Skip to content

Latest commit

 

History

History
438 lines (340 loc) · 37.4 KB

rhpam71-authoring.adoc

File metadata and controls

438 lines (340 loc) · 37.4 KB
Raw

rhpam71-authoring

Application template for a non-HA persistent authoring environment, for Red Hat Process Automation Manager 7.1

Table of Contents

Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable name Image Environment Variable Description Example value Required

APPLICATION_NAME

 — 

The name for the application.

myapp

True

KIE_ADMIN_USER

KIE_ADMIN_USER

KIE administrator username

adminUser

False

KIE_ADMIN_PWD

KIE_ADMIN_PWD

KIE administrator password

${KIE_ADMIN_PWD}

False

KIE_SERVER_CONTROLLER_USER

KIE_SERVER_CONTROLLER_USER

KIE server controller username (Sets the org.kie.server.controller.user system property)

controllerUser

False

KIE_SERVER_CONTROLLER_PWD

KIE_SERVER_CONTROLLER_PWD

KIE server controller password (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

False

KIE_SERVER_CONTROLLER_TOKEN

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

False

KIE_SERVER_USER

KIE_SERVER_USER

KIE server username (Sets the org.kie.server.user system property)

executionUser

False

KIE_SERVER_PWD

KIE_SERVER_PWD

KIE server password (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

False

KIE_SERVER_BYPASS_AUTH_USER

KIE_SERVER_BYPASS_AUTH_USER

KIE server bypass auth user (Sets the org.kie.server.bypass.auth.user system property)

false

False

KIE_SERVER_PERSISTENCE_DS

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource (Sets the org.kie.server.persistence.ds system property)

java:/jboss/datasources/rhpam

False

KIE_SERVER_H2_USER

 — 

KIE server H2 database username

sa

False

KIE_SERVER_H2_PWD

 — 

KIE server H2 database password

 — 

False

KIE_MBEANS

KIE_MBEANS

KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties)

enabled

False

DROOLS_SERVER_FILTER_CLASSES

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering (Sets the org.drools.server.filter.classes system property)

true

False

BUSINESS_CENTRAL_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentr-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

False

BUSINESS_CENTRAL_HOSTNAME_HTTPS

HOSTNAME_HTTP

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentr-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

False

KIE_SERVER_HOSTNAME_HTTP

HOSTNAME_HTTP

Custom hostname for http service route, if set will also configure the KIE_SERVER_HOST. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

False

KIE_SERVER_HOSTNAME_HTTPS

HOSTNAME_HTTP

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

False

KIE_SERVER_USE_SECURE_ROUTE_NAME

KIE_SERVER_USE_SECURE_ROUTE_NAME

Use https for the KIE_SERVER_HOST when it is not explicit configured to a custom value.

false

False

BUSINESS_CENTRAL_HTTPS_SECRET

 — 

The name of the secret containing the keystore file

 — 

True

BUSINESS_CENTRAL_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret

keystore.jks

False

BUSINESS_CENTRAL_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate

jboss

False

BUSINESS_CENTRAL_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate

mykeystorepass

False

KIE_SERVER_HTTPS_SECRET

 — 

The name of the secret containing the keystore file

 — 

True

KIE_SERVER_HTTPS_KEYSTORE

HTTPS_KEYSTORE

The name of the keystore file within the secret

keystore.jks

False

KIE_SERVER_HTTPS_NAME

HTTPS_NAME

The name associated with the server certificate

jboss

False

KIE_SERVER_HTTPS_PASSWORD

HTTPS_PASSWORD

The password for the keystore and certificate

mykeystorepass

False

DB_VOLUME_CAPACITY

 — 

Size of persistent storage for database volume.

1Gi

True

IMAGE_STREAM_NAMESPACE

 — 

Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you’ve installed the ImageStreams in a different namespace/project.

openshift

True

KIE_SERVER_IMAGE_STREAM_NAME

 — 

The name of the image stream to use for KIE server. Default is "rhpam71-kieserver-openshift".

rhpam71-kieserver-openshift

True

IMAGE_STREAM_TAG

 — 

A named pointer to an image in an image stream. Default is "1.1".

