sso73-x509-mysql-persistent.json

{
    "apiVersion": "v1",
    "kind": "Template",
    "labels": {
        "rhsso": "7.3.7.GA",
        "template": "sso73-x509-mysql-persistent"
    },
    "message": "A new persistent RH-SSO service (using MySQL) has been created in your project. The admin username/password for accessing the master realm via the RH-SSO console is ${SSO_ADMIN_USERNAME}/${SSO_ADMIN_PASSWORD}. The username/password for accessing the MySQL database \"${DB_DATABASE}\" is ${DB_USERNAME}/${DB_PASSWORD}. The HTTPS keystore used for serving secure content, the JGroups keystore used for securing JGroups communications, and server truststore used for securing RH-SSO requests were automatically created via OpenShift's service serving x509 certificate secrets.",
    "metadata": {
        "annotations": {
            "description": "An example application based on RH-SSO 7.3 image. For more information about using this template, see https://github.com/jboss-container-images/redhat-sso-7-openshift-image/docs.",
            "iconClass": "icon-sso",
            "openshift.io/display-name": "Red Hat Single Sign-On 7.3 + MySQL (Persistent)",
            "openshift.io/provider-display-name": "Red Hat, Inc.",
            "tags": "sso,keycloak,jboss",
            "template.openshift.io/documentation-url": "https://access.redhat.com/documentation/en/red-hat-single-sign-on/",
            "template.openshift.io/long-description": "This template defines resources needed to develop Red Hat Single Sign-On 7.3 server based deployment, deployment configuration for MySQL using persistence, and securing RH-SSO communication using re-encrypt TLS.",
            "template.openshift.io/support-url": "https://access.redhat.com",
            "version": "7.3.7.GA"
        },
        "name": "sso73-x509-mysql-persistent"
    },
    "objects": [
        {
            "apiVersion": "v1",
            "kind": "Service",
            "metadata": {
                "annotations": {
                    "description": "The web server's https port.",
                    "service.alpha.openshift.io/dependencies": "[{\"name\": \"${APPLICATION_NAME}-mysql\", \"kind\": \"Service\"}]",
                    "service.alpha.openshift.io/serving-cert-secret-name": "sso-x509-https-secret"
                },
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}"
            },
            "spec": {
                "ports": [
                    {
                        "port": 8443,
                        "targetPort": 8443
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                }
            }
        },
        {
            "apiVersion": "v1",
            "kind": "Service",
            "metadata": {
                "annotations": {
                    "description": "The database server's port."
                },
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}-mysql"
            },
            "spec": {
                "ports": [
                    {
                        "port": 3306,
                        "targetPort": 3306
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}-mysql"
                }
            }
        },
        {
            "apiVersion": "v1",
            "kind": "Service",
            "metadata": {
                "annotations": {
                    "description": "The JGroups ping port for clustering.",
                    "service.alpha.kubernetes.io/tolerate-unready-endpoints": "true",
                    "service.alpha.openshift.io/serving-cert-secret-name": "sso-x509-jgroups-secret"
                },
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}-ping"
            },
            "spec": {
                "clusterIP": "None",
                "ports": [
                    {
                        "name": "ping",
                        "port": 8888
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                }
            }
        },
        {
            "apiVersion": "v1",
            "id": "${APPLICATION_NAME}-https",
            "kind": "Route",
            "metadata": {
                "annotations": {
                    "description": "Route for application's https service."
