rhdm713-prod-immutable-kieserver-amq.adoc

rhdm713-prod-immutable-kieserver-amq

Application template for an immutable KIE Server in a production environment integrated with ActiveMQ for decision, for Red Hat Process Automation Manager 7.13 - Deprecated

Table of Contents

• Parameters
• Objects
  • Services
  • Routes
  • Build Configurations
  • Deployment Configurations
    • Triggers
    • Replicas
    • Pod Template
      • Service Accounts
      • Image
      • Readiness Probe
      • Liveness Probe
      • Exposed Ports
      • Image Environment Variables
      • Volumes
  • External Dependencies
    • Secrets

Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable name	Image Environment Variable	Description	Example value	Required
APPLICATION_NAME	—	The name for the application.	myapp	True
CREDENTIALS_SECRET	—	Secret containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values.	rhpam-credentials	True
IMAGE_STREAM_NAMESPACE	—	Namespace in which the ImageStreams for Red Hat Decision Manager images are installed. These ImageStreams are normally installed in the openshift namespace. You need to modify this parameter only if you installed the ImageStreams in a different namespace/project.	openshift	True
KIE_SERVER_IMAGE_STREAM_NAME	—	The name of the image stream to use for KIE Server. Default is "rhpam-kieserver-rhel8".	rhpam-kieserver-rhel8	True
IMAGE_STREAM_TAG	—	A named pointer to an image in an image stream. Default is "7.13.0".	7.13.0	True
KIE_MBEANS	KIE_MBEANS	KIE Server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)	enabled	False
DROOLS_SERVER_FILTER_CLASSES	DROOLS_SERVER_FILTER_CLASSES	KIE Server class filtering (Sets the org.drools.server.filter.classes system property)	true	False
KIE_SERVER_DECISIONS_ONLY	KIE_SERVER_DECISIONS_ONLY	KIE Server capabilities filtering to disable everything that it is not related to decisions (i.e jBPM and case management)	true	False
PROMETHEUS_SERVER_EXT_DISABLED	PROMETHEUS_SERVER_EXT_DISABLED	If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)	false	False
KIE_SERVER_HOSTNAME_HTTP	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>	—	False
KIE_SERVER_HOSTNAME_HTTPS	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>	—	False
KIE_SERVER_HTTPS_SECRET	—	The name of the secret containing the keystore file	kieserver-app-secret	True
KIE_SERVER_HTTPS_KEYSTORE	HTTPS_KEYSTORE	The name of the keystore file within the secret	keystore.jks	False
KIE_SERVER_HTTPS_NAME	HTTPS_NAME	The name associated with the server certificate	jboss	False
KIE_SERVER_HTTPS_PASSWORD	HTTPS_PASSWORD	The password for the keystore and certificate	mykeystorepass	False
KIE_SERVER_BYPASS_AUTH_USER	KIE_SERVER_BYPASS_AUTH_USER	Allows the KIE Server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property)	false	False
KIE_SERVER_CONTAINER_DEPLOYMENT	KIE_SERVER_CONTAINER_DEPLOYMENT	KIE Server Container deployment configuration with optional alias. Format: containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2	rhdm-kieserver-hellorules=org.openshift.quickstarts:rhpam-kieserver-decisions:1.6.0-SNAPSHOT	True
SOURCE_REPOSITORY_URL	—	Git source URI for application	https://github.com/jboss-container-images/rhpam-7-openshift-image.git	True
SOURCE_REPOSITORY_REF	—	Git branch/tag reference	main	False
CONTEXT_DIR	—	Path within Git project to build; empty for root project directory.	quickstarts/hello-rules/hellorules	False
GITHUB_WEBHOOK_SECRET	—	GitHub trigger secret	—	True
GENERIC_WEBHOOK_SECRET	—	Generic build trigger secret	—	True
MAVEN_MIRROR_URL	—	Maven mirror to use for S2I builds	—	False
MAVEN_REPO_ID	EXTERNAL_MAVEN_REPO_ID	The id to use for the maven repository, if set. Default is generated randomly.	my-repo-id	False
MAVEN_REPO_URL	EXTERNAL_MAVEN_REPO_URL	Fully qualified URL to a Maven repository.	—	False