1.1

True

MAVEN_REPO_ID

MAVEN_REPO_ID

The id to use for the maven repository, if set. Default is generated randomly.

${MAVEN_REPO_ID}

False

MAVEN_REPO_URL

MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

False

MAVEN_REPO_USERNAME

MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

False

MAVEN_REPO_PASSWORD

MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

False

BUSINESS_CENTRAL_MAVEN_USERNAME

 — 

Username to access the Maven service hosted by Business Central inside EAP.

mavenUser

True

BUSINESS_CENTRAL_MAVEN_PASSWORD

 — 

Password to access the Maven service hosted by Business Central inside EAP.

 — 

True

GIT_HOOKS_DIR

GIT_HOOKS_DIR

The directory to use for git hooks, if required.

${GIT_HOOKS_DIR}

False

BUSINESS_CENTRAL_VOLUME_CAPACITY

 — 

Size of the persistent storage for Business Central’s runtime data.

1Gi

True

BUSINESS_CENTRAL_MEMORY_LIMIT

 — 

Business Central Container memory limit

2Gi

False

KIE_SERVER_MEMORY_LIMIT

 — 

KIE server Container memory limit

1Gi

False

SSO_URL

SSO_URL

RH-SSO URL

${SSO_URL}

False

SSO_REALM

SSO_REALM

RH-SSO Realm name

${SSO_REALM}

False

BUSINESS_CENTRAL_SSO_CLIENT

SSO_CLIENT

Business Central RH-SSO Client name

${BUSINESS_CENTRAL_SSO_CLIENT}

False

BUSINESS_CENTRAL_SSO_SECRET

SSO_SECRET

Business Central RH-SSO Client Secret

${BUSINESS_CENTRAL_SSO_SECRET}

False

KIE_SERVER_SSO_CLIENT

SSO_CLIENT

KIE Server RH-SSO Client name

${BUSINESS_CENTRAL_SSO_CLIENT}

False

KIE_SERVER_SSO_SECRET

SSO_SECRET

KIE Server RH-SSO Client Secret

${BUSINESS_CENTRAL_SSO_SECRET}

False

SSO_USERNAME

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist

${SSO_USERNAME}

False

SSO_PASSWORD

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client

${SSO_PASSWORD}

False

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation

false

False

SSO_PRINCIPAL_ATTRIBUTE

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

preferred_username

False

AUTH_LDAP_URL

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication

${AUTH_LDAP_URL}

False

AUTH_LDAP_BIND_DN

AUTH_LDAP_BIND_DN

Bind DN used for authentication

${AUTH_LDAP_BIND_DN}

False

AUTH_LDAP_BIND_CREDENTIAL

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication

${AUTH_LDAP_BIND_CREDENTIAL}

False

AUTH_LDAP_JAAS_SECURITY_DOMAIN

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

False

AUTH_LDAP_BASE_CTX_DN

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

False

AUTH_LDAP_BASE_FILTER

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

False

AUTH_LDAP_SEARCH_SCOPE

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

False

AUTH_LDAP_SEARCH_TIME_LIMIT

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

False

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

False

AUTH_LDAP_PARSE_USERNAME

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

False

AUTH_LDAP_USERNAME_BEGIN_STRING

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

False

AUTH_LDAP_USERNAME_END_STRING

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

False

AUTH_LDAP_ROLE_ATTRIBUTE_ID

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

False

AUTH_LDAP_ROLES_CTX_DN

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

False

AUTH_LDAP_ROLE_FILTER

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

False

AUTH_LDAP_ROLE_RECURSION

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

False

AUTH_LDAP_DEFAULT_ROLE

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

${AUTH_LDAP_DEFAULT_ROLE}

False

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

False

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

False

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

False

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, this option can be ignored. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

False

Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

Service Port Name Description

${APPLICATION_NAME}-rhpamcentr

8080

http

All the Business Central web server’s ports.

8443

https

8001

git-ssh

${APPLICATION_NAME}-kieserver

8080

http

All the KIE server web server’s ports.

