOR_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server monitor token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_MONITOR_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

 — 

${APPLICATION_NAME}-rhpamcentrmon

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

http

KIE_SERVER_ROUTER_REPO

 — 

/opt/rhpam-smartrouter/data

KIE_SERVER_ROUTER_CONFIG_WATCHER_ENABLED

 — 

true

4.1.2.3.3.7. Volumes
DeploymentNamemountPathPurposereadOnly

${APPLICATION_NAME}-rhpamcentrmon

businesscentral-keystore-volume

/etc/businesscentral-secret-volume

ssl certs

True

${APPLICATION_NAME}-smartrouter

${APPLICATION_NAME}-smartrouter

/opt/rhpam-smartrouter/data

 — 

false

4.1.2.4. External Dependencies

4.1.2.4.1. Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

NameAccess Mode

${APPLICATION_NAME}-smartrouter-claim

ReadWriteMany

${APPLICATION_NAME}-rhpamcentr-claim

ReadWriteMany

4.1.2.4.2. Secrets

This template requires the following secrets to be installed for the application to run.

smartrouter-app-secret businesscentral-app-secret

4.2. rhpam73-prod-immutable-kieserver.yaml template

Application template for an immutable KIE server in a production environment, for Red Hat Process Automation Manager 7.3

4.2.1. Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable nameImage Environment VariableDescriptionExample valueRequired

APPLICATION_NAME

 — 

The name for the application.

myapp

True

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username.

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password.

 — 

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password, used to connect to KIE servers. Value is automatically generated by default. (Sets the org.kie.server.pwd system property)

 — 

False

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.

openshift

True

KIE_SERVER_IMAGE_STREAM_NAME

 — 

The name of the image stream to use for KIE server. Default is "rhpam73-kieserver-openshift".

rhpam73-kieserver-openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

True

KIE_SERVER_MONITOR_USER

KIE_SERVER_CONTROLLER_USER

KIE server monitor username, for optional use of Business Central Monitoring. (Sets the org.kie.server.controller.user system property)

monitorUser

False

KIE_SERVER_MONITOR_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server monitor password, for optional use of Business Central Monitoring. (Sets the org.kie.server.controller.pwd system property)

 — 

False

KIE_SERVER_MONITOR_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server monitor token for bearer authentication. (Sets the org.kie.server.controller.token system property)

 — 

False

KIE_SERVER_MONITOR_SERVICE

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

 — 

False

KIE_SERVER_ROUTER_SERVICE

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

 — 

False

KIE_SERVER_ROUTER_HOST

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

myapp-smartrouter

False

KIE_SERVER_ROUTER_PORT

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

9000

False

KIE_SERVER_ROUTER_PROTOCOL

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

http

False

KIE_SERVER_PERSISTENCE_DS

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

java:/jboss/datasources/rhpam

False

POSTGRESQL_IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStream for the PostgreSQL image is installed. The ImageStream is already installed in the openshift namespace. You should only need to modify this if you installed the ImageStream in a different namespace/project. Default is "openshift".

openshift

False

POSTGRESQL_IMAGE_STREAM_TAG

 — 

The PostgreSQL image version, which is intended to correspond to the PostgreSQL version. Default is "10".

10

False

KIE_SERVER_POSTGRESQL_USER

RHPAM_USERNAME

KIE server PostgreSQL database username.

rhpam

False

KIE_SERVER_POSTGRESQL_PWD

RHPAM_PASSWORD

KIE server PostgreSQL database password.

 — 

False

KIE_SERVER_POSTGRESQL_DB

RHPAM_DATABASE

KIE server PostgreSQL database name.

rhpam7

False

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

Allows the PostgreSQL to handle XA transactions.

100

True

DB_VOLUME_CAPACITY

 — 

Size of persistent storage for the database volume.

1Gi

True

KIE_SERVER_POSTGRESQL_DIALECT

KIE_SERVER_PERSISTENCE_DIALECT

KIE server PostgreSQL Hibernate dialect.

org.hibernate.dialect.PostgreSQLDialect

True

KIE_MBEANS

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

enabled

False

DROOLS_SERVER_FILTER_CLASSES

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

true

False

KIE_SERVER_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_HOSTNAME_HTTPS

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_USE_SECURE_ROUTE_NAME

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

false

False

KIE_SERVER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

kieserver-app-secret

True

KIE_SERVER_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret.

keystore.jks

False

KIE_SERVER_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate.

jboss

False

KIE_SERVER_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

KIE_SERVER_BYPASS_AUTH_USER

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

false

False

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version|c2=g2:a2:v2

rhpam-kieserver-library=org.openshift.quickstarts:rhpam-kieserver-library:1.4.0-SNAPSHOT

True

SOURCE_REPOSITORY_URL

 — 

Git source URI for application.

https://github.com/jboss-container-images/rhpam-7-openshift-image.git

True

SOURCE_REPOSITORY_REF

 — 

Git branch/tag reference.

master

False

CONTEXT_DIR

 — 

Path within Git project to build; empty for root project directory.

quickstarts/library-process/library

False

GITHUB_WEBHOOK_SECRET

 — 

GitHub trigger secret.

 — 

True

GENERIC_WEBHOOK_SECRET

 — 

Generic build trigger secret.

 — 

True

MAVEN_MIRROR_URL

MAVEN_MIRROR_URL

Maven mirror to use for S2I builds. If enabled, the mirror must contain all the artifacts necessary for building and running the required services.

 — 

False

MAVEN_MIRROR_OF

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

external:*

False

MAVEN_REPO_ID

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

repo-custom

False

MAVEN_REPO_URL

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository.

 — 

False

MAVEN_REPO_USERNAME

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

 — 

False

MAVEN_REPO_PASSWORD

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

 — 

False

BUSINESS_CENTRAL_MAVEN_SERVICE

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional Business Central, where it can be reached, to allow service lookups (for maven repo usage), if required.

myapp-rhpamcentr

False

BUSINESS_CENTRAL_MAVEN_USERNAME

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

False

BUSINESS_CENTRAL_MAVEN_PASSWORD

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

maven1!

False

ARTIFACT_DIR

 — 

List of directories from which archives will be copied into the deployment folder. If unspecified, all archives in /target will be copied.

 — 

False

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer service database-data-store.

30000

False

KIE_SERVER_MEMORY_LIMIT

 — 

KIE server Container memory limit.

1Gi

False

KIE_SERVER_MGMT_DISABLED

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

true

True

KIE_SERVER_STARTUP_STRATEGY

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

LocalContainersStartupStrategy

True

SSO_URL

SSO_URL

RH-SSO URL.

https://rh-sso.example.com/auth

False

SSO_REALM

SSO_REALM

RH-SSO Realm name.

 — 

False

KIE_SERVER_SSO_CLIENT

SSO_CLIENT

KIE Server RH-SSO Client name.

 — 

False

KIE_SERVER_SSO_SECRET

SSO_SECRET

KIE Server RH-SSO Client Secret.