MAVEN_REPO_USERNAME	EXTERNAL_MAVEN_REPO_USERNAME	User name for accessing the Maven repository, if required.	—	False
MAVEN_REPO_PASSWORD	EXTERNAL_MAVEN_REPO_PASSWORD	Password to access the Maven repository, if required.	—	False
DECISION_CENTRAL_SERVICE	WORKBENCH_SERVICE_NAME	The Service name for the optional Decision Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required.	myapp-rhdmcentr	False
ARTIFACT_DIR	—	List of directories from which archives will be copied into the deployment folder. If unspecified, all archives in /target will be copied.	—	False
KIE_SERVER_MEMORY_LIMIT	—	KIE Server Container memory limit.	2Gi	True
KIE_SERVER_MEMORY_REQUEST	—	KIE Server Container memory Request.	1536Mi	True
KIE_SERVER_CPU_LIMIT	—	KIE Server Container CPU limit.	1	True
KIE_SERVER_CPU_REQUEST	—	KIE Server Container CPU Request.	750m	True
KIE_SERVER_MGMT_DISABLED	KIE_SERVER_MGMT_DISABLED	Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped. Sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.	true	True
KIE_SERVER_JMS_QUEUE_REQUEST	KIE_SERVER_JMS_QUEUE_REQUEST	JNDI name of request queue for JMS. The default value is queue/KIE.SERVER.REQUEST	queue/KIE.SERVER.REQUEST	False
KIE_SERVER_JMS_QUEUE_RESPONSE	KIE_SERVER_JMS_QUEUE_RESPONSE	JNDI name of response queue for JMS. The default value is queue/KIE.SERVER.RESPONSE	queue/KIE.SERVER.RESPONSE	False
AMQ_USERNAME	AMQ_USERNAME	User name for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	—	False
AMQ_PASSWORD	AMQ_PASSWORD	Password for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	—	False
AMQ_ROLE	AMQ_ROLE	User role for standard broker user.	admin	True
AMQ_QUEUES	AMQ_QUEUES	Queue names, separated by commas. These queues will be automatically created when the broker starts. Also, they will be made accessible as JNDI resources in EAP. These are the default queues needed by KIE Server. If using custom Queues, use the same values here as in the KIE_SERVER_JMS_QUEUE_RESPONSE and KIE_SERVER_JMS_QUEUE_REQUEST parameters.	queue/KIE.SERVER.REQUEST,queue/KIE.SERVER.RESPONSE	False
AMQ_GLOBAL_MAX_SIZE	AMQ_GLOBAL_MAX_SIZE	Specifies the maximum amount of memory that message data can consume. If no value is specified, half of the system’s memory is allocated.	10 gb	False
AMQ_SECRET	—	The name of a secret containing AMQ SSL related files.	broker-app-secret	True
AMQ_TRUSTSTORE	AMQ_TRUSTSTORE	The name of the AMQ SSL Trust Store file.	broker.ts	False
AMQ_TRUSTSTORE_PASSWORD	AMQ_TRUSTSTORE_PASSWORD	The password for the AMQ Trust Store.	changeit	False
AMQ_KEYSTORE	AMQ_KEYSTORE	The name of the AMQ keystore file.	broker.ks	False
AMQ_KEYSTORE_PASSWORD	AMQ_KEYSTORE_PASSWORD	The password for the AMQ keystore and certificate.	changeit	False
AMQ_PROTOCOL	AMQ_PROTOCOL	Broker protocols to configure, separated by commas. Allowed values are: openwire, amqp, stomp and mqtt. Only openwire is supported by EAP.	openwire	False
AMQ_BROKER_IMAGESTREAM_NAME	—	AMQ Broker Image Stream Name	amq-broker:7.8	True
AMQ_IMAGE_STREAM_NAMESPACE	—	Namespace in which the ImageStreams for Red Hat AMQ images are installed. These ImageStreams are normally installed in the openshift namespace. You need to modify this parameter only if you installed the ImageStreams in a different namespace/project.	openshift	True
SSO_URL	SSO_URL	RH-SSO URL	https://rh-sso.example.com/auth	False
SSO_REALM	SSO_REALM	RH-SSO Realm name	—	False
KIE_SERVER_SSO_CLIENT	SSO_CLIENT	KIE Server RH-SSO Client name	—	False
KIE_SERVER_SSO_SECRET	SSO_SECRET	KIE Server RH-SSO Client Secret	252793ed-7118-4ca8-8dab-5622fa97d892	False
SSO_USERNAME	SSO_USERNAME	RH-SSO Realm admin user name used to create the Client if it doesn’t exist	—	False
SSO_PASSWORD	SSO_PASSWORD	RH-SSO Realm Admin Password used to create the Client	—	False
SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	RH-SSO Disable SSL Certificate Validation	false	False
SSO_PRINCIPAL_ATTRIBUTE	SSO_PRINCIPAL_ATTRIBUTE	RH-SSO Principal Attribute to use as user name.	preferred_username	False
AUTH_LDAP_URL	AUTH_LDAP_URL	LDAP endpoint to connect for authentication. For failover, set two or more LDAP endpoints separated by space.	ldap://myldap.example.com:389	False
AUTH_LDAP_LOGIN_MODULE	AUTH_LDAP_LOGIN_MODULE	LDAP login module flag, adds backward compatibility with the legacy security subsystem on Elytron. 'optional' is the only supported value, if set, it will create a distributed realm on Elytron configuration with LDAP and FileSystem realms with the user added using the KIE_ADMIN_USER.	optional	False
AUTH_LDAP_LOGIN_FAILOVER	AUTH_LDAP_LOGIN_FAILOVER	Enable failover, if LDAP Url is unreachable, it will fail over to the KieFsRealm.	true	False
AUTH_LDAP_BIND_DN	AUTH_LDAP_BIND_DN	Bind DN used for authentication	uid=admin,ou=users,ou=example,ou=com	False
AUTH_LDAP_BIND_CREDENTIAL	AUTH_LDAP_BIND_CREDENTIAL	LDAP Credentials used for authentication	Password	False
AUTH_LDAP_ALLOW_EMPTY_PASSWORDS	AUTH_LDAP_ALLOW_EMPTY_PASSWORDS	Does this realm support blank password direct verification? Blank password attempt will be rejected otherwise. Boolean flag, defaults to false.	true	False
AUTH_LDAP_BASE_CTX_DN	AUTH_LDAP_BASE_CTX_DN	LDAP Base DN of the top-level context to begin the user search.	ou=users,ou=example,ou=com	False
AUTH_LDAP_BASE_FILTER	AUTH_LDAP_BASE_FILTER	LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).	(uid={0})	False
AUTH_LDAP_RECURSIVE_SEARCH	AUTH_LDAP_RECURSIVE_SEARCH	Indicates if the user queries are recursive.	true	False
AUTH_LDAP_SEARCH_TIME_LIMIT	AUTH_LDAP_SEARCH_TIME_LIMIT	The timeout in milliseconds for user or role searches.	10000	False
AUTH_LDAP_ROLE_ATTRIBUTE_ID	AUTH_LDAP_ROLE_ATTRIBUTE_ID	Name of the attribute containing the user roles.	memberOf	False
AUTH_LDAP_ROLES_CTX_DN	AUTH_LDAP_ROLES_CTX_DN	The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.	ou=groups,ou=example,ou=com	False
AUTH_LDAP_ROLE_FILTER	AUTH_LDAP_ROLE_FILTER	A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).	(memberOf={1})	False
AUTH_LDAP_ROLE_RECURSION	AUTH_LDAP_ROLE_RECURSION	The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.	1	False
AUTH_LDAP_DEFAULT_ROLE	AUTH_LDAP_DEFAULT_ROLE	A role included for all authenticated users	user	False
AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES	AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES	Provide new identities for LDAP identity mapping, the pattern to be used with this env is 'attribute_name=attribute_value;another_attribute_name=value'	sn=BlankSurname;cn=BlankCommonName	False
AUTH_LDAP_REFERRAL_MODE	AUTH_LDAP_REFERRAL_MODE	If LDAP referrals should be followed. Corresponds to REFERRAL ('java.naming.referral') environment property. Allowed values: 'ignore', 'follow', 'throw'	—	False
AUTH_ROLE_MAPPER_ROLES_PROPERTIES	AUTH_ROLE_MAPPER_ROLES_PROPERTIES	When present, the RoleMapping will be configured to use the provided properties file or roles. This parameter defines the fully-qualified file path and name of a properties file or a set of roles with the following pattern 'role=role1;another-role=role2'. The format of every entry in the file is original_role=role1,role2,role3	role=role1,role3,role4;role7=role,admin	False
AUTH_LDAP_MAPPER_KEEP_MAPPED	AUTH_LDAP_MAPPER_KEEP_MAPPED	When set to 'true' the mapped roles will retain all roles, that have defined mappings. Defaults to false.	—	False
AUTH_LDAP_MAPPER_KEEP_NON_MAPPED	AUTH_LDAP_MAPPER_KEEP_NON_MAPPED	When set to 'true' the mapped roles will retain all roles, that have no defined mappings. Defaults to false.	—	False

Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

Service	Port	Name	Description
${APPLICATION_NAME}-kieserver	8080	http	All the KIE Server web server’s ports.
	8443	https
${APPLICATION_NAME}-amq-jolokia	8161	amq-jolokia-console	The broker’s console and Jolokia port.
${APPLICATION_NAME}-amq-amqp	5672	amq-amqp	The broker’s AMQP port.
${APPLICATION_NAME}-amq-amqp-ssl	5671	amq-amqp-ssl	The broker’s AMQP SSL port.
${APPLICATION_NAME}-amq-mqtt	1883	amq-mqtt	The broker’s MQTT port.
${APPLICATION_NAME}-amq-mqtt-ssl	8883	amq-mqtt-ssl	The broker’s MQTT SSL port.
${APPLICATION_NAME}-amq-stomp	61613	amq-stomp	The broker’s STOMP port.
${APPLICATION_NAME}-amq-stomp-ssl	61612	amq-stomp-ssl	The broker’s STOMP SSL port.
${APPLICATION_NAME}-amq-tcp	61616	amq-tcp	The broker’s OpenWire port.
${APPLICATION_NAME}-amq-tcp-ssl	61617	amq-tcp-ssl	The broker’s OpenWire (SSL) port.

Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

Service	Security	Hostname
insecure-${APPLICATION_NAME}-kieserver-http	none	${KIE_SERVER_HOSTNAME_HTTP}
${APPLICATION_NAME}-kieserver-https	TLS passthrough	${KIE_SERVER_HOSTNAME_HTTPS}
${APPLICATION_NAME}-amq-jolokia-console	TLS passthrough	<default>
${APPLICATION_NAME}-amq-tcp-ssl	TLS passthrough	<default>

Build Configurations

A buildConfig describes a single build definition and a set of triggers for when a new build should be created. A buildConfig is a REST object, which can be used in a POST to the API server to create a new instance. Refer to the Openshift documentation for more information.

S2I image	link	Build output	BuildTriggers and Settings
rhpam-kieserver-rhel8:7.13.0	rhpam-7/rhpam-kieserver-rhel8	${APPLICATION_NAME}-kieserver:latest	GitHub, Generic, ImageChange, ConfigChange

Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

Deployment	Triggers
${APPLICATION_NAME}-kieserver	ImageChange
${APPLICATION_NAME}-amq	ImageChange

Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

Deployment	Replicas
${APPLICATION_NAME}-kieserver	2
${APPLICATION_NAME}-amq	1

Pod Template

Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

Deployment	Service Account
${APPLICATION_NAME}-kieserver	${APPLICATION_NAME}-kieserver

Image

Deployment	Image
${APPLICATION_NAME}-kieserver	${APPLICATION_NAME}-kieserver
${APPLICATION_NAME}-amq	${AMQ_BROKER_IMAGESTREAM_NAME}

Readiness Probe

${APPLICATION_NAME}-kieserver

Http Get on http://localhost:8080/services/rest/server/readycheck

${APPLICATION_NAME}-amq

/bin/bash -c /opt/amq/bin/readinessProbe.sh

Liveness Probe

${APPLICATION_NAME}-kieserver

Http Get on http://localhost:8080/services/rest/server/healthcheck

Exposed Ports

Deployments	Name	Port	Protocol
${APPLICATION_NAME}-kieserver	jolokia	8778	TCP
	http	8080	TCP
	https	8443	TCP
${APPLICATION_NAME}-amq	console-jolokia	8161	TCP
	amq-amqp	5672	TCP
	amqp-ssl	5671	TCP
	amq-mqtt	1883	TCP
	mqtt-ssl	8883	TCP
	amq-stomp	61613	TCP
	stomp-ssl	61612	TCP
	amq-tcp	61616	TCP
	amq-tcp-ssl	61617	TCP