                },
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}"
            },
            "spec": {
                "tls": {
                    "termination": "reencrypt"
                },
                "to": {
                    "name": "${APPLICATION_NAME}"
                }
            }
        },
        {
            "apiVersion": "v1",
            "kind": "DeploymentConfig",
            "metadata": {
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}"
            },
            "spec": {
                "replicas": 1,
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                },
                "strategy": {
                    "type": "Recreate"
                },
                "template": {
                    "metadata": {
                        "labels": {
                            "application": "${APPLICATION_NAME}",
                            "deploymentConfig": "${APPLICATION_NAME}"
                        },
                        "name": "${APPLICATION_NAME}"
                    },
                    "spec": {
                        "containers": [
                            {
                                "env": [
                                    {
                                        "name": "SSO_HOSTNAME",
                                        "value": "${SSO_HOSTNAME}"
                                    },
                                    {
                                        "name": "DB_SERVICE_PREFIX_MAPPING",
                                        "value": "${APPLICATION_NAME}-mysql=DB"
                                    },
                                    {
                                        "name": "DB_JNDI",
                                        "value": "${DB_JNDI}"
                                    },
                                    {
                                        "name": "DB_USERNAME",
                                        "value": "${DB_USERNAME}"
                                    },
                                    {
                                        "name": "DB_PASSWORD",
                                        "value": "${DB_PASSWORD}"
                                    },
                                    {
                                        "name": "DB_DATABASE",
                                        "value": "${DB_DATABASE}"
                                    },
                                    {
                                        "name": "TX_DATABASE_PREFIX_MAPPING",
                                        "value": "${APPLICATION_NAME}-mysql=DB"
                                    },
                                    {
                                        "name": "DB_MIN_POOL_SIZE",
                                        "value": "${DB_MIN_POOL_SIZE}"
                                    },
                                    {
                                        "name": "DB_MAX_POOL_SIZE",
                                        "value": "${DB_MAX_POOL_SIZE}"
                                    },
                                    {
                                        "name": "DB_TX_ISOLATION",
                                        "value": "${DB_TX_ISOLATION}"
                                    },
                                    {
                                        "name": "JGROUPS_PING_PROTOCOL",
                                        "value": "openshift.DNS_PING"
                                    },
                                    {
                                        "name": "OPENSHIFT_DNS_PING_SERVICE_NAME",
                                        "value": "${APPLICATION_NAME}-ping"
                                    },
                                    {
                                        "name": "OPENSHIFT_DNS_PING_SERVICE_PORT",
                                        "value": "8888"
                                    },
                                    {
                                        "name": "X509_CA_BUNDLE",
                                        "value": "/var/run/secrets/kubernetes.io/serviceaccount/service-ca.crt /var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
                                    },
                                    {
                                        "name": "JGROUPS_CLUSTER_PASSWORD",
                                        "value": "${JGROUPS_CLUSTER_PASSWORD}"
                                    },
                                    {
                                        "name": "SSO_ADMIN_USERNAME",
                                        "value": "${SSO_ADMIN_USERNAME}"
                                    },
                                    {
                                        "name": "SSO_ADMIN_PASSWORD",
                                        "value": "${SSO_ADMIN_PASSWORD}"
                                    },
                                    {
                                        "name": "SSO_REALM",
                                        "value": "${SSO_REALM}"
                                    },
                                    {
                                        "name": "SSO_SERVICE_USERNAME",
                                        "value": "${SSO_SERVICE_USERNAME}"
                                    },
                                    {
                                        "name": "SSO_SERVICE_PASSWORD",
                                        "value": "${SSO_SERVICE_PASSWORD}"
                                    }
                                ],
                                "image": "${APPLICATION_NAME}",
                                "imagePullPolicy": "Always",