252793ed-7118-4ca8-8dab-5622fa97d892

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

 — 

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

 — 

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

ldap://myldap.example.com

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

uid=admin,ou=users,ou=exmample,ou=com

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

Password

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

 — 

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

ou=users,ou=example,ou=com

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

(uid={0})

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

SUBTREE_SCOPE

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

10000

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

distinguishedName

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

true

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

memberOf

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

ou=groups,ou=example,ou=com

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

(memberOf={1})

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

1

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

guest

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

name

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

false

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

false

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

 — 

False

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

 — 

False

AUTH_ROLE_MAPPER_REPLACE_ROLE

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

 — 

False

4.2.2. Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

4.2.2.1. Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

ServicePortNameDescription

${APPLICATION_NAME}-kieserver

8080

http

All the KIE server web server’s ports.

8443

https

${APPLICATION_NAME}-kieserver-ping

8888

ping

The JGroups ping port for clustering.

${APPLICATION_NAME}-postgresql

5432

 — 

The database server’s port.

4.2.2.2. Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

ServiceSecurityHostname

${APPLICATION_NAME}-kieserver-http

none

${KIE_SERVER_HOSTNAME_HTTP}

${APPLICATION_NAME}-kieserver-https

TLS passthrough

${KIE_SERVER_HOSTNAME_HTTPS}

4.2.2.3. Build Configurations

A buildConfig describes a single build definition and a set of triggers for when a new build should be created. A buildConfig is a REST object, which can be used in a POST to the API server to create a new instance. Refer to the Openshift documentation for more information.

S2I imagelinkBuild outputBuildTriggers and Settings

rhpam73-kieserver-openshift:1.1

rhpam-7/rhpam73-kieserver-openshift

${APPLICATION_NAME}-kieserver:latest

GitHub, Generic, ImageChange, ConfigChange

4.2.2.4. Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

4.2.2.4.1. Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

DeploymentTriggers

${APPLICATION_NAME}-kieserver

ImageChange

${APPLICATION_NAME}-postgresql

ImageChange

4.2.2.4.2. Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

DeploymentReplicas

${APPLICATION_NAME}-kieserver

2

${APPLICATION_NAME}-postgresql

1

4.2.2.4.3. Pod Template
4.2.2.4.3.1. Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

DeploymentService Account

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-kieserver

4.2.2.4.3.2. Image
DeploymentImage

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-postgresql

postgresql

4.2.2.4.3.3. Readiness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container

4.2.2.4.3.4. Liveness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/healthcheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container --live

4.2.2.4.3.5. Exposed Ports
DeploymentsNamePortProtocol

${APPLICATION_NAME}-kieserver

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

ping

8888

TCP

${APPLICATION_NAME}-postgresql

 — 

5432

TCP

4.2.2.4.3.6. Image Environment Variables
DeploymentVariable nameDescriptionExample value

${APPLICATION_NAME}-kieserver

KIE_ADMIN_USER

KIE administrator username.

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password.

${KIE_ADMIN_PWD}

KIE_SERVER_MODE

 — 

DEVELOPMENT

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

${KIE_MBEANS}

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

${DROOLS_SERVER_FILTER_CLASSES}

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

${KIE_SERVER_BYPASS_AUTH_USER}

KIE_SERVER_CONTROLLER_USER

KIE server monitor username, for optional use of Business Central Monitoring. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_MONITOR_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server monitor password, for optional use of Business Central Monitoring. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_MONITOR_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server monitor token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_MONITOR_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

${KIE_SERVER_MONITOR_SERVICE}

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

ws

KIE_SERVER_ID

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_ROUTE_NAME

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

${KIE_SERVER_USE_SECURE_ROUTE_NAME}

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password, used to connect to KIE servers. Value is automatically generated by default. (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version

c2=g2:a2:v2

${KIE_SERVER_CONTAINER_DEPLOYMENT}

MAVEN_MIRROR_URL

Maven mirror to use for S2I builds. If enabled, the mirror must contain all the artifacts necessary for building and running the required services.

${MAVEN_MIRROR_URL}

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

${MAVEN_MIRROR_OF}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_ID

 — 

repo-rhpamcentr

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional Business Central, where it can be reached, to allow service lookups (for maven repo usage), if required.

${BUSINESS_CENTRAL_MAVEN_SERVICE}

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

${KIE_SERVER_ROUTER_SERVICE}

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

${KIE_SERVER_ROUTER_HOST}

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

${KIE_SERVER_ROUTER_PORT}

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

${KIE_SERVER_ROUTER_PROTOCOL}

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

DATASOURCES

 — 

RHPAM

RHPAM_DATABASE

KIE server PostgreSQL database name.

${KIE_SERVER_POSTGRESQL_DB}

RHPAM_JNDI

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

RHPAM_JTA

 — 

true

RHPAM_DRIVER

 — 

postgresql

KIE_SERVER_PERSISTENCE_DIALECT

KIE server PostgreSQL Hibernate dialect.

${KIE_SERVER_POSTGRESQL_DIALECT}

RHPAM_USERNAME

KIE server PostgreSQL database username.

${KIE_SERVER_POSTGRESQL_USER}

RHPAM_PASSWORD

KIE server PostgreSQL database password.

${KIE_SERVER_POSTGRESQL_PWD}

RHPAM_SERVICE_HOST

 — 

${APPLICATION_NAME}-postgresql

RHPAM_SERVICE_PORT

 — 

5432

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer service database-data-store.

${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}

HTTPS_KEYSTORE_DIR

 — 

/etc/kieserver-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret.

${KIE_SERVER_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate.

${KIE_SERVER_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate.

${KIE_SERVER_HTTPS_PASSWORD}

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

${KIE_SERVER_MGMT_DISABLED}

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

${KIE_SERVER_STARTUP_STRATEGY}

JGROUPS_PING_PROTOCOL

 — 

openshift.DNS_PING

OPENSHIFT_DNS_PING_SERVICE_NAME

 — 

${APPLICATION_NAME}-kieserver-ping

OPENSHIFT_DNS_PING_SERVICE_PORT

 — 

8888

SSO_URL

RH-SSO URL.

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name.

${SSO_REALM}

SSO_SECRET

KIE Server RH-SSO Client Secret.

${KIE_SERVER_SSO_SECRET}

SSO_CLIENT

KIE Server RH-SSO Client name.

${KIE_SERVER_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

${AUTH_ROLE_MAPPER_REPLACE_ROLE}

${APPLICATION_NAME}-postgresql

POSTGRESQL_USER

KIE server PostgreSQL database username.

${KIE_SERVER_POSTGRESQL_USER}

POSTGRESQL_PASSWORD

KIE server PostgreSQL database password.

${KIE_SERVER_POSTGRESQL_PWD}

POSTGRESQL_DATABASE

KIE server PostgreSQL database name.

${KIE_SERVER_POSTGRESQL_DB}

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

Allows the PostgreSQL to handle XA transactions.

