Chapter 2. Preparing to deploy Red Hat Process Automation Manager in your OpenShift environment
Before deploying Red Hat Process Automation Manager in your OpenShift environment, you must complete several tasks. You do not need to repeat these tasks if you want to deploy additional images, for example, for new versions of processes or for other processes.
2.1. Ensuring the availability of image streams and the image registry
To deploy Red Hat Process Automation Manager components on Red Hat OpenShift Container Platform, you must ensure that OpenShift can download the correct images from the Red Hat registry. To download the images, OpenShift requires image streams, which contain the information about the location of images. OpenShift also must be configured to authenticate with the Red Hat registry using your service account user name and password.
Some versions of the OpenShift environment include the required image streams. You must check if they are available. If image streams are available in OpenShift by default, you can use them if the OpenShift infrastructure is configured for registry authentication server. The administrator must complete the registry authentication configuration when installing the OpenShift environment.
Otherwise, you can configure registry authentication in your own project and install the image streams in that project.
Procedure
- Determine whether Red Hat OpenShift Container Platform is configured with the user name and password for Red Hat registry access. For details about the required configuration, see Configuring a Registry Location. If you are using an OpenShift Online subscription, it is configured for Red Hat registry access.
If Red Hat OpenShift Container Platform is configured with the user name and password for Red Hat registry access, enter the following commands:
$ oc get imagestreamtag -n openshift | grep -F rhpam-businesscentral | grep -F 7.5 $ oc get imagestreamtag -n openshift | grep -F rhpam-kieserver | grep -F 7.5
If the outputs of both commands are not empty, the required image streams are available in the
openshift
namespace and no further action is required.If the output of one or both of the commands is empty or if OpenShift is not configured with the user name and password for Red Hat registry access, complete the following steps:
-
Ensure you are logged in to OpenShift with the
oc
command and that your project is active. - Complete the steps documented in Registry Service Accounts for Shared Environments. You must log in to the Red Hat Customer Portal to access the document and to complete the steps to create a registry service account.
- Select the OpenShift Secret tab and click the link under Download secret to download the YAML secret file.
-
View the downloaded file and note the name that is listed in the
name:
entry. Enter the following commands:
oc create -f <file_name>.yaml oc secrets link default <secret_name> --for=pull oc secrets link builder <secret_name> --for=pull
Replace
<file_name>
with the name of the downloaded file and<secret_name>
with the name that is listed in thename:
entry of the file.-
Download the
rhpam-7.5.1-openshift-templates.zip
product deliverable file from the Software Downloads page and extract therhpam75-image-streams.yaml
file. Enter the following command:
$ oc apply -f rhpam75-image-streams.yaml
NoteIf you complete these steps, you install the image streams into the namespace of your project. In this case, when you deploy the templates, you must set the
IMAGE_STREAM_NAMESPACE
parameter to the name of this project.
-
Ensure you are logged in to OpenShift with the
2.2. Creating the secrets for Process Server
OpenShift uses objects called secrets to hold sensitive information such as passwords or keystores. For more information about OpenShift secrets, see the Secrets chapter in the OpenShift documentation.
You must create an SSL certificate for HTTP access to Process Server and provide it to your OpenShift environment as a secret.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Process Server. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Process Server.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedkieserver-app-secret
from the new keystore file:$ oc create secret generic kieserver-app-secret --from-file=keystore.jks
2.3. Creating the secrets for Business Central
You must create an SSL certificate for HTTP access to Business Central and provide it to your OpenShift environment as a secret.
Do not use the same certificate and keystore for Business Central and Process Server.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Business Central. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Business Central.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedbusinesscentral-app-secret
from the new keystore file:$ oc create secret generic businesscentral-app-secret --from-file=keystore.jks
2.4. Creating the secrets for Smart Router
You must create an SSL certificate for HTTP access to Smart Router and provide it to your OpenShift environment as a secret.
Do not use the same certificate and keystore for Smart Router as the ones used for Process Server or Business Central.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Smart Router. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Smart Router.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedsmartrouter-app-secret
from the new keystore file:$ oc create secret generic smartrouter-app-secret --from-file=keystore.jks
2.5. Building a custom Process Server extension image for an external database
If you want to use an external database server for a Process Server and the database server is not a MySQL or PostgreSQL server, you must build a custom Process Server extension image with drivers for this server before deploying your environment.
Complete the steps in this build procedure to provide drivers for any of the following database servers:
- Microsoft SQL Server
- MariaDB
- IBM DB2
- Oracle Database
- Sybase
For the supported versions of the database servers, see Red Hat Process Automation Manager 7 Supported Configurations.
The build procedure creates a custom extension image that extends the existing Process Server image. You must import this custom extension image into your OpenShift environment and then reference it in the EXTENSION_IMAGE
parameter.
Prerequisites
-
You are logged in to your OpenShift environment using the
oc
command. Your OpenShift user must have theregistry-editor
role. - For Oracle Database or Sybase, you downloaded the JDBC driver from the database server vendor.
You have installed the following required software:
- Docker
- Cekit version 3.2
The following libraries and extensions for Cekit:
-
odcs-client
, provided by thepython3-odcs-client
package or similar package -
docker
, provided by thepython3-docker
package or similar package -
docker-squash
, provided by thepython3-docker-squash
package or similar package -
behave
, provided by thepython3-behave
package or similar package -
s2i
, provided by thesource-to-image
package or similar package
-
Procedure
- For IBM DB2, Oracle Database, or Sybase, provide the JDBC driver JAR file in a local directory.