8443

https

Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

Service Security Hostname

${APPLICATION_NAME}-rhpamcentr-http

none

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

${APPLICATION_NAME}-rhpamcentr-https

TLS passthrough

${BUSINESS_CENTRAL_HOSTNAME_HTTPS}

${APPLICATION_NAME}-kieserver-http

none

${KIE_SERVER_HOSTNAME_HTTP}

${APPLICATION_NAME}-kieserver-https

TLS passthrough

${KIE_SERVER_HOSTNAME_HTTPS}

Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

Deployment Triggers

${APPLICATION_NAME}-rhpamcentr

ImageChange

${APPLICATION_NAME}-kieserver

ImageChange

Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

Deployment Replicas

${APPLICATION_NAME}-rhpamcentr

1

${APPLICATION_NAME}-kieserver

1

Pod Template

Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

Deployment Service Account

${APPLICATION_NAME}-rhpamcentr

${APPLICATION_NAME}-rhpamsvc

${APPLICATION_NAME}-kieserver

${APPLICATION_NAME}-rhpamsvc
Image
Deployment Image

${APPLICATION_NAME}-rhpamcentr

rhpam71-businesscentral-openshift

${APPLICATION_NAME}-kieserver

${KIE_SERVER_IMAGE_STREAM_NAME}
Readiness Probe
${APPLICATION_NAME}-rhpamcentr
/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/kie-wb.jsp
${APPLICATION_NAME}-kieserver
/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck
Liveness Probe
${APPLICATION_NAME}-rhpamcentr
/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/kie-wb.jsp
${APPLICATION_NAME}-kieserver
/bin/bash -c curl --fail --silent -u '${KIE_ADMIN_USER}:${KIE_ADMIN_PWD}' http://localhost:8080/services/rest/server/readycheck
Exposed Ports
Deployments Name Port Protocol

${APPLICATION_NAME}-rhpamcentr

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP

git-ssh

8001

TCP

${APPLICATION_NAME}-kieserver

jolokia

8778

TCP

http

8080

TCP

https

8443

TCP
Image Environment Variables
Deployment Variable name Description Example value

${APPLICATION_NAME}-rhpamcentr

KIE_ADMIN_USER

KIE administrator username

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password

${KIE_ADMIN_PWD}

KIE_MBEANS

KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties)

${KIE_MBEANS}

KIE_SERVER_CONTROLLER_USER

KIE server controller username (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_CONTROLLER_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server controller password (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

KIE_SERVER_USER

KIE server username (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

MAVEN_REPO_ID

The id to use for the maven repository, if set. Default is generated randomly.

${MAVEN_REPO_ID}

MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

KIE_MAVEN_USER

 — 

${BUSINESS_CENTRAL_MAVEN_USERNAME}

KIE_MAVEN_PWD

 — 

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

GIT_HOOKS_DIR

The directory to use for git hooks, if required.

${GIT_HOOKS_DIR}

HTTPS_KEYSTORE_DIR

 — 

/etc/businesscentral-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret

${BUSINESS_CENTRAL_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate

${BUSINESS_CENTRAL_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate

${BUSINESS_CENTRAL_HTTPS_PASSWORD}

WORKBENCH_ROUTE_NAME

 — 

${APPLICATION_NAME}-rhpamcentr

SSO_URL

RH-SSO URL

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name

${SSO_REALM}

SSO_SECRET

Business Central RH-SSO Client Secret

${BUSINESS_CENTRAL_SSO_SECRET}

SSO_CLIENT

Business Central RH-SSO Client name

${BUSINESS_CENTRAL_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentr-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentr-<project>.<default-domain-suffix>

${BUSINESS_CENTRAL_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, this option can be ignored. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}

${APPLICATION_NAME}-kieserver

DATASOURCES

 — 

RHPAM

RHPAM_DATABASE

 — 

rhpam7

RHPAM_JNDI

 — 

${KIE_SERVER_PERSISTENCE_DS}

RHPAM_JTA

 — 

true

RHPAM_DRIVER

 — 

h2

RHPAM_USERNAME

 — 

${KIE_SERVER_H2_USER}

RHPAM_PASSWORD

 — 

${KIE_SERVER_H2_PWD}

RHPAM_XA_CONNECTION_PROPERTY_URL

 — 

jdbc:h2:/opt/eap/standalone/data/rhpam

RHPAM_SERVICE_HOST

 — 

dummy_ignored

RHPAM_SERVICE_PORT

 — 

12345

KIE_SERVER_PERSISTENCE_DIALECT

 — 

org.hibernate.dialect.H2Dialect

DROOLS_SERVER_FILTER_CLASSES

KIE server class filtering (Sets the org.drools.server.filter.classes system property)