4.2.2.4.3.7. Volumes
DeploymentNamemountPathPurposereadOnly

${APPLICATION_NAME}-kieserver

kieserver-keystore-volume

/etc/kieserver-secret-volume

ssl certs

True

${APPLICATION_NAME}-postgresql

${APPLICATION_NAME}-postgresql-pvol

/var/lib/pgsql/data

postgresql

false

4.2.2.5. External Dependencies

4.2.2.5.1. Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

NameAccess Mode

${APPLICATION_NAME}-postgresql-claim

ReadWriteOnce

4.2.2.5.2. Secrets

This template requires the following secrets to be installed for the application to run.

kieserver-app-secret

4.3. rhpam73-kieserver-externaldb.yaml template

Application template for a managed KIE Server with an external database, for Red Hat Process Automation Manager 7.3

4.3.1. Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable nameImage Environment VariableDescriptionExample valueRequired

APPLICATION_NAME

 — 

The name for the application.

myapp

True

MAVEN_MIRROR_URL

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

 — 

False

MAVEN_MIRROR_OF

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

external:*

False

MAVEN_REPO_ID

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

repo-custom

False

MAVEN_REPO_URL

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/

True

MAVEN_REPO_USERNAME

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

 — 

False

MAVEN_REPO_PASSWORD

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

 — 

False

BUSINESS_CENTRAL_MAVEN_SERVICE

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required.

myapp-rhpamcentr

False

BUSINESS_CENTRAL_MAVEN_USERNAME

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

False

BUSINESS_CENTRAL_MAVEN_PASSWORD

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

maven1!

False

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username.

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password.

 — 

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

 — 

False

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.

openshift

True

KIE_SERVER_IMAGE_STREAM_NAME

 — 

The name of the image stream to use for KIE server. Default is "rhpam73-kieserver-openshift".

rhpam73-kieserver-openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

True

KIE_SERVER_ROUTER_SERVICE

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

 — 

False

KIE_SERVER_ROUTER_HOST

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

myapp-smartrouter

False

KIE_SERVER_ROUTER_PORT

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

9000

False

KIE_SERVER_ROUTER_PROTOCOL

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

http

False

KIE_SERVER_CONTROLLER_USER

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

controllerUser

False

KIE_SERVER_CONTROLLER_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

 — 

False

KIE_SERVER_CONTROLLER_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

 — 

False

KIE_SERVER_CONTROLLER_SERVICE

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

 — 

False

KIE_SERVER_CONTROLLER_HOST

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

my-app-controller-ocpuser.os.example.com

False

KIE_SERVER_CONTROLLER_PORT

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

8080

False

KIE_SERVER_PERSISTENCE_SCHEMA

KIE_SERVER_PERSISTENCE_SCHEMA

Hibernate persistence schema.

bd.schema

False

KIE_SERVER_EXTERNALDB_DIALECT

KIE_SERVER_PERSISTENCE_DIALECT

KIE server external database Hibernate dialect.

org.hibernate.dialect.MySQL57Dialect

True

KIE_SERVER_EXTERNALDB_SERVICE_HOST

RHPAM_SERVICE_HOST

Sets the datasource service host. Use this if you want to use the predefined mysql or postgresql datasource properties. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

10.10.10.1

False

KIE_SERVER_EXTERNALDB_SERVICE_PORT

RHPAM_SERVICE_PORT

Sets the datasource service port. Use this if you want to use the predefined mysql or postgresql datasource properties. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

4321

False

KIE_SERVER_EXTERNALDB_NONXA

RHPAM_NONXA

Sets the datasources type. It can be XA or NONXA. For non XA set it to true. Default value is false.

True

False

KIE_SERVER_EXTERNALDB_URL

RHPAM_URL

Sets the datasource jdbc connection url. Note that, if you are using PostgreSQL do not use this field, use the SERVICE_HOST and PORT. If using SERVICE_PORT and HOST there is no need to fill this parameter.

jdbc:mysql://127.0.0.1:3306/rhpam

False

KIE_SERVER_EXTERNALDB_DRIVER

RHPAM_DRIVER

The predefined driver name, available values are mysql, postgresql or the preferred name for the external driver.

mysql

True

KIE_SERVER_EXTERNALDB_JNDI

KIE_SERVER_PERSISTENCE_DS

Database JNDI name used by application to resolve the datasource, e.g. java:/jboss/datasources/ExampleDS.

java:jboss/datasources/jbpmDS

True

KIE_SERVER_EXTERNALDB_DB

RHPAM_DATABASE

KIE server external database name. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

rhpam

False

KIE_SERVER_EXTERNALDB_USER

RHPAM_USERNAME

KIE server external database username.

rhpam

True

KIE_SERVER_EXTERNALDB_PWD

RHPAM_PASSWORD

KIE server external database password.

 — 

True

KIE_SERVER_EXTERNALDB_MIN_POOL_SIZE

RHPAM_MIN_POOL_SIZE

Sets xa-pool/min-pool-size for the configured datasource.

 — 

False

KIE_SERVER_EXTERNALDB_MAX_POOL_SIZE

RHPAM_MAX_POOL_SIZE

Sets xa-pool/max-pool-size for the configured datasource.

 — 

False

KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER

RHPAM_CONNECTION_CHECKER

An org.jboss.jca.adapters.jdbc.ValidConnectionChecker that provides a SQLException isValidConnection(Connection e) method to validate if a connection is valid.

org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker

False

KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER

RHPAM_EXCEPTION_SORTER

An org.jboss.jca.adapters.jdbc.ExceptionSorter that provides a boolean isExceptionFatal(SQLException e) method to validate if an exception should be broadcast to all javax.resource.spi.ConnectionEventListener as a connectionErrorOccurred.

org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLExceptionSorter

False

KIE_SERVER_EXTERNALDB_BACKGROUND_VALIDATION

RHPAM_BACKGROUND_VALIDATION

Sets the sql validation method to background-validation, if set to false the validate-on-match method will be used.

true

False

KIE_SERVER_EXTERNALDB_BACKGROUND_VALIDATION_MILLIS

RHPAM_VALIDATION_MILLIS

Defines the interval for the background-validation check for the jdbc connections.

10000

False

KIE_SERVER_EXTERNALDB_DRIVER_TYPE

RHPAM_DRIVER_TYPE

KIE server external database driver type, applicable only for DB2, possible values are 4 (default) or 2.

4

False

KIE_SERVER_MODE

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

PRODUCTION

False

KIE_MBEANS

KIE_MBEANS

KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties).

enabled

False

DROOLS_SERVER_FILTER_CLASSES

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering (Sets the org.drools.server.filter.classes system property).

true

False

KIE_SERVER_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_HOSTNAME_HTTPS

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_USE_SECURE_ROUTE_NAME

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

false

False

KIE_SERVER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

kieserver-app-secret

True

KIE_SERVER_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret.

keystore.jks

False

KIE_SERVER_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate.

jboss

False

KIE_SERVER_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

KIE_SERVER_BYPASS_AUTH_USER

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

false

False

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

30000

False

KIE_SERVER_MEMORY_LIMIT

 — 

KIE server Container memory limit.

1Gi

False

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version|c2=g2:a2:v2

rhpam-kieserver-library=org.openshift.quickstarts:rhpam-kieserver-library:1.4.0-SNAPSHOT

False

KIE_SERVER_MGMT_DISABLED

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped. Sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

true

False

KIE_SERVER_STARTUP_STRATEGY

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

LocalContainersStartupStrategy

False

SSO_URL

SSO_URL

RH-SSO URL.

https://rh-sso.example.com/auth

False

SSO_REALM

SSO_REALM

RH-SSO Realm name.

 — 

False

KIE_SERVER_SSO_CLIENT

SSO_CLIENT

KIE Server RH-SSO Client name.