                                "livenessProbe": {
                                    "exec": {
                                        "command": [
                                            "/bin/bash",
                                            "-c",
                                            "/opt/eap/bin/livenessProbe.sh"
                                        ]
                                    },
                                    "initialDelaySeconds": 60
                                },
                                "name": "${APPLICATION_NAME}",
                                "ports": [
                                    {
                                        "containerPort": 8778,
                                        "name": "jolokia",
                                        "protocol": "TCP"
                                    },
                                    {
                                        "containerPort": 8080,
                                        "name": "http",
                                        "protocol": "TCP"
                                    },
                                    {
                                        "containerPort": 8443,
                                        "name": "https",
                                        "protocol": "TCP"
                                    },
                                    {
                                        "containerPort": 8888,
                                        "name": "ping",
                                        "protocol": "TCP"
                                    }
                                ],
                                "readinessProbe": {
                                    "exec": {
                                        "command": [
                                            "/bin/bash",
                                            "-c",
                                            "/opt/eap/bin/readinessProbe.sh"
                                        ]
                                    }
                                },
                                "resources": {
                                    "limits": {
                                        "memory": "${MEMORY_LIMIT}"
                                    }
                                },
                                "volumeMounts": [
                                    {
                                        "mountPath": "/etc/x509/https",
                                        "name": "sso-x509-https-volume",
                                        "readOnly": true
                                    },
                                    {
                                        "mountPath": "/etc/x509/jgroups",
                                        "name": "sso-x509-jgroups-volume",
                                        "readOnly": true
                                    }
                                ]
                            }
                        ],
                        "terminationGracePeriodSeconds": 75,
                        "volumes": [
                            {
                                "name": "sso-x509-https-volume",
                                "secret": {
                                    "secretName": "sso-x509-https-secret"
                                }
                            },
                            {
                                "name": "sso-x509-jgroups-volume",
                                "secret": {
                                    "secretName": "sso-x509-jgroups-secret"
                                }
                            }
                        ]
                    }
                },
                "triggers": [
                    {
                        "imageChangeParams": {
                            "automatic": true,
                            "containerNames": [
                                "${APPLICATION_NAME}"
                            ],
                            "from": {
                                "kind": "ImageStreamTag",
                                "name": "redhat-sso73-openshift:1.0",
                                "namespace": "${IMAGE_STREAM_NAMESPACE}"
                            }
                        },
                        "type": "ImageChange"
                    },
                    {
                        "type": "ConfigChange"
                    }
                ]
            }
        },
        {
            "apiVersion": "v1",
            "kind": "DeploymentConfig",
            "metadata": {
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}-mysql"
            },
            "spec": {
                "replicas": 1,
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}-mysql"
                },
                "strategy": {
                    "type": "Recreate"
                },
                "template": {
                    "metadata": {
                        "labels": {
                            "application": "${APPLICATION_NAME}",
                            "deploymentConfig": "${APPLICATION_NAME}-mysql"
                        },
                        "name": "${APPLICATION_NAME}-mysql"
                    },
                    "spec": {
                        "containers": [
                            {
                                "env": [
                                    {
                                        "name": "MYSQL_USER",
                                        "value": "${DB_USERNAME}"
                                    },
                                    {
                                        "name": "MYSQL_PASSWORD",
                                        "value": "${DB_PASSWORD}"