${DROOLS_SERVER_FILTER_CLASSES}

KIE_ADMIN_USER

KIE administrator username

${KIE_ADMIN_USER}

KIE_ADMIN_PWD

KIE administrator password

${KIE_ADMIN_PWD}

KIE_MBEANS

KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties)

${KIE_MBEANS}

KIE_SERVER_BYPASS_AUTH_USER

KIE server bypass auth user (Sets the org.kie.server.bypass.auth.user system property)

${KIE_SERVER_BYPASS_AUTH_USER}

KIE_SERVER_CONTROLLER_USER

KIE server controller username (Sets the org.kie.server.controller.user system property)

${KIE_SERVER_CONTROLLER_USER}

KIE_SERVER_CONTROLLER_PWD

KIE server controller password (Sets the org.kie.server.controller.pwd system property)

${KIE_SERVER_CONTROLLER_PWD}

KIE_SERVER_CONTROLLER_TOKEN

KIE server controller token for bearer authentication (Sets the org.kie.server.controller.token system property)

${KIE_SERVER_CONTROLLER_TOKEN}

KIE_SERVER_CONTROLLER_SERVICE

 — 

${APPLICATION_NAME}-rhpamcentr

KIE_SERVER_CONTROLLER_PROTOCOL

 — 

ws

KIE_SERVER_ID

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_HOST

Custom hostname for http service route, if set will also configure the KIE_SERVER_HOST. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

KIE_SERVER_ROUTE_NAME

 — 

${APPLICATION_NAME}-kieserver

KIE_SERVER_USE_SECURE_ROUTE_NAME

Use https for the KIE_SERVER_HOST when it is not explicit configured to a custom value.

${KIE_SERVER_USE_SECURE_ROUTE_NAME}

KIE_SERVER_PERSISTENCE_DS

KIE server persistence datasource (Sets the org.kie.server.persistence.ds system property)

${KIE_SERVER_PERSISTENCE_DS}

KIE_SERVER_USER

KIE server username (Sets the org.kie.server.user system property)

${KIE_SERVER_USER}

KIE_SERVER_PWD

KIE server password (Sets the org.kie.server.pwd system property)

${KIE_SERVER_PWD}

MAVEN_REPOS

 — 

RHPAMCENTR,EXTERNAL

RHPAMCENTR_MAVEN_REPO_SERVICE

 — 

${APPLICATION_NAME}-rhpamcentr

RHPAMCENTR_MAVEN_REPO_PATH

 — 

/maven2/

RHPAMCENTR_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${BUSINESS_CENTRAL_MAVEN_USERNAME}

RHPAMCENTR_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${BUSINESS_CENTRAL_MAVEN_PASSWORD}

EXTERNAL_MAVEN_REPO_ID

The id to use for the maven repository, if set. Default is generated randomly.

${MAVEN_REPO_ID}

EXTERNAL_MAVEN_REPO_URL

Fully qualified URL to a Maven repository or service.

${MAVEN_REPO_URL}

EXTERNAL_MAVEN_REPO_USERNAME

Username to access the Maven repository, if required.

${MAVEN_REPO_USERNAME}

EXTERNAL_MAVEN_REPO_PASSWORD

Password to access the Maven repository, if required.