 — 

False

KIE_SERVER_SSO_SECRET

SSO_SECRET

KIE Server RH-SSO Client Secret.

252793ed-7118-4ca8-8dab-5622fa97d892

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

 — 

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

 — 

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

ldap://myldap.example.com

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

uid=admin,ou=users,ou=exmample,ou=com

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

Password

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

 — 

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

ou=users,ou=example,ou=com

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

(uid={0})

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

SUBTREE_SCOPE

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

10000

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

distinguishedName

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

true

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

memberOf

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

ou=groups,ou=example,ou=com

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

(memberOf={1})

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

1

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

guest

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

name

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

false

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

false

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

 — 

False

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This property defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

 — 

False

AUTH_ROLE_MAPPER_REPLACE_ROLE

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

 — 

False

4.3.2. Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

4.3.2.1. Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

ServicePortNameDescription

${APPLICATION_NAME}-kieserver

8080

http

All the KIE server web server’s ports.

8443

https

${APPLICATION_NAME}-kieserver-ping

8888

ping

The JGroups ping port for clustering.

4.3.2.2. Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

ServiceSecurityHostname

${APPLICATION_NAME}-kieserver-http

none

${KIE_SERVER_HOSTNAME_HTTP}

${APPLICATION_NAME}-kieserver-https

TLS passthrough

${KIE_SERVER_HOSTNAME_HTTPS}

4.3.2.3. Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

4.3.2.3.1. Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

DeploymentTriggers

${APPLICATION_NAME}-kieserver

ImageChange

4.3.2.3.2. Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

DeploymentReplicas

${APPLICATION_NAME}-kieserver

1

4.3.2.3.3. Pod Template
4.3.2.3.3.1. Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

DeploymentService Account

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-kieserver

4.3.2.3.3.2. Image
DeploymentImage

${APPLICATION_NAME}-kieserver

${KIE_SERVER_IMAGE_STREAM_NAME}

4.3.2.3.3.3. Readiness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck

4.3.2.3.3.4. Liveness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/healthcheck

4.3.2.3.3.5. Exposed Ports
DeploymentsNamePortProtocol

${APPLICATION_NAME}-kieserver

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

ping

8888

TCP

4.3.2.3.3.6. Image Environment Variables
DeploymentVariable nameDescriptionExample value

${APPLICATION_NAME}-kieserver

KIE_ADMIN_USER

KIE administrator username.

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password.

${KIE_ADMIN_PWD}

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

${KIE_SERVER_MODE}

KIE_MBEANS

KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties).

${KIE_MBEANS}

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering (Sets the org.drools.server.filter.classes system property).

${DROOLS_SERVER_FILTER_CLASSES}

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

${KIE_SERVER_BYPASS_AUTH_USER}

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_CONTROLLER_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

${KIE_SERVER_CONTROLLER_SERVICE}

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

ws

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_HOST}

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_PORT}

KIE_SERVER_ID

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_ROUTE_NAME

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

${KIE_SERVER_USE_SECURE_ROUTE_NAME}

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version

c2=g2:a2:v2

${KIE_SERVER_CONTAINER_DEPLOYMENT}

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

${MAVEN_MIRROR_URL}

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

${MAVEN_MIRROR_OF}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_ID

 — 

repo-rhpamcentr

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required.

${BUSINESS_CENTRAL_MAVEN_SERVICE}

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

${KIE_SERVER_ROUTER_SERVICE}

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

${KIE_SERVER_ROUTER_HOST}

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

${KIE_SERVER_ROUTER_PORT}

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

${KIE_SERVER_ROUTER_PROTOCOL}

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped. Sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

${KIE_SERVER_MGMT_DISABLED}

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

${KIE_SERVER_STARTUP_STRATEGY}

KIE_SERVER_PERSISTENCE_DS

Database JNDI name used by application to resolve the datasource, e.g. java:/jboss/datasources/ExampleDS.

${KIE_SERVER_EXTERNALDB_JNDI}

KIE_SERVER_PERSISTENCE_SCHEMA

Hibernate persistence schema.

${KIE_SERVER_PERSISTENCE_SCHEMA}

KIE_SERVER_PERSISTENCE_DIALECT

KIE server external database Hibernate dialect.

${KIE_SERVER_EXTERNALDB_DIALECT}

DATASOURCES

 — 

RHPAM

RHPAM_DATABASE

KIE server external database name. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

${KIE_SERVER_EXTERNALDB_DB}

RHPAM_SERVICE_HOST

Sets the datasource service host. Use this if you want to use the predefined mysql or postgresql datasource properties. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

${KIE_SERVER_EXTERNALDB_SERVICE_HOST}

RHPAM_SERVICE_PORT

Sets the datasource service port. Use this if you want to use the predefined mysql or postgresql datasource properties. Leave blank if the KIE_SERVER_EXTERNALDB_URL is set.

${KIE_SERVER_EXTERNALDB_SERVICE_PORT}

RHPAM_JNDI

Database JNDI name used by application to resolve the datasource, e.g. java:/jboss/datasources/ExampleDS.

${KIE_SERVER_EXTERNALDB_JNDI}

RHPAM_DRIVER

The predefined driver name, available values are mysql, postgresql or the preferred name for the external driver.

${KIE_SERVER_EXTERNALDB_DRIVER}

RHPAM_USERNAME

KIE server external database username.

${KIE_SERVER_EXTERNALDB_USER}

RHPAM_PASSWORD

KIE server external database password.

${KIE_SERVER_EXTERNALDB_PWD}

RHPAM_NONXA

Sets the datasources type. It can be XA or NONXA. For non XA set it to true. Default value is false.

${KIE_SERVER_EXTERNALDB_NONXA}

RHPAM_URL

Sets the datasource jdbc connection url. Note that, if you are using PostgreSQL do not use this field, use the SERVICE_HOST and PORT. If using SERVICE_PORT and HOST there is no need to fill this parameter.

${KIE_SERVER_EXTERNALDB_URL}

RHPAM_XA_CONNECTION_PROPERTY_URL

Sets the datasource jdbc connection url. Note that, if you are using PostgreSQL do not use this field, use the SERVICE_HOST and PORT. If using SERVICE_PORT and HOST there is no need to fill this parameter.

${KIE_SERVER_EXTERNALDB_URL}

RHPAM_MIN_POOL_SIZE

Sets xa-pool/min-pool-size for the configured datasource.

${KIE_SERVER_EXTERNALDB_MIN_POOL_SIZE}

RHPAM_MAX_POOL_SIZE

Sets xa-pool/max-pool-size for the configured datasource.

${KIE_SERVER_EXTERNALDB_MAX_POOL_SIZE}

RHPAM_CONNECTION_CHECKER

An org.jboss.jca.adapters.jdbc.ValidConnectionChecker that provides a SQLException isValidConnection(Connection e) method to validate if a connection is valid.

${KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER}

RHPAM_EXCEPTION_SORTER

An org.jboss.jca.adapters.jdbc.ExceptionSorter that provides a boolean isExceptionFatal(SQLException e) method to validate if an exception should be broadcast to all javax.resource.spi.ConnectionEventListener as a connectionErrorOccurred.

${KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER}

RHPAM_BACKGROUND_VALIDATION

Sets the sql validation method to background-validation, if set to false the validate-on-match method will be used.

