Chapter 3. Environment with immutable servers

Procedure

1. Use the following command to extract the source code:

   git clone ssh://adminUser@decision-central-host:8001/MySpace/MyProject

   Copy to Clipboard

   Replace:

   • adminUser with the administrative user for Decision Central
   • decision-central-host with the host on which Decision Central is running
   • MySpace with the name of the Decision Central space in which the project is located
   • MyProject with the name of the project
2. Upload the source code to another Git repository for the S2I build.

Procedure

1. Use one of the following methods to deploy the template:

   • In the OpenShift Web UI, select Add to Project Import YAML / JSON and then select or paste the rhdm71-prod-immutable-kieserver.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/rhdm71-prod-immutable-kieserver.yaml -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret

     Copy to Clipboard

     In this command line:

     • Replace <template-path> with the path to the downloaded template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters. You can view the template file to see descriptions for all parameters.

2. Set the following parameters as necessary:

   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for Decision Server, as created in Section 2.2, “Creating the secrets for Decision Server”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URL for Decision Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts. You can deploy several applications using the same template into the same project, as long as you use different application names. Also, the application name determines the name of the server configuration (server template) on the Decision Central that the Decision Server is to join.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 2.2, “Creating the secrets for Decision Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 2.2, “Creating the secrets for Decision Server”.
   • KIE Server Container Deployment (KIE_SERVER_CONTAINER_DEPLOYMENT): The identifying information of the decision service (KJAR file) that is built from your source. The format is: <containerId>=<groupId>:<artifactId>:<version>. You can provide two or more KJAR files using the | separator, for example: containerId=groupId:artifactId:version|c2=g2:a2:v2. The Maven build process must produce all these files from the source in the Git repository.
   • Git Repository URL (SOURCE_REPOSITORY_URL): The URL for the Git repository that contains the source for your decision service.
   • Git Reference (SOURCE_REPOSITORY_REF): The branch in the Git repository
   • Context Directory (CONTEXT_DIR): The path to the source within the project downloaded from the Git repository
   • Artifact Directory (ARTIFACT_DIR): The path within the project that contains the required binary files (KJAR files and any other necessary files) after a successful Maven build. Normally this directory is the target directory of the build. However, you can provide prebuilt binaries in this directory in the Git repository
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 2.1, “Ensuring the availability of image streams”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

3. If your build includes dependencies that are not available on the public Maven tree and require a separate repository, set the parameters to provide this repository:

   • Maven repository URL (MAVEN_REPO_URL): The URL for the Maven repository.
   • Maven repository username (MAVEN_REPO_USERNAME): The username for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The username for the Maven repository.

4. If you want to use RH-SSO or LDAP authentication, complete the following additional configuration:

   1. In the RH-SSO or LDAP service, create all user names in the deployment parameters. If you do not set any of the parameters, create users with the default user names. The created users must also be assigned to roles:

      • KIE_ADMIN_USER: default user name adminUser, roles: kie-server,rest-all,admin,kiemgmt,Administrators
      • KIE_SERVER_USER: default user name executionUser, roles kie-server,rest-all,guest

   2. If you want to configure Red Hat Single Sign On (RH-SSO) authentication, an RH-SSO realm that applies to Red Hat Decision Manager must exist. A client within RH-SSO must also exist for

      For the user roles that you can configure in RH-SSO, see Roles and users.

      Use one of the following procedures:

      1. If the client for Red Hat Decision Manager within RH-SSO already exists, set the following parameters in the template:

         • RH-SSO URL (SSO_URL): The URL for RH-SSO.
         • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Decision Manager.
         • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The RH-SSO client name for Decision Server.
         • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string that is set in RH-SSO for the client for Decision Server.
         • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

      2. To create the client for Red Hat Decision Manager within RH-SSO, set the following parameters in the template:

         • RH-SSO URL (SSO_URL): The URL for RH-SSO.
         • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Decision Manager.
         • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The name of the client to create in RH-SSO for Decision Server.
         • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string to set in RH-SSO for the client for Decision Server.
         • KIE Server Custom http Route Hostname (KIE_SERVER_HOSTNAME_HTTP): The fully qualified host name to use for the HTTP endpoint for Decision Server. If you need to create a client in RH-SSO, you can not leave this parameter blank.
         • KIE Server Custom https Route Hostname (KIE_SERVER_HOSTNAME_HTTPS): The fully qualified host name to use for the HTTPS endpoint for Decision Server. If you need to create a client in RH-SSO, you can not leave this parameter blank.
         • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Decision Manager.
         • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

   3. To configure LDAP, set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdatExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended Login Module.

      Do not configure LDAP authentication and RH-SSO authentication in the same deployment.

5. Complete the creation of the environment, depending on the method that you are using:

   • In the OpenShift Web UI, click Create.

     • If the This will create resources that may have security or project behavior implications message appears, click Create Anyway.
   • Complete and run the command line.