Chapter 3. Deployment and management of a Red Hat Decision Manager environment using OpenShift operators
To deploy a Red Hat Decision Manager environment, the OpenShift operator uses a YAML source that describes the environment. Red Hat Decision Manager provides an installer that you can use to form the YAML source and deploy the environment.
When the Business Automation operator deploys the environment, it creates a YAML description of the environment, and then ensures that the environment is consistent with the description at all times. You can edit the description to modify the environment.
You can remove the environment by deleting the operator application in Red Hat OpenShift Container Platform.
When you remove an environment with a high-availability Business Central, the operator does not delete Persistent Volume Claims that were created as part of the JBoss Datagrid and JBoss AMQ StatefulSet creation. This behaviour is a part of Kubernetes design, as deletion of the Persistent Volume Claims could cause data loss. For more information about handling persistent volumes during deletion of a StatefulSet, see the Kubernetes documentation.
If you create a new environment using the same namespace and the same application name, the environment reuses the persistent volumes for increased performance.
To ensure that new deployments do not use any old data, you can delete the Persistent Volume Claims manually.
3.1. Subscribing to the Business Automation operator
To be able to deploy Red Hat Decision Manager using operators, you must subscribe to the Business Automation operator in OpenShift.
Procedure
- Enter your project in the OpenShift Web cluster console.
-
In the OpenShift Web console navigation panel, select Catalog
OperatorHub or Operators OperatorHub. - Search for Business Automation, select it and click Install.
On the Create Operator Subscription page, select your target namespace and approval strategy.
Optional: Set Approval strategy to
Automatic
to enable automatic operator updates. An operator update does not immediately update the product, but is required before you update the product. Configure automatic or manual product updates using the settings in every particular product deployment.- Click Subscribe to create a subscription.
3.2. Deploying a Red Hat Decision Manager environment using the operator
After you subscribe to the Business Automation operator, you can use the installer wizard to configure and deploy a Red Hat Decision Manager environment.
In Red Hat Decision Manager 7.13, the operator installer wizard is for Technology Preview only. For more information on Red Hat Technology Preview features, see Technology Preview Features Support Scope.
3.2.1. Starting the deployment of a Red Hat Decision Manager environment using the Business Automation operator
To start deploying a Red Hat Decision Manager environment using the Business Automation operator, access the installer wizard. The installer wizard is deployed when you subscribe to the operator.
Prerequisites
- You subscribed to the Business Automation operator. For instructions about subscribing to the operator, see Section 3.1, “Subscribing to the Business Automation operator”.
Procedure
-
In the Red Hat OpenShift Container Platform web cluster console menu, select Catalog
Installed operators or Operators Installed operators. -
Click the name of the operator that contains
businessautomation
. Information about this operator is displayed. - Click the Installer link located on the right side of the window.
- If prompted, log in with your OpenShift credentials.
Result
The Installation tab of the wizard is displayed.
3.2.2. Setting the basic configuration of the environment
After you start to deploy a Red Hat Decision Manager environment using the Business Automation operator, you must select the type of the environment and set other basic configuration.
Prerequisites
- You started to deploy a Red Hat Decision Manager environment using the Business Automation operator and accessed the installer wizard according to the instructions in Section 3.2.1, “Starting the deployment of a Red Hat Decision Manager environment using the Business Automation operator”.
Procedure
- In the Application Name field, enter a name for the OpenShift application. This name is used in the default URLs for all components.
In the Environment list, select the type of environment. This type determines the default configuration; you can modify this configuration as necessary. The following types are available for Red Hat Decision Manager:
-
rhdm-trial
: A trial environment that you can set up quickly and use to evaluate or demonstrate developing and running assets. Includes Business Central and a KIE Server. This environment does not use any persistent storage, and any work you do in the environment is not saved. -
rhdm-authoring
: An environment for creating and modifying services using Business Central. It consists of pods that provide Business Central for the authoring work and a KIE Server for test execution of the services. You can also use this environment to run services for staging and production purposes. You can add KIE Servers to the environment and they are managed by the same Business Central. rhdm-authoring-ha
: An environment for creating and modifying services using Business Central. It consists of pods that provide Business Central for the authoring work and a KIE Server for test execution of the services. This version of the authoring environment supports scaling the Business Central pod to ensure high availability.ImportantIn Red Hat Decision Manager 7.13, high-availability Business Central functionality is for Technology Preview only. For more information about Red Hat Technology Preview features, see Technology Preview Features Support Scope.