${KIE_SERVER_EXTERNALDB_BACKGROUND_VALIDATION}

RHPAM_VALIDATION_MILLIS

Defines the interval for the background-validation check for the jdbc connections.

${KIE_SERVER_EXTERNALDB_BACKGROUND_VALIDATION_MILLIS}

RHPAM_DRIVER_TYPE

KIE server external database driver type, applicable only for DB2, possible values are 4 (default) or 2.

${KIE_SERVER_EXTERNALDB_DRIVER_TYPE}

RHPAM_JTA

 — 

true

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}

HTTPS_KEYSTORE_DIR

 — 

/etc/kieserver-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret.

${KIE_SERVER_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate.

${KIE_SERVER_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate.

${KIE_SERVER_HTTPS_PASSWORD}

JGROUPS_PING_PROTOCOL

 — 

openshift.DNS_PING

OPENSHIFT_DNS_PING_SERVICE_NAME

 — 

${APPLICATION_NAME}-kieserver-ping

OPENSHIFT_DNS_PING_SERVICE_PORT

 — 

8888

SSO_URL

RH-SSO URL.

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name.

${SSO_REALM}

SSO_SECRET

KIE Server RH-SSO Client Secret.

${KIE_SERVER_SSO_SECRET}

SSO_CLIENT

KIE Server RH-SSO Client name.

${KIE_SERVER_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This property defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

4.3.2.3.3.7. Volumes
DeploymentNamemountPathPurposereadOnly

${APPLICATION_NAME}-kieserver

kieserver-keystore-volume

/etc/kieserver-secret-volume

ssl certs

True

4.3.2.4. External Dependencies

4.3.2.4.1. Secrets

This template requires the following secrets to be installed for the application to run.

kieserver-app-secret

4.4. rhpam73-kieserver-mysql.yaml template

Application template for a managed KIE Server with a MySQL database, for Red Hat Process Automation Manager 7.3

4.4.1. Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable nameImage Environment VariableDescriptionExample valueRequired

APPLICATION_NAME

 — 

The name for the application.

myapp

True

MAVEN_MIRROR_URL

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

 — 

False

MAVEN_MIRROR_OF

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

external:*

False

MAVEN_REPO_ID

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

repo-custom

False

MAVEN_REPO_URL

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/

True

MAVEN_REPO_USERNAME

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

 — 

False

MAVEN_REPO_PASSWORD

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

 — 

False

BUSINESS_CENTRAL_MAVEN_SERVICE

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required

myapp-rhpamcentr

False

BUSINESS_CENTRAL_MAVEN_USERNAME

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

False

BUSINESS_CENTRAL_MAVEN_PASSWORD

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

maven1!

False

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username.

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password.

 — 

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

 — 

False

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.

openshift

True

KIE_SERVER_IMAGE_STREAM_NAME

 — 

The name of the image stream to use for KIE server. Default is "rhpam73-kieserver-openshift".

rhpam73-kieserver-openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

True

KIE_SERVER_ROUTER_SERVICE

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

 — 

False

KIE_SERVER_ROUTER_HOST

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

myapp-smartrouter

False

KIE_SERVER_ROUTER_PORT

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

9000

False

KIE_SERVER_ROUTER_PROTOCOL

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

http

False

KIE_SERVER_CONTROLLER_USER

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

controllerUser

False

KIE_SERVER_CONTROLLER_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

 — 

False

KIE_SERVER_CONTROLLER_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

 — 

False

KIE_SERVER_CONTROLLER_SERVICE

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

 — 

False

KIE_SERVER_CONTROLLER_HOST

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

my-app-controller-ocpuser.os.example.com

False

KIE_SERVER_CONTROLLER_PORT

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

8080

False

KIE_SERVER_PERSISTENCE_DS

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

java:/jboss/datasources/rhpam

False

MYSQL_IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStream for the MySQL image is installed. The ImageStream is already installed in the openshift namespace. You should only need to modify this if you installed the ImageStream in a different namespace/project. Default is "openshift".

openshift

False

MYSQL_IMAGE_STREAM_TAG

 — 

The MySQL image version, which is intended to correspond to the MySQL version. Default is "5.7".

5.7

False

KIE_SERVER_MYSQL_USER

RHPAM_USERNAME

KIE server MySQL database username.

rhpam

False

KIE_SERVER_MYSQL_PWD

RHPAM_PASSWORD

KIE server MySQL database password.

 — 

False

KIE_SERVER_MYSQL_DB

RHPAM_DATABASE

KIE server MySQL database name.

rhpam7

False

DB_VOLUME_CAPACITY

 — 

Size of persistent storage for the database volume.

1Gi

True

KIE_SERVER_MYSQL_DIALECT

KIE_SERVER_PERSISTENCE_DIALECT

KIE server MySQL Hibernate dialect.

org.hibernate.dialect.MySQL57Dialect

True

KIE_SERVER_MODE

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

PRODUCTION

False

KIE_MBEANS

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

enabled

False

DROOLS_SERVER_FILTER_CLASSES

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

true

False

KIE_SERVER_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_HOSTNAME_HTTPS

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_USE_SECURE_ROUTE_NAME

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

false

False

KIE_SERVER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

kieserver-app-secret

True

KIE_SERVER_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret.

keystore.jks

False

KIE_SERVER_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate.

jboss

False

KIE_SERVER_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

KIE_SERVER_BYPASS_AUTH_USER

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

false

False

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

30000

False

KIE_SERVER_MEMORY_LIMIT

 — 

KIE server Container memory limit.

1Gi

False

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version|c2=g2:a2:v2

rhpam-kieserver-library=org.openshift.quickstarts:rhpam-kieserver-library:1.4.0-SNAPSHOT

False

KIE_SERVER_MGMT_DISABLED

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

true

False

KIE_SERVER_STARTUP_STRATEGY

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

LocalContainersStartupStrategy

False

SSO_URL

SSO_URL

RH-SSO URL.

https://rh-sso.example.com/auth

False

SSO_REALM

SSO_REALM

RH-SSO Realm name.

 — 

False

KIE_SERVER_SSO_CLIENT

SSO_CLIENT

KIE Server RH-SSO Client name.

 — 

False

KIE_SERVER_SSO_SECRET

SSO_SECRET

KIE Server RH-SSO Client Secret.

252793ed-7118-4ca8-8dab-5622fa97d892

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

 — 

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

 — 

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

ldap://myldap.example.com

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

uid=admin,ou=users,ou=exmample,ou=com

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

Password

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

 — 

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

ou=users,ou=example,ou=com

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

(uid={0})

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

SUBTREE_SCOPE

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

10000

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

distinguishedName

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

true

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

memberOf

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

ou=groups,ou=example,ou=com

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

(memberOf={1})

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

1

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

guest

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

name

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

false

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

false

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

 — 

False

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

 — 

False

AUTH_ROLE_MAPPER_REPLACE_ROLE

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

 — 

False

4.4.2. Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

4.4.2.1. Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

ServicePortNameDescription

${APPLICATION_NAME}-kieserver

8080

http

All the KIE server web server’s ports.

8443

https

${APPLICATION_NAME}-kieserver-ping

8888

ping

The JGroups ping port for clustering.