                                    },
                                    {
                                        "name": "MYSQL_DATABASE",
                                        "value": "${DB_DATABASE}"
                                    },
                                    {
                                        "name": "MYSQL_LOWER_CASE_TABLE_NAMES",
                                        "value": "${MYSQL_LOWER_CASE_TABLE_NAMES}"
                                    },
                                    {
                                        "name": "MYSQL_MAX_CONNECTIONS",
                                        "value": "${MYSQL_MAX_CONNECTIONS}"
                                    },
                                    {
                                        "name": "MYSQL_FT_MIN_WORD_LEN",
                                        "value": "${MYSQL_FT_MIN_WORD_LEN}"
                                    },
                                    {
                                        "name": "MYSQL_FT_MAX_WORD_LEN",
                                        "value": "${MYSQL_FT_MAX_WORD_LEN}"
                                    },
                                    {
                                        "name": "MYSQL_AIO",
                                        "value": "${MYSQL_AIO}"
                                    }
                                ],
                                "image": "mysql",
                                "imagePullPolicy": "Always",
                                "livenessProbe": {
                                    "failureThreshold": 3,
                                    "initialDelaySeconds": 90,
                                    "successThreshold:": 1,
                                    "tcpSocket": {
                                        "port": 3306
                                    },
                                    "timeoutSeconds": 10
                                },
                                "name": "${APPLICATION_NAME}-mysql",
                                "ports": [
                                    {
                                        "containerPort": 3306,
                                        "protocol": "TCP"
                                    }
                                ],
                                "readinessProbe": {
                                    "exec": {
                                        "command": [
                                            "/bin/sh",
                                            "-i",
                                            "-c",
                                            "MYSQL_PWD=\"$MYSQL_PASSWORD\" mysql -h 127.0.0.1 -u $MYSQL_USER -D $MYSQL_DATABASE -e 'SELECT 1'"
                                        ]
                                    },
                                    "failureThreshold": 3,
                                    "initialDelaySeconds": 90,
                                    "successThreshold:": 1,
                                    "timeoutSeconds": 10
                                },
                                "volumeMounts": [
                                    {
                                        "mountPath": "/var/lib/mysql/data",
                                        "name": "${APPLICATION_NAME}-mysql-pvol"
                                    }
                                ]
                            }
                        ],
                        "terminationGracePeriodSeconds": 60,
                        "volumes": [
                            {
                                "name": "${APPLICATION_NAME}-mysql-pvol",
                                "persistentVolumeClaim": {
                                    "claimName": "${APPLICATION_NAME}-mysql-claim"
                                }
                            }
                        ]
                    }
                },
                "triggers": [
                    {
                        "imageChangeParams": {
                            "automatic": true,
                            "containerNames": [
                                "${APPLICATION_NAME}-mysql"
                            ],
                            "from": {
                                "kind": "ImageStreamTag",
                                "name": "mysql:${MYSQL_IMAGE_STREAM_TAG}",
                                "namespace": "${IMAGE_STREAM_NAMESPACE}"
                            }
                        },
                        "type": "ImageChange"
                    },
                    {
                        "type": "ConfigChange"
                    }
                ]
            }
        },
        {
            "apiVersion": "v1",
            "kind": "PersistentVolumeClaim",
            "metadata": {
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "name": "${APPLICATION_NAME}-mysql-claim"
            },
            "spec": {
                "accessModes": [
                    "ReadWriteOnce"
                ],
                "resources": {
                    "requests": {
                        "storage": "${VOLUME_CAPACITY}"
                    }
                }
            }
        }
    ],
    "parameters": [
        {
            "description": "The name for the application.",
            "displayName": "Application Name",
            "name": "APPLICATION_NAME",
            "required": true,
            "value": "sso"
        },
        {
            "description": "Custom hostname for the RH-SSO server.",
            "displayName": "Custom RH-SSO Server Hostname",
            "name": "SSO_HOSTNAME",
            "required": false,
            "value": ""
        },
        {