rhpam-production-immutable
: An alternate environment for running existing services for staging and production purposes. You can configure one or more KIE Server pods that build services from source or pull them from a Maven repository. You can then replicate each pod as necessary.You cannot remove any service from the pod or add any new service to the pod. If you want to use another version of a service or to modify the configuration in any other way, deploy a new server image to replace the old one. You can use any container-based integration workflows to manage the pods.
When configuring this environment, in the KIE Servers tab you must customize KIE Server and either click the Set immutable server configuration button or set the
KIE_SERVER_CONTAINER_DEPLOYMENT
environment variable. For instructions about configuring KIE Server, see Section 3.2.5, “Setting custom KIE Server configuration of the environment”.
-
If you want to enable automatic upgrades to new versions, select the Enable Upgrades box. If this box is selected, when a new patch version of Red Hat Decision Manager 7.13 becomes available, the operator automatically upgrades your deployment to this version. All services are preserved and normally remain available throughout the upgrade process.
If you also want to enable the same automatic upgrade process when a new minor version of Red Hat Decision Manager 7.x becomes available, select the Include minor version upgrades box.
NoteDisable automatic updates if you want to use a custom image for any component of Red Hat Decision Manager.
- If you want to use image tags for downloading images, select the Use Image Tags box. This setting is useful if you use a custom registry or if you are directed by Red Hat support.
If you want to disable SSL connections to your deployment, select the Disable SSL Routes box. In this case, all routes that are externally exposed use clear-text (HTTP) connections.
NoteIf this box is not selected, only secure (HTTPS) routes are exposed externally.
If you want to use a custom image registry, under Custom registry, enter the URL of the registry in the Image registry field. If this registry does not have a properly signed and recognized SSL certificate, select the Insecure box.
For instructions about configuring the image registry to use specific images, see Section 3.2.2.1, “Configuring the image registry to use specific images”.
Under Admin user, enter the user name and password for the administrative user for Red Hat Decision Manager in the Username and Password fields.
ImportantIf you use RH-SSO or LDAP authentication, the same user must be configured in your authentication system with the
kie-server,rest-all,admin
roles for Red Hat Decision Manager.Optional: Select the startup strategy. The
OpenShiftStartupStrategy
setting is enabled by default.In some authoring environments, you might need to ensure that several users can deploy services on the same KIE Server at the same time. By default, after deploying a service onto a KIE Server using Business Central, the user must wait a few seconds before more services can be deployed. The
OpenShiftStartupStrategy
setting is enabled by default and causes this limitation. To remove the limitation, select theControllerBasedStartupStrategy
setting from the Startup Strategy list.NoteDo not enable the controller-based startup strategy in an environment with a high-availability Business Central.
- Optional: If you want to use the OpenShift CA bundle as the trust store for HTTPS communication, select the Use OpenShift CA Bundle box.
Optional: If you want to use a secret that contains the credentials for the Admin user, complete the following tasks:
-
From the Admin user configuration list, select
Secret configuration
. -
Under OpenShift admin credentials secret, in the Secret field, enter the name of the secret. If the Secret field is left blank, the default secret from
kie-admin-credentials
is used. -
Under OpenShift admin credentials secret, in the Username field, enter the username for the admin user to use in the secret. If the Username field is left blank, the default username from
kie-admin-credentials
is used. Under OpenShift admin credentials secret, in the Password field, enter the password for the admin user to use in the secret. If the Password field is left blank, the default password from
kie-admin-credentials
is used.NoteIf
kie-admin-credentials
is missing,kie-admin-credentials
is generated with a default username and password.