${APPLICATION_NAME}-mysql

3306

 — 

The database server’s port.

4.4.2.2. Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

ServiceSecurityHostname

${APPLICATION_NAME}-kieserver-http

none

${KIE_SERVER_HOSTNAME_HTTP}

${APPLICATION_NAME}-kieserver-https

TLS passthrough

${KIE_SERVER_HOSTNAME_HTTPS}

4.4.2.3. Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

4.4.2.3.1. Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

DeploymentTriggers

${APPLICATION_NAME}-kieserver

ImageChange

${APPLICATION_NAME}-mysql

ImageChange

4.4.2.3.2. Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

DeploymentReplicas

${APPLICATION_NAME}-kieserver

1

${APPLICATION_NAME}-mysql

1

4.4.2.3.3. Pod Template
4.4.2.3.3.1. Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

DeploymentService Account

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-kieserver

4.4.2.3.3.2. Image
DeploymentImage

${APPLICATION_NAME}-kieserver

${KIE_SERVER_IMAGE_STREAM_NAME}

${APPLICATION_NAME}-mysql

mysql

4.4.2.3.3.3. Readiness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck

${APPLICATION_NAME}-mysql

/bin/sh -i -c MYSQL_PWD="$MYSQL_PASSWORD" mysql -h 127.0.0.1 -u $MYSQL_USER -D $MYSQL_DATABASE -e 'SELECT 1'

4.4.2.3.3.4. Liveness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/healthcheck

${APPLICATION_NAME}-mysql

tcpSocket on port 3306

4.4.2.3.3.5. Exposed Ports
DeploymentsNamePortProtocol

${APPLICATION_NAME}-kieserver

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

ping

8888

TCP

${APPLICATION_NAME}-mysql

 — 

3306

TCP

4.4.2.3.3.6. Image Environment Variables
DeploymentVariable nameDescriptionExample value

${APPLICATION_NAME}-kieserver

KIE_ADMIN_USER

KIE administrator username.

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password.

${KIE_ADMIN_PWD}

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

${KIE_SERVER_MODE}

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

${KIE_MBEANS}

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

${DROOLS_SERVER_FILTER_CLASSES}

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

${KIE_SERVER_BYPASS_AUTH_USER}

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_CONTROLLER_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

${KIE_SERVER_CONTROLLER_SERVICE}

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

ws

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_HOST}

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_PORT}

KIE_SERVER_ID

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_ROUTE_NAME

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

${KIE_SERVER_USE_SECURE_ROUTE_NAME}

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version

c2=g2:a2:v2

${KIE_SERVER_CONTAINER_DEPLOYMENT}

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

${MAVEN_MIRROR_URL}

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

${MAVEN_MIRROR_OF}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_ID

 — 

repo-rhpamcentr

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required

${BUSINESS_CENTRAL_MAVEN_SERVICE}

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

${KIE_SERVER_ROUTER_SERVICE}

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

${KIE_SERVER_ROUTER_HOST}

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (Router property org.kie.server.router.port)

${KIE_SERVER_ROUTER_PORT}

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

${KIE_SERVER_ROUTER_PROTOCOL}

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

${KIE_SERVER_MGMT_DISABLED}

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

${KIE_SERVER_STARTUP_STRATEGY}

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

DATASOURCES

 — 

RHPAM

RHPAM_JNDI

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

RHPAM_DATABASE

KIE server MySQL database name.

${KIE_SERVER_MYSQL_DB}

RHPAM_DRIVER

 — 

mysql

KIE_SERVER_PERSISTENCE_DIALECT

KIE server MySQL Hibernate dialect.

${KIE_SERVER_MYSQL_DIALECT}

RHPAM_USERNAME

KIE server MySQL database username.

${KIE_SERVER_MYSQL_USER}

RHPAM_PASSWORD

KIE server MySQL database password.

${KIE_SERVER_MYSQL_PWD}

RHPAM_SERVICE_HOST

 — 

${APPLICATION_NAME}-mysql

RHPAM_SERVICE_PORT

 — 

3306

RHPAM_JTA

 — 

true

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}

HTTPS_KEYSTORE_DIR

 — 

/etc/kieserver-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret.

${KIE_SERVER_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate.

${KIE_SERVER_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate.

${KIE_SERVER_HTTPS_PASSWORD}

JGROUPS_PING_PROTOCOL

 — 

openshift.DNS_PING

OPENSHIFT_DNS_PING_SERVICE_NAME

 — 

${APPLICATION_NAME}-kieserver-ping

OPENSHIFT_DNS_PING_SERVICE_PORT

 — 

8888

SSO_URL

RH-SSO URL.

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name.

${SSO_REALM}

SSO_SECRET

KIE Server RH-SSO Client Secret.

${KIE_SERVER_SSO_SECRET}

SSO_CLIENT

KIE Server RH-SSO Client name.

${KIE_SERVER_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users.

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

${AUTH_ROLE_MAPPER_REPLACE_ROLE}

${APPLICATION_NAME}-mysql

MYSQL_USER

KIE server MySQL database username.

${KIE_SERVER_MYSQL_USER}

MYSQL_PASSWORD

KIE server MySQL database password.

${KIE_SERVER_MYSQL_PWD}

MYSQL_DATABASE

KIE server MySQL database name.

4.4.2.3.3.7. Volumes
DeploymentNamemountPathPurposereadOnly

${APPLICATION_NAME}-kieserver

kieserver-keystore-volume

/etc/kieserver-secret-volume

ssl certs

True

${APPLICATION_NAME}-mysql

${APPLICATION_NAME}-mysql-pvol

/var/lib/mysql/data

mysql

false

4.4.2.4. External Dependencies

4.4.2.4.1. Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

NameAccess Mode

${APPLICATION_NAME}-mysql-claim

ReadWriteOnce

4.4.2.4.2. Secrets

This template requires the following secrets to be installed for the application to run.

kieserver-app-secret

4.5. rhpam73-kieserver-postgresql.yaml template

Application template for a managed KIE Server with a PostgreSQL database, for Red Hat Process Automation Manager 7.3

4.5.1. Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable nameImage Environment VariableDescriptionExample valueRequired

APPLICATION_NAME

 — 

The name for the application.

myapp

True

MAVEN_MIRROR_URL

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

 — 

False

MAVEN_MIRROR_OF

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

external:*

False

MAVEN_REPO_ID

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

repo-custom

False

MAVEN_REPO_URL

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/

True

MAVEN_REPO_USERNAME

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

 — 

False

MAVEN_REPO_PASSWORD

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

 — 

False

BUSINESS_CENTRAL_MAVEN_SERVICE

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required.

myapp-rhpamcentr

False

BUSINESS_CENTRAL_MAVEN_USERNAME

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

False

BUSINESS_CENTRAL_MAVEN_PASSWORD

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

maven1!

False

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username.

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password.