Image Environment Variables

Deployment	Variable name	Description	Example value
${APPLICATION_NAME}-kieserver	WORKBENCH_SERVICE_NAME	The Service name for the optional Decision Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required.	${DECISION_CENTRAL_SERVICE}
	KIE_ADMIN_USER	—	—
	KIE_ADMIN_PWD	—	—
	KIE_SERVER_MODE	—	DEVELOPMENT
	KIE_MBEANS	KIE Server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)	${KIE_MBEANS}
	DROOLS_SERVER_FILTER_CLASSES	KIE Server class filtering (Sets the org.drools.server.filter.classes system property)	${DROOLS_SERVER_FILTER_CLASSES}
	KIE_SERVER_DECISIONS_ONLY	KIE Server capabilities filtering to disable everything that it is not related to decisions (i.e jBPM and case management)	${KIE_SERVER_DECISIONS_ONLY}
	PROMETHEUS_SERVER_EXT_DISABLED	If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)	${PROMETHEUS_SERVER_EXT_DISABLED}
	KIE_SERVER_BYPASS_AUTH_USER	Allows the KIE Server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property)	${KIE_SERVER_BYPASS_AUTH_USER}
	KIE_SERVER_ID	—	—
	KIE_SERVER_ROUTE_NAME	—	${APPLICATION_NAME}-kieserver
	KIE_SERVER_CONTAINER_DEPLOYMENT	KIE Server Container deployment configuration with optional alias. Format: containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2	${KIE_SERVER_CONTAINER_DEPLOYMENT}
	MAVEN_REPOS	—	RHDMCENTR,EXTERNAL
	RHDMCENTR_MAVEN_REPO_SERVICE	The Service name for the optional Decision Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required.	${DECISION_CENTRAL_SERVICE}
	RHDMCENTR_MAVEN_REPO_PATH	—	/maven2/
	RHDMCENTR_MAVEN_REPO_USERNAME	—	—
	RHDMCENTR_MAVEN_REPO_PASSWORD	—	—
	EXTERNAL_MAVEN_REPO_ID	The id to use for the maven repository, if set. Default is generated randomly.	${MAVEN_REPO_ID}
	EXTERNAL_MAVEN_REPO_URL	Fully qualified URL to a Maven repository.	${MAVEN_REPO_URL}
	EXTERNAL_MAVEN_REPO_USERNAME	User name for accessing the Maven repository, if required.	${MAVEN_REPO_USERNAME}
	EXTERNAL_MAVEN_REPO_PASSWORD	Password to access the Maven repository, if required.	${MAVEN_REPO_PASSWORD}
	KIE_SERVER_JMS_QUEUE_REQUEST	JNDI name of request queue for JMS. The default value is queue/KIE.SERVER.REQUEST	${KIE_SERVER_JMS_QUEUE_REQUEST}
	KIE_SERVER_JMS_QUEUE_RESPONSE	JNDI name of response queue for JMS. The default value is queue/KIE.SERVER.RESPONSE	${KIE_SERVER_JMS_QUEUE_RESPONSE}
	MQ_SERVICE_PREFIX_MAPPING	—	${APPLICATION_NAME}-amq7=AMQ
	AMQ_USERNAME	User name for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	${AMQ_USERNAME}
	AMQ_PASSWORD	Password for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	${AMQ_PASSWORD}
	AMQ_PROTOCOL	Broker protocols to configure, separated by commas. Allowed values are: openwire, amqp, stomp and mqtt. Only openwire is supported by EAP.	tcp
	AMQ_QUEUES	Queue names, separated by commas. These queues will be automatically created when the broker starts. Also, they will be made accessible as JNDI resources in EAP. These are the default queues needed by KIE Server. If using custom Queues, use the same values here as in the KIE_SERVER_JMS_QUEUE_RESPONSE and KIE_SERVER_JMS_QUEUE_REQUEST parameters.	${AMQ_QUEUES}
	HTTPS_KEYSTORE_DIR	—	/etc/kieserver-secret-volume
	HTTPS_KEYSTORE	The name of the keystore file within the secret	${KIE_SERVER_HTTPS_KEYSTORE}
	HTTPS_NAME	The name associated with the server certificate	${KIE_SERVER_HTTPS_NAME}