-
From the Admin user configuration list, select
Next steps
If you want to deploy the environment with the default configuration, click Finish and then click Deploy to deploy the environment. Otherwise, continue to set other configuration parameters.
3.2.2.1. Configuring the image registry to use specific images
During the basic configuration of the environment you can configure the custom registry to use specific images. For more information about configuring the basic environment, see Section 3.2.2, “Setting the basic configuration of the environment”.
Prerequisites
- You started to configure a Red Hat Decision Manager environment using the Business Automation operator and accessed the installer wizard according to the instructions in Section 3.2.2, “Setting the basic configuration of the environment”.
- You have set the URL of the image registry in the Image registry field under the Custom registry of the Red Hat Decision Manager environment configuration according to the instructions in Section 3.2.2, “Setting the basic configuration of the environment”.
Procedure
During the Red Hat Decision Manager environment configuration, to use a specific image from the custom registry, complete one of the following steps:
If you want to specify the image using the installer wizard, set the image context, image name, and image tag parameters in the Console and KIE Server tabs:
Table 3.1. Parameters Name Description Image context
The context of the image in the registry.
Image
The name of the image.
Image tag
The tag of the image. If you do not set this field, the installation uses the latest tag.
If you want to specify the image by using a KieApp CR YAML file, add the image registry and image details to the file, for example:
Example
apiVersion: app.kiegroup.org/v2 kind: KieApp spec: ... useImageTags: true imageRegistry: registry: registry.example.com:5000 ... objects: ... servers: - id: ... ... image: YOUR_IMAGE_NAME imageContext: YOUR_IMAGE_CONTEXT imageTag: YOUR_IMAGE_TAG ...
If an ImageStream with the configured name exists in the namespace that you are using or in the Red Hat OpenShift Container Platform namespace, the operator uses this ImageStream and does not create a new ImageStream.
To configure an ImageStream to update automatically, the ImageStream property scheduledImportPolicy
must be set to true
in the KieApp CR YAML file. For example:
Example of scheduledImportPolicy
apiVersion: app.kiegroup.org/v2 kind: KieApp spec: ... useImageTags: true scheduledImportPolicy: true imageRegistry: registry: registry.example.com:5000 ... objects: ... servers: - id: ... ... image: YOUR_IMAGE_NAME imageContext: YOUR_IMAGE_CONTEXT imageTag: YOUR_IMAGE_TAG ...
3.2.3. Setting the security configuration of the environment
After you set the basic configuration of a Red Hat Decision Manager environment using the Business Automation operator, you can optionally configure authentication (security) settings for the environment.
Prerequisites
- You completed basic configuration of a Red Hat Decision Manager environment using the Business Automation operator in the installer wizard according to the instructions in Section 3.2.2, “Setting the basic configuration of the environment”.
-
If you want to use RH-SSO or LDAP for authentication, you created users with the correct roles in your authentication system. You must create at least one administrative user (for example,
adminUser
) with thekie-server,rest-all,admin
roles. This user must have the user name and password that you configured on the Installation tab. - If you want to use RH-SSO authentication, you created the clients in your RH-SSO system for all components of your environment, specifying the correct URLs. This action ensures maximum control. Alternatively, the deployment can create the clients.
Procedure
- If the Installation tab is open, click Next to view the Security tab.
In the Authentication mode list, select one of the following modes:
-
Internal
: You configure the initial administration user when deploying the environment. You can create a post-configuration script to add users in the Elytron security subsystem. For instructions about creating a post-configuration script, see Section 3.4, “Providing Elytron user configuration or other post-configuration settings”. -
RH-SSO
: Red Hat Decision Manager uses Red Hat Single Sign-On for authentication. -
LDAP
: Red Hat Decision Manager uses LDAP for authentication
-
Complete the security configuration based on the Authentication mode that you selected:
If you selected
RH-SSO
, configure RH-SSO authentication:- In the RH-SSO URL field, enter the RH-SSO URL.
- In the Realm field, enter the RH-SSO realm name.
- If you did not create RH-SSO clients for components of your environment enter the credentials of an administrative user for your RH-SSO system in the SSO admin user and SSO admin password fields.