 — 

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

 — 

False

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.

openshift

True

KIE_SERVER_IMAGE_STREAM_NAME

 — 

The name of the image stream to use for KIE server. Default is "rhpam73-kieserver-openshift".

rhpam73-kieserver-openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

True

KIE_SERVER_ROUTER_SERVICE

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

 — 

False

KIE_SERVER_ROUTER_HOST

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

myapp-smartrouter

False

KIE_SERVER_ROUTER_PORT

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (router property org.kie.server.router.port)

9000

False

KIE_SERVER_ROUTER_PROTOCOL

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

http

False

KIE_SERVER_CONTROLLER_USER

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

controllerUser

False

KIE_SERVER_CONTROLLER_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

 — 

False

KIE_SERVER_CONTROLLER_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

 — 

False

KIE_SERVER_CONTROLLER_SERVICE

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

 — 

False

KIE_SERVER_CONTROLLER_HOST

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

my-app-controller-ocpuser.os.example.com

False

KIE_SERVER_CONTROLLER_PORT

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

8080

False

KIE_SERVER_PERSISTENCE_DS

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

java:/jboss/datasources/rhpam

False

KIE_SERVER_POSTGRESQL_USER

RHPAM_USERNAME

KIE server PostgreSQL database username.

rhpam

False

KIE_SERVER_POSTGRESQL_PWD

RHPAM_PASSWORD

KIE server PostgreSQL database password.

 — 

False

KIE_SERVER_POSTGRESQL_DB

RHPAM_DATABASE

KIE server PostgreSQL database name.

rhpam7

False

POSTGRESQL_IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStream for the PostgreSQL image is installed. The ImageStream is already installed in the openshift namespace. You should only need to modify this if you installed the ImageStream in a different namespace/project. Default is "openshift".

openshift

False

POSTGRESQL_IMAGE_STREAM_TAG

 — 

The PostgreSQL image version, which is intended to correspond to the PostgreSQL version. Default is "10".

10

False

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

Allows the PostgreSQL to handle XA transactions.

100

True

DB_VOLUME_CAPACITY

 — 

Size of persistent storage for the database volume.

1Gi

True

KIE_SERVER_POSTGRESQL_DIALECT

KIE_SERVER_PERSISTENCE_DIALECT

KIE server PostgreSQL Hibernate dialect.

org.hibernate.dialect.PostgreSQLDialect

True

KIE_SERVER_MODE

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

PRODUCTION

False

KIE_MBEANS

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

enabled

False

DROOLS_SERVER_FILTER_CLASSES

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

true

False

KIE_SERVER_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_HOSTNAME_HTTPS

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

 — 

False

KIE_SERVER_USE_SECURE_ROUTE_NAME

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

false

False

KIE_SERVER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file.

kieserver-app-secret

True

KIE_SERVER_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret.

keystore.jks

False

KIE_SERVER_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate.

jboss

False

KIE_SERVER_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate.

mykeystorepass

False

KIE_SERVER_BYPASS_AUTH_USER

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

false

False

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

30000

False

KIE_SERVER_MEMORY_LIMIT

 — 

KIE server Container memory limit.

1Gi

False

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version|c2=g2:a2:v2

rhpam-kieserver-library=org.openshift.quickstarts:rhpam-kieserver-library:1.4.0-SNAPSHOT

False

KIE_SERVER_MGMT_DISABLED

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

true

False

KIE_SERVER_STARTUP_STRATEGY

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

LocalContainersStartupStrategy

False

SSO_URL

SSO_URL

RH-SSO URL.

https://rh-sso.example.com/auth

False

SSO_REALM

SSO_REALM

RH-SSO Realm name.

 — 

False

KIE_SERVER_SSO_CLIENT

SSO_CLIENT

KIE Server RH-SSO Client name.

 — 

False

KIE_SERVER_SSO_SECRET

SSO_SECRET

KIE Server RH-SSO Client Secret.

252793ed-7118-4ca8-8dab-5622fa97d892

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

 — 

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

 — 

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

ldap://myldap.example.com

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

uid=admin,ou=users,ou=exmample,ou=com

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

Password

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

 — 

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

ou=users,ou=example,ou=com

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

(uid={0})

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

SUBTREE_SCOPE

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

10000

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

distinguishedName

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

true

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

 — 

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

memberOf

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

ou=groups,ou=example,ou=com

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

(memberOf={1})

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

1

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

guest

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

name

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

false

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

false

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

 — 

False

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

 — 

False

AUTH_ROLE_MAPPER_REPLACE_ROLE

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

 — 

False

4.5.2. Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

4.5.2.1. Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

ServicePortNameDescription

${APPLICATION_NAME}-kieserver

8080

http

All the KIE server web server’s ports.

8443

https

${APPLICATION_NAME}-kieserver-ping

8888

ping

The JGroups ping port for clustering.

${APPLICATION_NAME}-postgresql

5432

 — 

The database server’s port.

4.5.2.2. Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

ServiceSecurityHostname

${APPLICATION_NAME}-kieserver-http

none

${KIE_SERVER_HOSTNAME_HTTP}

${APPLICATION_NAME}-kieserver-https

TLS passthrough

${KIE_SERVER_HOSTNAME_HTTPS}

4.5.2.3. Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

4.5.2.3.1. Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

DeploymentTriggers

${APPLICATION_NAME}-kieserver

ImageChange

${APPLICATION_NAME}-postgresql

ImageChange

4.5.2.3.2. Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

DeploymentReplicas

${APPLICATION_NAME}-kieserver

1

${APPLICATION_NAME}-postgresql

1

4.5.2.3.3. Pod Template
4.5.2.3.3.1. Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

DeploymentService Account

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-kieserver

4.5.2.3.3.2. Image
DeploymentImage

${APPLICATION_NAME}-kieserver

${KIE_SERVER_IMAGE_STREAM_NAME}

${APPLICATION_NAME}-postgresql

postgresql

4.5.2.3.3.3. Readiness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container

4.5.2.3.3.4. Liveness Probe

${APPLICATION_NAME}-kieserver

/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/healthcheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container --live

4.5.2.3.3.5. Exposed Ports
DeploymentsNamePortProtocol

${APPLICATION_NAME}-kieserver

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

ping

8888

TCP

${APPLICATION_NAME}-postgresql

 — 

5432

TCP

4.5.2.3.3.6. Image Environment Variables
DeploymentVariable nameDescriptionExample value

${APPLICATION_NAME}-kieserver

KIE_ADMIN_USER

KIE administrator username.

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password.

${KIE_ADMIN_PWD}

KIE_SERVER_MODE

The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).

${KIE_SERVER_MODE}

KIE_MBEANS

KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)

${KIE_MBEANS}

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering. (Sets the org.drools.server.filter.classes system property)

${DROOLS_SERVER_FILTER_CLASSES}

KIE_SERVER_BYPASS_AUTH_USER

Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)

${KIE_SERVER_BYPASS_AUTH_USER}

KIE_SERVER_CONTROLLER_USER

KIE server controller username. (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_CONTROLLER_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server controller password. (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

The service name for the optional Business Central Monitoring. The application uses this service name to register with the monitoring console. (If set, will be used to discover host and port)

${KIE_SERVER_CONTROLLER_SERVICE}

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

ws

KIE_SERVER_CONTROLLER_HOST

KIE server controller host. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_HOST}

KIE_SERVER_CONTROLLER_PORT

KIE server controller port. (Used to set the org.kie.server.controller system property)

${KIE_SERVER_CONTROLLER_PORT}

KIE_SERVER_ID

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_ROUTE_NAME

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_USE_SECURE_ROUTE_NAME

If true, the KIE server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.