            "description": "The password for the JGroups cluster.",
            "displayName": "JGroups Cluster Password",
            "from": "[a-zA-Z0-9]{32}",
            "generate": "expression",
            "name": "JGROUPS_CLUSTER_PASSWORD",
            "required": true
        },
        {
            "description": "Database JNDI name used by application to resolve the datasource, e.g. java:/jboss/datasources/mysql",
            "displayName": "Database JNDI Name",
            "name": "DB_JNDI",
            "required": false,
            "value": "java:jboss/datasources/KeycloakDS"
        },
        {
            "description": "Database name",
            "displayName": "Database Name",
            "name": "DB_DATABASE",
            "required": true,
            "value": "root"
        },
        {
            "description": "Sets xa-pool/min-pool-size for the configured datasource.",
            "displayName": "Datasource Minimum Pool Size",
            "name": "DB_MIN_POOL_SIZE",
            "required": false
        },
        {
            "description": "Sets xa-pool/max-pool-size for the configured datasource.",
            "displayName": "Datasource Maximum Pool Size",
            "name": "DB_MAX_POOL_SIZE",
            "required": false
        },
        {
            "description": "Sets transaction-isolation for the configured datasource.",
            "displayName": "Datasource Transaction Isolation",
            "name": "DB_TX_ISOLATION",
            "required": false
        },
        {
            "description": "Sets how the table names are stored and compared.",
            "displayName": "MySQL Lower Case Table Names",
            "name": "MYSQL_LOWER_CASE_TABLE_NAMES",
            "required": false
        },
        {
            "description": "The maximum permitted number of simultaneous client connections.",
            "displayName": "MySQL Maximum number of connections",
            "name": "MYSQL_MAX_CONNECTIONS",
            "required": false
        },
        {
            "description": "The minimum length of the word to be included in a FULLTEXT index.",
            "displayName": "MySQL FullText Minimum Word Length",
            "name": "MYSQL_FT_MIN_WORD_LEN",
            "required": false
        },
        {
            "description": "The maximum length of the word to be included in a FULLTEXT index.",
            "displayName": "MySQL FullText Maximum Word Length",
            "name": "MYSQL_FT_MAX_WORD_LEN",
            "required": false
        },
        {
            "description": "Controls the innodb_use_native_aio setting value if the native AIO is broken.",
            "displayName": "MySQL AIO",
            "name": "MYSQL_AIO",
            "required": false
        },
        {
            "description": "Database user name",
            "displayName": "Database Username",
            "from": "user[a-zA-Z0-9]{3}",
            "generate": "expression",
            "name": "DB_USERNAME",
            "required": true
        },
        {
            "description": "Database user password",
            "displayName": "Database Password",
            "from": "[a-zA-Z0-9]{32}",
            "generate": "expression",
            "name": "DB_PASSWORD",
            "required": true
        },
        {
            "description": "Size of persistent storage for database volume.",
            "displayName": "Database Volume Capacity",
            "name": "VOLUME_CAPACITY",
            "required": true,
            "value": "1Gi"
        },
        {
            "description": "Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you've installed the ImageStreams in a different namespace/project.",
            "displayName": "ImageStream Namespace",
            "name": "IMAGE_STREAM_NAMESPACE",
            "required": true,
            "value": "openshift"
        },
        {
            "description": "RH-SSO Server administrator username",
            "displayName": "RH-SSO Administrator Username",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "name": "SSO_ADMIN_USERNAME",
            "required": true
        },
        {
            "description": "RH-SSO Server administrator password",
            "displayName": "RH_SSO Administrator Password",
            "from": "[a-zA-Z0-9]{32}",
            "generate": "expression",
            "name": "SSO_ADMIN_PASSWORD",
            "required": true
        },
        {
            "description": "Realm to be created in the RH-SSO server (e.g. demorealm).",
            "displayName": "RH-SSO Realm",
            "name": "SSO_REALM",
            "required": false,
            "value": ""
        },
        {
            "description": "The username used to access the RH-SSO service.  This is used by clients to create the appliction client(s) within the specified RH-SSO realm.",
            "displayName": "RH-SSO Service Username",
            "name": "SSO_SERVICE_USERNAME",
            "required": false,
            "value": ""
        },
        {
            "description": "The password for the RH-SSO service user.",
            "displayName": "RH-SSO Service Password",
            "name": "SSO_SERVICE_PASSWORD",
            "required": false,
            "value": ""
        },
        {
            "description": "The tag to use for the \"mysql\" image stream.  Typically, this aligns with the major.minor version of MySQL.",
            "displayName": "MySQL Image Stream Tag",
            "name": "MYSQL_IMAGE_STREAM_TAG",
            "required": true,
            "value": "5.7"
        },
        {
            "description": "Container memory limit.",
            "displayName": "Container Memory Limit",
            "name": "MEMORY_LIMIT",
            "required": false,
            "value": "1Gi"
        }
    ]
}