- If your RH-SSO system does not have a proper signed SSL certificate, select the Disable SSL cert validation box.
- If you want to change the RH-SSO principal attribute used for the user name, in the Principal attribute field enter the name of the new attribute.
If you selected
LDAP
, configure LDAP authentication:ImportantThe
baseFilter
field is a legacy LDAP search filter used to locate the context of the user to authenticate. The inputusername
oruserDN
obtained from the login module callback is substituted into the filter anywhere a{0}
expression is used. A common example for the search filter is(uid={0})
. For Elytron based subsystems, this property should be configured only with the search filter parameter, without any search expression. For example, search foruid
instead of(uid={0})
.- In the LDAP URL field, enter the LDAP URL.
Set LDAP parameters. These parameters configure LDAP authentication using the Elytron subsystem of Red Hat JBoss EAP. For more information about using the Elytron subsystem of Red Hat JBoss EAP with LDAP, see Configure Authentication with an LDAP-Based Identity Store.
NoteIf you want to enable LDAP failover, you can set two or more LDAP server addresses in the
AUTH_LDAP_URL
parameter, separated by a space.
If you selected
RH-SSO
orLDAP
, if your RH-SSO or LDAP system does not define all the roles required for your deployment, you can map authentication system roles to Red Hat Decision Manager roles.To enable role mapping, you must provide role mapping either as a single configuration string or as a role mapping configuration file. If you use a file for role mapping configuration, you must provide the file in an OpenShift configuration map or secret object in the project namespace.
The string must use the
role=role1,role2;another-role=role2
pattern, for exampleadmins=kie-server,rest-all,admin;developers=kie-server,rest-all
.The file must contain entries in the following format:
ldap_role=product_role1, product_role2...
For example:
admins=kie-server,rest-all,admin
To enable the use of this string or file, make the following changes:
-
Under RoleMapper, in the Roles properties file field, enter the role configuration string or the fully qualified path name of the role mapping configuration file, for example
/opt/eap/standalone/configuration/rolemapping/rolemapping.properties
. - Optional: Select the Roles keep mapped box or the Roles keep non mapped box. If you define role mapping, by default only the roles that you define in the mapping are available. If you want to keep the original roles that are defined in the authentication system and that your mapping maps to other roles, select the Roles keep mapped box. If you want to keep the original roles that are defined in the authentication system and not mentioned in your mapping,select the Roles keep non mapped box.
If you are using a role configuration file, configure the fields under RoleMapper Configuration object:
-
Under the Kind label, select the kind of the object that provides the file (
ConfigMap
orSecret
). - In the Name field, enter the name of the object. This object is automatically mounted on Business Central and KIE Server pods in the path that you specified for the role mapping configuration file.
-
Under the Kind label, select the kind of the object that provides the file (
-
Under RoleMapper, in the Roles properties file field, enter the role configuration string or the fully qualified path name of the role mapping configuration file, for example
Configure other passwords, if necessary:
- AMQ password and AMQ cluster password are passwords for interaction with ActiveMQ using the JMS API.
- Keystore password is the password for the keystore files used in secrets for HTTPS communication. Set this password if you created secrets according to instructions in Section 2.2, “Creating the secrets for KIE Server” or Section 2.3, “Creating the secrets for Business Central”.
- Database password is the password for database server pods that are a part of the environments.
Next steps
If you want to deploy the environment with the default configuration of all components, click Finish and then click Deploy to deploy the environment. Otherwise, continue to set configuration parameters for Business Central and KIE Servers.
3.2.4. Setting the Business Central configuration of the environment
After you set the basic and security configuration of a Red Hat Decision Manager environment using the Business Automation operator, you can optionally configure settings for the Business Central component of the environment.
All environment types except rhpam-production-immutable
include this component.
Do not change these settings for the rhpam-production-immutable
environment, as this environment does not include Business Central or Business Central Monitoring.
Prerequisites
- You completed basic configuration of a Red Hat Decision Manager environment using the Business Automation operator in the installer wizard according to the instructions in Section 3.2.2, “Setting the basic configuration of the environment”.