${KIE_SERVER_USE_SECURE_ROUTE_NAME}

KIE_SERVER_USER

KIE server username. (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password. (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

KIE_SERVER_CONTAINER_DEPLOYMENT

KIE Server Container deployment configuration in format: containerId=groupId:artifactId:version

c2=g2:a2:v2

${KIE_SERVER_CONTAINER_DEPLOYMENT}

MAVEN_MIRROR_URL

Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.

${MAVEN_MIRROR_URL}

MAVEN_MIRROR_OF

Maven mirror configuration for KIE server.

${MAVEN_MIRROR_OF}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_ID

 — 

repo-rhpamcentr

RHPAMCENTR_MAVEN_REPO_SERVICE

The service name for the optional business central, where it can be reached, to allow service lookups (for maven repo usage), if required.

${BUSINESS_CENTRAL_MAVEN_SERVICE}

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven service hosted by Business Central inside EAP.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_SERVER_ROUTER_SERVICE

The service name for the optional smart router.

${KIE_SERVER_ROUTER_SERVICE}

KIE_SERVER_ROUTER_HOST

The host name of the smart router, which can be the service name resolved by OpenShift or a globally resolvable domain name.

${KIE_SERVER_ROUTER_HOST}

KIE_SERVER_ROUTER_PORT

Port on which the smart router server listens. (router property org.kie.server.router.port)

${KIE_SERVER_ROUTER_PORT}

KIE_SERVER_ROUTER_PROTOCOL

KIE server router protocol. (Used to build the org.kie.server.router.url.external property)

${KIE_SERVER_ROUTER_PROTOCOL}

KIE_SERVER_MGMT_DISABLED

Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.

${KIE_SERVER_MGMT_DISABLED}

KIE_SERVER_STARTUP_STRATEGY

When set to OpenShiftStartupStrategy, allows KIE server to start up independently using shared state from OpenShift API service and to connect to a Business Central that uses OpenShift integration. When set to LocalContainersStartupStrategy, allows KIE server to start up and function with local config, even when a controller is configured and unavailable.

${KIE_SERVER_STARTUP_STRATEGY}

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

DATASOURCES

 — 

RHPAM

RHPAM_DATABASE

KIE server PostgreSQL database name.

${KIE_SERVER_POSTGRESQL_DB}

RHPAM_DRIVER

 — 

postgresql

RHPAM_USERNAME

KIE server PostgreSQL database username.

${KIE_SERVER_POSTGRESQL_USER}

RHPAM_PASSWORD

KIE server PostgreSQL database password.

${KIE_SERVER_POSTGRESQL_PWD}

RHPAM_SERVICE_HOST

 — 

${APPLICATION_NAME}-postgresql

RHPAM_SERVICE_PORT

 — 

5432

KIE_SERVER_PERSISTENCE_DIALECT

KIE server PostgreSQL Hibernate dialect.

${KIE_SERVER_POSTGRESQL_DIALECT}

RHPAM_JTA

 — 

true

RHPAM_JNDI

KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL

Sets refresh-interval for the EJB timer database data-store service.

${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}

HTTPS_KEYSTORE_DIR

 — 

/etc/kieserver-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret.

${KIE_SERVER_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate.

${KIE_SERVER_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate.

${KIE_SERVER_HTTPS_PASSWORD}

JGROUPS_PING_PROTOCOL

 — 

openshift.DNS_PING

OPENSHIFT_DNS_PING_SERVICE_NAME

 — 

${APPLICATION_NAME}-kieserver-ping

OPENSHIFT_DNS_PING_SERVICE_PORT

 — 

8888

SSO_URL

RH-SSO URL.

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name.

${SSO_REALM}

SSO_SECRET

KIE Server RH-SSO Client Secret.

${KIE_SERVER_SSO_SECRET}

SSO_CLIENT

KIE Server RH-SSO Client name.

${KIE_SERVER_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client.

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation.

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication.

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication.

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication.

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

AUTH_ROLE_MAPPER_ROLES_PROPERTIES

When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3

${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}

AUTH_ROLE_MAPPER_REPLACE_ROLE

Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.

${AUTH_ROLE_MAPPER_REPLACE_ROLE}

${APPLICATION_NAME}-postgresql

POSTGRESQL_USER

KIE server PostgreSQL database username.

${KIE_SERVER_POSTGRESQL_USER}

POSTGRESQL_PASSWORD

KIE server PostgreSQL database password.

${KIE_SERVER_POSTGRESQL_PWD}

POSTGRESQL_DATABASE

KIE server PostgreSQL database name.

${KIE_SERVER_POSTGRESQL_DB}

POSTGRESQL_MAX_PREPARED_TRANSACTIONS

Allows the PostgreSQL to handle XA transactions.

4.5.2.3.3.7. Volumes
DeploymentNamemountPathPurposereadOnly

${APPLICATION_NAME}-kieserver

kieserver-keystore-volume

/etc/kieserver-secret-volume

ssl certs

True

${APPLICATION_NAME}-postgresql

${APPLICATION_NAME}-postgresql-pvol

/var/lib/pgsql/data

postgresql

false

4.5.2.4. External Dependencies

4.5.2.4.1. Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

NameAccess Mode

${APPLICATION_NAME}-postgresql-claim

ReadWriteOnce

4.5.2.4.2. Secrets

This template requires the following secrets to be installed for the application to run.

kieserver-app-secret

4.6. OpenShift usage quick reference

To deploy, monitor, manage, and undeploy Red Hat Process Automation Manager templates on Red Hat OpenShift Container Platform, you can use the OpenShift Web console or the oc command.

For instructions about using the Web console, see Create and build an image using the Web console.

For detailed instructions about using the oc command, see CLI Reference. The following commands are likely to be required:

  • To create a project, use the following command:

    $ oc new-project <project-name>

    For more information, see Creating a project using the CLI.

  • To deploy a template (create an application from a template), use the following command:

    $ oc new-app -f <template-name> -p <parameter>=<value> -p <parameter>=<value> ...

    For more information, see Creating an application using the CLI.

  • To view a list of the active pods in the project, use the following command:

    $ oc get pods
  • To view the current status of a pod, including information whether or not the pod deployment has completed and it is now in a running state, use the following command:

    $ oc describe pod <pod-name>

    You can also use the oc describe command to view the current status of other objects. For more information, see Application modification operations.

  • To view the logs for a pod, use the following command:

    $ oc logs <pod-name>
  • To view deployment logs, look up a DeploymentConfig name in the template reference and run the following command:

    $ oc logs -f dc/<deployment-config-name>

    For more information, see Viewing deployment logs.

  • To view build logs, look up a BuildConfig name in the template reference and run the command:

    $ oc logs -f bc/<build-config-name>

    For more information, see Accessing build logs.

  • To scale a pod in the application, look up a DeploymentConfig name in the template reference and run the command:

    $ oc scale dc/<deployment-config-name> --replicas=<number>

    For more information, see Manual scaling.

  • To undeploy the application, you can delete the project by using the command:

    $ oc delete project <project-name>

    Alternatively, you can use the oc delete command to remove any part of the application, such as a pod or replication controller. For details, see Application modification operations.