${MAVEN_REPO_PASSWORD}

HTTPS_KEYSTORE_DIR

 — 

/etc/kieserver-secret-volume

HTTPS_KEYSTORE

The name of the keystore file within the secret

${KIE_SERVER_HTTPS_KEYSTORE}

HTTPS_NAME

The name associated with the server certificate

${KIE_SERVER_HTTPS_NAME}

HTTPS_PASSWORD

The password for the keystore and certificate

${KIE_SERVER_HTTPS_PASSWORD}

SSO_URL

RH-SSO URL

${SSO_URL}

SSO_OPENIDCONNECT_DEPLOYMENTS

 — 

ROOT.war

SSO_REALM

RH-SSO Realm name

${SSO_REALM}

SSO_SECRET

Business Central RH-SSO Client Secret

${KIE_SERVER_SSO_SECRET}

SSO_CLIENT

Business Central RH-SSO Client name

${KIE_SERVER_SSO_CLIENT}

SSO_USERNAME

RH-SSO Realm Admin Username used to create the Client if it doesn’t exist

${SSO_USERNAME}

SSO_PASSWORD

RH-SSO Realm Admin Password used to create the Client

${SSO_PASSWORD}

SSO_DISABLE_SSL_CERTIFICATE_VALIDATION

RH-SSO Disable SSL Certificate Validation

${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}

SSO_PRINCIPAL_ATTRIBUTE

RH-SSO Principal Attribute to use as username.

${SSO_PRINCIPAL_ATTRIBUTE}

HOSTNAME_HTTP

Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentr-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTP}

HOSTNAME_HTTPS

Custom hostname for https service route. Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentr-<project>.<default-domain-suffix>

${KIE_SERVER_HOSTNAME_HTTPS}

AUTH_LDAP_URL

LDAP Endpoint to connect for authentication

${AUTH_LDAP_URL}

AUTH_LDAP_BIND_DN

Bind DN used for authentication

${AUTH_LDAP_BIND_DN}

AUTH_LDAP_BIND_CREDENTIAL

LDAP Credentials used for authentication

${AUTH_LDAP_BIND_CREDENTIAL}

AUTH_LDAP_JAAS_SECURITY_DOMAIN

The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.

${AUTH_LDAP_JAAS_SECURITY_DOMAIN}

AUTH_LDAP_BASE_CTX_DN

LDAP Base DN of the top-level context to begin the user search.

${AUTH_LDAP_BASE_CTX_DN}

AUTH_LDAP_BASE_FILTER

LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).

${AUTH_LDAP_BASE_FILTER}

AUTH_LDAP_SEARCH_SCOPE

The search scope to use.

${AUTH_LDAP_SEARCH_SCOPE}

AUTH_LDAP_SEARCH_TIME_LIMIT

The timeout in milliseconds for user or role searches.

${AUTH_LDAP_SEARCH_TIME_LIMIT}

AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE

The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.

${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}

AUTH_LDAP_PARSE_USERNAME

A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.

${AUTH_LDAP_PARSE_USERNAME}

AUTH_LDAP_USERNAME_BEGIN_STRING

Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_BEGIN_STRING}

AUTH_LDAP_USERNAME_END_STRING

Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.

${AUTH_LDAP_USERNAME_END_STRING}

AUTH_LDAP_ROLE_ATTRIBUTE_ID

Name of the attribute containing the user roles.

${AUTH_LDAP_ROLE_ATTRIBUTE_ID}

AUTH_LDAP_ROLES_CTX_DN

The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.

${AUTH_LDAP_ROLES_CTX_DN}

AUTH_LDAP_ROLE_FILTER

A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).

${AUTH_LDAP_ROLE_FILTER}

AUTH_LDAP_ROLE_RECURSION

The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.

${AUTH_LDAP_ROLE_RECURSION}

AUTH_LDAP_DEFAULT_ROLE

A role included for all authenticated users

${AUTH_LDAP_DEFAULT_ROLE}

AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID

Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.

${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}

AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN

A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.

${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}

AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN

Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.

${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}

AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK

If you are not using referrals, this option can be ignored. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.

${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}
Volumes
Deployment Name mountPath Purpose readOnly

${APPLICATION_NAME}-rhpamcentr

businesscentral-keystore-volume

/etc/businesscentral-secret-volume

ssl certs

True

${APPLICATION_NAME}-kieserver

kieserver-keystore-volume

/etc/kieserver-secret-volume

ssl certs

True

External Dependencies

Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

Name Access Mode

${APPLICATION_NAME}-rhpamcentr-claim

ReadWriteOnce

${APPLICATION_NAME}-h2-claim

ReadWriteOnce

Secrets

This template requires the following secrets to be installed for the application to run.

businesscentral-app-secret kieserver-app-secret