- If you want to use RH-SSO or LDAP for authentication, you completed security configuration according to the instructions in Section 3.2.3, “Setting the security configuration of the environment”.
Procedure
- If the Installation or Security tab is open, click Next until you view the Console tab.
- If you created the secret for Business Central according to the instructions in Section 2.3, “Creating the secrets for Business Central”, enter the name of the secret in the Keystore secret field.
Optional: If you want to use a custom image for the Business Central deployment, complete the following additional steps:
- Set the custom registry in the Installation tab. If you do not set the custom registry, the installation uses the default Red Hat registry. For more information about setting the custom registry value, see Section 3.2.2, “Setting the basic configuration of the environment”.
In the Console tab, set the following fields:
- Image context: The context of the image in the registry.
- Image: The name of the image.
Image tag: The tag of the image. If you do not set this field, the installation uses the
latest
tag.For example, if the full address of the image is
registry.example.com/mycontext/mycentral:1.0-SNAPSHOT
, set the custom registry toregistry.example.com
, the Image context field tomycontext
, the Image field tomycentral
, and the Image tag field to1.0-SNAPSHOT
.
Optional: To set a custom hostname for the external route, enter a domain in the Custom hostname to be used on the Business Central external Route field, formatted as in the following example:
`businesscentral.example.com`
NoteThe custom hostname must be valid and resolvable.
To change the custom hostname, you can modify the
routeHostname
property.Optional: To enable and set the Edge termination route, complete the following steps:
- Under Change route termination, select Enable Edge termination.
- Optional: In the Key field, enter the private key.
- Optional: In the Certificate field, enter the certificate.
- Optional: In the CaCertificate field, enter the CaCertificate.
Optional: Configure Git hooks.
In an authoring environment, you can use Git hooks to facilitate interaction between the internal Git repository of Business Central and an external Git repository. If you want to use Git hooks, you must prepare a Git hooks directory in an OpenShift configuration map, secret, or persistent volume claim object in the project namespace. You can also prepare a secret with the SSH key and known hosts files for Git SSH authentication. For instructions about preparing Git hooks, see Section 2.5, “Preparing Git hooks”.
To use a Git hooks directory, make the following changes:
-
Under GitHooks, in the Mount path field, enter a fully qualified path for the directory, for example,
/opt/kie/data/git/hooks
. -
In the fields under GitHooks Configuration object, select the Kind of the object that provides the file (
ConfigMap
,Secret
, orPersistentVolumeClaim
) and enter the Name of the object. This object is automatically mounted on the Business Central pods in the path that you specified for the Git hooks directory.
-
Under GitHooks, in the Mount path field, enter a fully qualified path for the directory, for example,
- Optional: In the SSH secret field enter the name of the secret with the SSH key and known hosts files.
- Optional: To configure KIE Server for decision management only capabilities so that jBPM and case management features are disabled, select Execute Kie Server only with Decisions capabilities.
-
Optional: Enter the number of replicas for Business Central or Business Central monitoring in the Replicas field. Do not change this number in a
rhpam-authoring
environment. -
Optional: To set the Business Central persistent volume size
pvSize
, on the Console component page, enter the desired size in the Persistent Volume Size field. The default size is 1Gi for Business Central and 64Mb for Business Central Monitoring. - Optional: Enter requested and maximum CPU and memory limits in the fields under Resource quotas.
- If you want to customize the configuration of the Java virtual machine on the Business Central pods, select the Enable JVM configuration box and then enter information in any of the fields under Enable JVM configuration. All fields are optional. For the JVM parameters that you can configure, see Section 3.5, “JVM configuration parameters”.
If you selected RH-SSO authentication, configure RH-SSO for Business Central:
- Enter the client name in the Client name field and the client secret in the Client secret field. If a client with this name does not exist, the deployment attempts to create a new client with this name and secret.
- If the deployment is to create a new client, enter the HTTP and HTTPS URLs that will be used for accessing Business Central into the SSO HTTP URL and SSO HTTPS URL fields. This information is recorded in the client.