	HTTPS_PASSWORD	The password for the keystore and certificate	${KIE_SERVER_HTTPS_PASSWORD}
	KIE_SERVER_MGMT_DISABLED	Disable management api and don’t allow KIE containers to be deployed/undeployed or started/stopped. Sets the property org.kie.server.mgmt.api.disabled to true and org.kie.server.startup.strategy to LocalContainersStartupStrategy.	${KIE_SERVER_MGMT_DISABLED}
	KIE_SERVER_STARTUP_STRATEGY	—	OpenShiftStartupStrategy
	JGROUPS_PING_PROTOCOL	—	kubernetes.KUBE_PING
	KUBERNETES_NAMESPACE	—	—
	KUBERNETES_LABELS	—	cluster=jgrp.k8s.${APPLICATION_NAME}.kiserver
	SSO_URL	RH-SSO URL	${SSO_URL}
	SSO_OPENIDCONNECT_DEPLOYMENTS	—	ROOT.war
	SSO_REALM	RH-SSO Realm name	${SSO_REALM}
	SSO_SECRET	KIE Server RH-SSO Client Secret	${KIE_SERVER_SSO_SECRET}
	SSO_CLIENT	KIE Server RH-SSO Client name	${KIE_SERVER_SSO_CLIENT}
	SSO_USERNAME	RH-SSO Realm admin user name used to create the Client if it doesn’t exist	${SSO_USERNAME}
	SSO_PASSWORD	RH-SSO Realm Admin Password used to create the Client	${SSO_PASSWORD}
	SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	RH-SSO Disable SSL Certificate Validation	${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}
	SSO_PRINCIPAL_ATTRIBUTE	RH-SSO Principal Attribute to use as user name.	${SSO_PRINCIPAL_ATTRIBUTE}
	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>	${KIE_SERVER_HOSTNAME_HTTP}
	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>	${KIE_SERVER_HOSTNAME_HTTPS}
	AUTH_LDAP_URL	LDAP endpoint to connect for authentication. For failover, set two or more LDAP endpoints separated by space.	${AUTH_LDAP_URL}
	AUTH_LDAP_LOGIN_MODULE	LDAP login module flag, adds backward compatibility with the legacy security subsystem on Elytron. 'optional' is the only supported value, if set, it will create a distributed realm on Elytron configuration with LDAP and FileSystem realms with the user added using the KIE_ADMIN_USER.	${AUTH_LDAP_LOGIN_MODULE}
	AUTH_LDAP_LOGIN_FAILOVER	Enable failover, if LDAP Url is unreachable, it will fail over to the KieFsRealm.	${AUTH_LDAP_LOGIN_FAILOVER}
	AUTH_LDAP_BIND_DN	Bind DN used for authentication	${AUTH_LDAP_BIND_DN}
	AUTH_LDAP_BIND_CREDENTIAL	LDAP Credentials used for authentication	${AUTH_LDAP_BIND_CREDENTIAL}
	AUTH_LDAP_ALLOW_EMPTY_PASSWORDS	Does this realm support blank password direct verification? Blank password attempt will be rejected otherwise. Boolean flag, defaults to false.	${AUTH_LDAP_ALLOW_EMPTY_PASSWORDS}
	AUTH_LDAP_BASE_CTX_DN	LDAP Base DN of the top-level context to begin the user search.	${AUTH_LDAP_BASE_CTX_DN}
	AUTH_LDAP_BASE_FILTER	LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).	${AUTH_LDAP_BASE_FILTER}
	AUTH_LDAP_RECURSIVE_SEARCH	Indicates if the user queries are recursive.	${AUTH_LDAP_RECURSIVE_SEARCH}
	AUTH_LDAP_SEARCH_TIME_LIMIT	The timeout in milliseconds for user or role searches.	${AUTH_LDAP_SEARCH_TIME_LIMIT}
	AUTH_LDAP_ROLE_ATTRIBUTE_ID	Name of the attribute containing the user roles.	${AUTH_LDAP_ROLE_ATTRIBUTE_ID}
	AUTH_LDAP_ROLES_CTX_DN	The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.	${AUTH_LDAP_ROLES_CTX_DN}
	AUTH_LDAP_ROLE_FILTER	A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).	${AUTH_LDAP_ROLE_FILTER}
	AUTH_LDAP_ROLE_RECURSION	The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.	${AUTH_LDAP_ROLE_RECURSION}