-
Download the
rhpam-7.5.1-openshift-templates.zip
product deliverable file from the Software Downloads page of the Red Hat Customer Portal. -
Unzip the file and, using the command line, change to the
templates/contrib/jdbc
directory of the unzipped file. This directory contains the source code for the custom build. Run one of the following commands, depending on the database server type:
For Microsoft SQL Server:
make build mssql
For MariaDB:
make build mariadb
For IBM DB2:
make build db2
For Oracle Database:
make build oracle artifact=/tmp/ojdbc7.jar version=7.0
In this command, replace
/tmp/ojdbc7.jar
with the path name of the downloaded Oracle Database driver and7.0
with the version of the driver.For Sybase:
make build sybase artifact=/tmp/jconn4-16.0_PL05.jar version=16.0_PL05
In this command, replace
/tmp/jconn4-16.0_PL05.jar
with the path name of the downloaded Sybase driver and16.0_PL05
with the version of the driver.
Run the following command to list the Docker images that are available locally:
docker images
Note the name of the image that was built, for example,
jboss-kie-db2-extension-openshift-image
, and the version tag of the image, for example,11.1.4.4
(not thelatest
tag).-
Access the registry of your OpenShift environment directly and push the image to the registry. Depending on your user permissions, you can push the image into the
openshift
namespace or into a project namespace. For instructions about accessing the registry and pushing the images, see Accessing the Registry Directly. When configuring your Process Server deployment with a template that supports an external database server, set the following parameters:
-
Drivers Extension Image (
EXTENSIONS_IMAGE
): The ImageStreamTag definition of the extension image, for example,jboss-kie-db2-extension-openshift-image:11.1.4.4
-
Drivers ImageStream Namespace (
EXTENSIONS_IMAGE_NAMESPACE
): The namespace to which you uploaded the extension image, for example,openshift
or your project namespace.
-
Drivers Extension Image (
2.6. Extracting the source code from Business Central for use in an S2I build
If you are using Business Central for authoring services, you can extract the source code for your service and place it into a separate Git repository, such as GitHub or an on-premise installation of GitLab, for use in the S2I build.
Procedure
Use the following command to extract the source code:
git clone https://<business-central-host>:443/git/<MySpace>/<MyProject>
In this command, replace the following variables:
-
<business-central-host>
with the host on which Business Central is running -
<MySpace>
with the name of the Business Central space in which the project is located -
<MyProject>
with the name of the project
NoteTo view the full Git URL for a project in Business Central, click Menu → Design → <MyProject> → Settings.
NoteIf you are using self-signed certificates for HTTPS communication, the command might fail with an
SSL certificate problem
error message. In this case, disable SSL certificate verification ingit
, for example, using theGIT_SSL_NO_VERIFY
environment variable:env GIT_SSL_NO_VERIFY=true git clone https://<business-central-host>:443/git/<MySpace>/<MyProject>
-
- Upload the source code to another Git repository, such as GitHub or GitLab, for the S2I build.
2.7. Preparing a Maven mirror repository for offline use
If your Red Hat OpenShift Container Platform environment does not have outgoing access to the public Internet, you must prepare a Maven repository with a mirror of all the necessary artifacts and make this repository available to your environment.
You do not need to complete this procedure if your Red Hat OpenShift Container Platform environment is connected to the Internet.
Prerequisites
- A computer that has outgoing access to the public Internet is available.
Procedure
- Prepare a Maven release repository to which you can write. The repository must allow read access without authentication. Your OpenShift environment must have access to this repository. You can deploy a Nexus repository manager in the OpenShift environment. For instructions about setting up Nexus on OpenShift, see Setting up Nexus. Use this repository as a mirror repository. If you are planning to create immutable servers from KJAR services or to deploy Business Central Monitoring, place your services in this repository as well. You must configure this repository as the external Maven repository. You cannot configure a separate mirror repository in an immutable environment.
On the computer that has an outgoing connection to the public Internet, complete the following steps:
- Download the latest version of the Offliner tool.
-
Download the
rhpam-7.5.1-offliner.txt
product deliverable file from the Software Downloads page of the Red Hat Customer Portal. Enter the following command to use the Offliner tool to download the required artifacts:
java -jar offliner-<version>.jar -r https://maven.repository.redhat.com/ga/ -r https://repo1.maven.org/maven2/ -d /home/user/temp rhpam-7.5.1-offliner.txt
Replace
/home/user/temp
with an empty temporary directory and<version>
with the version of the Offliner tool that you downloaded. The download can take a significant amount of time.- Upload all artifacts from the temporary directory to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility to upload the artifacts.
If you developed services outside Business Central and they have additional dependencies, add the dependencies to the mirror repository. If you developed the services as Maven projects, you can use the following steps to prepare these dependencies automatically. Complete the steps on the computer that has an outgoing connection to the public Internet.
-
Create a backup of the local Maven cache directory (
~/.m2/repository
) and then clear the directory. -
Build the source of your projects using the
mvn clean install
command. For every project, enter the following command to ensure that Maven downloads all runtime dependencies for all the artifacts generated by the project:
mvn -e -DskipTests dependency:go-offline -f /path/to/project/pom.xml --batch-mode -Djava.net.preferIPv4Stack=true
Replace
/path/to/project/pom.xml
with the correct path to thepom.xml
file of the project.-
Upload all artifacts from the local Maven cache directory (
~/.m2/repository
) to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility to upload the artifacts.
-
Create a backup of the local Maven cache directory (