-
Optional: If you are configuring a high-availability environment, set the user name and password for the DataGrid component in the DataGrid username and DataGrid password fields. By default, the user name is
infinispan
and the password is generated automatically. Optional: Depending on your needs, set environment variables. To set an environment variable, click Add new Environment variable, then enter the name and value for the variable in the Name and Value fields.
Optional: If you want to configure the proxy settings, use the following environment variables:
-
https_proxy
: The location of the https proxy. This takes precedence overHTTPS_PROXY
,http_proxy
, andHTTP_PROXY
, and is used for both Maven builds and Java runtime. For example:myuser:mypass@127.0.0.1:8080
. -
HTTPS_PROXY
: The location of the https proxy. This takes precedence overhttp_proxy
andHTTP_PROXY
, and is used for both Maven builds and Java runtime. For example:myuser@127.0.0.1:8080
. -
http_proxy
: The location of the http proxy. This takes precedence overHTTP_PROXY
and is used for both Maven builds and Java runtime. For example:http://127.0.0.1:8080
. -
HTTP_PROXY
: The location of the http proxy. This is used for both Maven builds and Java runtime. For example:127.0.0.1:8080
. -
no_proxy
: A comma separated lists of hosts, IP addresses, or domains that can be accessed directly. This takes precedence overNO_PROXY
and is used for both Maven builds and Java runtime. For example:*.example.com
. -
NO_PROXY
: A comma separated lists of hosts, IP addresses, or domains that can be accessed directly. This is used for both Maven builds and Java runtime. For example:foo.example.com,bar.example.com
.
-
If you want to use an external Maven repository, set the following variables:
-
MAVEN_REPO_URL
: The URL for the Maven repository -
MAVEN_REPO_ID
: An identifier for the Maven repository, for example,repo-custom
-
MAVEN_REPO_USERNAME
: The user name for the Maven repository MAVEN_REPO_PASSWORD
The password for the Maven repositoryImportantIn an authoring environment, if you want Business Central to push a project into an external Maven repository, you must configure this repository during deployment and also configure exporting to the repository in every project. For information about exporting Business Central projects to an external Maven repository, see Packaging and deploying an Red Hat Decision Manager project.
-
If your OpenShift environment does not have a connection to the public Internet, configure access to a Maven mirror that you set up according to Section 2.9, “Preparing a Maven mirror repository for offline use”. Set the following variables:
-
MAVEN_MIRROR_URL
: The URL for the Maven mirror repository that you set up in Section 2.9, “Preparing a Maven mirror repository for offline use”. This URL must be accessible from a pod in your OpenShift environment. MAVEN_MIRROR_OF
: The value that determines which artifacts are to be retrieved from the mirror. For instructions about setting themirrorOf
value, see Mirror Settings in the Apache Maven documentation. The default value isexternal:*
. With this value, Maven retrieves every required artifact from the mirror and does not query any other repositories.If you configure an external Maven repository (
MAVEN_REPO_URL
), changeMAVEN_MIRROR_OF
to exclude the artifacts in this repository from the mirror, for example,external:*,!repo-custom
. Replacerepo-custom
with the ID that you configured inMAVEN_REPO_ID
.If your authoring environment uses a built-in Business Central Maven repository, change
MAVEN_MIRROR_OF
to exclude the artifacts in this repository from the mirror:external:*,!repo-rhpamcentr
.
-
In some cases, you might want to persist the Maven repository cache for Business Central. By default, the cache is not persisted, so when you restart or scale a Business Central pod, all Maven artifacts are downloaded again and all projects within Business Central must be built again. If you enable persistence for the cache, the download is not necessary and startup time can improve in some situations. However, significant additional space on the Business Central persistence volume is required.
To enable persistence for the Maven repository cache, set the
KIE_PERSIST_MAVEN_REPO
environment variable totrue
.If you set
KIE_PERSIST_MAVEN_REPO
totrue
, you can optionally set a custom path for the cache using theKIE_M2_REPO_DIR
variable. The default path is/opt/kie/data/m2
. Files in the/opt/kie/data
directory tree are persisted.