	AUTH_LDAP_DEFAULT_ROLE	A role included for all authenticated users	${AUTH_LDAP_DEFAULT_ROLE}
	AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES	Provide new identities for LDAP identity mapping, the pattern to be used with this env is 'attribute_name=attribute_value;another_attribute_name=value'	${AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES}
AUTH_LDAP_REFERRAL_MODE	If LDAP referrals should be followed. Corresponds to REFERRAL ('java.naming.referral') environment property. Allowed values: 'ignore', 'follow', 'throw'	${AUTH_LDAP_REFERRAL_MODE}
AUTH_ROLE_MAPPER_ROLES_PROPERTIES	When present, the RoleMapping will be configured to use the provided properties file or roles. This parameter defines the fully-qualified file path and name of a properties file or a set of roles with the following pattern 'role=role1;another-role=role2'. The format of every entry in the file is original_role=role1,role2,role3	${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}
AUTH_LDAP_MAPPER_KEEP_MAPPED	When set to 'true' the mapped roles will retain all roles, that have defined mappings. Defaults to false.	${AUTH_LDAP_MAPPER_KEEP_MAPPED}
AUTH_LDAP_MAPPER_KEEP_NON_MAPPED	When set to 'true' the mapped roles will retain all roles, that have no defined mappings. Defaults to false.	${AUTH_LDAP_MAPPER_KEEP_NON_MAPPED}
${APPLICATION_NAME}-amq	AMQ_USER	User name for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	${AMQ_USERNAME}
	AMQ_PASSWORD	Password for standard broker user. It is required for connecting to the broker. If left empty, it will be generated.	${AMQ_PASSWORD}
	AMQ_ROLE	User role for standard broker user.	${AMQ_ROLE}
	AMQ_NAME	—	${APPLICATION_NAME}-broker
	AMQ_TRANSPORTS	Broker protocols to configure, separated by commas. Allowed values are: openwire, amqp, stomp and mqtt. Only openwire is supported by EAP.	${AMQ_PROTOCOL}
	AMQ_QUEUES	Queue names, separated by commas. These queues will be automatically created when the broker starts. Also, they will be made accessible as JNDI resources in EAP. These are the default queues needed by KIE Server. If using custom Queues, use the same values here as in the KIE_SERVER_JMS_QUEUE_RESPONSE and KIE_SERVER_JMS_QUEUE_REQUEST parameters.	${AMQ_QUEUES}
	AMQ_GLOBAL_MAX_SIZE	Specifies the maximum amount of memory that message data can consume. If no value is specified, half of the system’s memory is allocated.	${AMQ_GLOBAL_MAX_SIZE}
	AMQ_REQUIRE_LOGIN	—	true
	AMQ_ANYCAST_PREFIX	—	—
	AMQ_MULTICAST_PREFIX	—	—
	AMQ_KEYSTORE_TRUSTSTORE_DIR	—	/etc/amq-secret-volume
	AMQ_TRUSTSTORE	The name of the AMQ SSL Trust Store file.	${AMQ_TRUSTSTORE}
	AMQ_TRUSTSTORE_PASSWORD	The password for the AMQ Trust Store.	${AMQ_TRUSTSTORE_PASSWORD}
	AMQ_KEYSTORE	The name of the AMQ keystore file.	${AMQ_KEYSTORE}
	AMQ_KEYSTORE_PASSWORD	The password for the AMQ keystore and certificate.	${AMQ_KEYSTORE_PASSWORD}

Volumes

Deployment	Name	mountPath	Purpose	readOnly
${APPLICATION_NAME}-kieserver	kieserver-keystore-volume	/etc/kieserver-secret-volume	ssl certs	True
${APPLICATION_NAME}-amq	broker-secret-volume	/etc/amq-secret-volume	ssl certs	True

External Dependencies

Secrets

This template requires the following secrets to be installed for the application to run.

• kieserver-app-secret

• broker-app-secret