Next steps
If you want to deploy the environment with the default configuration of KIE Servers, click Finish and then click Deploy to deploy the environment. Otherwise, continue to set configuration parameters for KIE Servers.
3.2.5. Setting custom KIE Server configuration of the environment
Every environment type in the Business Automation operator includes one or several KIE Servers by default.
Optionally, you can set custom configuration for KIE Servers. In this case, default KIE Servers are not created and only the KIE Servers that you configure are deployed.
Prerequisites
- You completed basic configuration of a Red Hat Decision Manager environment using the Business Automation operator in the installer wizard according to the instructions in Section 3.2.2, “Setting the basic configuration of the environment”.
Procedure
- If the Installation, Security, or Console tab is open, click Next until you view the KIE Servers tab.
- Click Add new KIE Server to add a new KIE Server configuration.
- In the Id field, enter an identifier for this KIE Server instance. If the KIE Server instance connects to a Business Central or Business Central Monitoring instance, this identifier determines which server group the server joins.
- In the Name field, enter a name for the KIE Server.
- In the Deployments field, enter the number of similar KIE Servers that are to be deployed. The installer can deploy several KIE Servers with the same configuration. The identifiers and names of the KIE Servers are modified automatically and remain unique.
- If you created the secret for KIE Server according to the instructions in Section 2.2, “Creating the secrets for KIE Server”, enter the name of the secret in the Keystore secret field.
- Optional: To configure KIE Server for decision management only capabilities so that jBPM and case management features are disabled, select Execute Kie Server only with Decisions capabilities.
- Optional: Enter the number of replicas for the KIE Server deployment in the Replicas field.
Optional: To set a custom hostname for the external route, enter a domain in the Custom hostname to be used on the KIE Server external Route field, formatted as in the following example:
`kieserver.example.com`
NoteThe custom hostname must be valid and resolvable.
To change the custom hostname, you can modify the
routeHostname
property.Optional: To enable and set the Edge termination route, complete the following steps:
- Under Change route termination, select Enable Edge termination.
- Optional: In the Key field, enter the private key.
- Optional: In the Certificate field, enter the certificate.
- Optional: In the CaCertificate field, enter the CaCertificate.
Optional: If you want to use a custom KIE Server image, complete the following additional steps:
- Click Set KIE Server image.
-
From the Kind list, select
ImageStreamTag
if you want to pull the image from an OpenShift image stream or selectDockerImage
if you want to pull the image from any Docker registry. Set the image name by completing one of the following steps:
If you selected the
ImageStreamTag
kind, enter the image stream tag name of the image in the Name field, for example,my-custom-is-tag:1.0
.If a corresponding image stream does not exist in your environment, the operator creates this image stream using the default Red Hat registry and tags. If you configured a custom registry in the Installation tab, the operator uses this registry for creating the image stream.
If you selected the
DockerImage
kind, enter the fully qualified image name for the image in the Name field, for example,registry.io/test/testing:1.0
.You can configure an image from any registry that your environment can access.
If you want to use an image stream that is not in the
openshift
namespace, enter the namespace in the Namespace field.For instructions about creating custom images, see Section 3.7, “Creating custom images for KIE Server”.
Optional: If you want to configure an immutable KIE Server using a Source to Image (S2I) build, complete the following additional steps:
ImportantIf you want to configure an immutable KIE Server that pulls services from the Maven repository, do not click Set Immutable server configuration and do not complete these steps. Instead, set the
KIE_SERVER_CONTAINER_DEPLOYMENT
environment variable.- Click Set Immutable server configuration.
-
In the KIE Server container deployment field, enter the identifying information of the services (KJAR files) that the deployment must extract from the result of a Source to Image (S2I) build. The format is
<containerId>=<groupId>:<artifactId>:<version>
or, if you want to specify an alias name for the container,<containerId>(<aliasId>)=<groupId>:<artifactId>:<version>
. You can provide two or more KJAR files using the|
separator, as illustrated in the following example:containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2
. - If your OpenShift environment does not have a connection to the public Internet, enter the URL of the Maven mirror that you set up according to Section 2.9, “Preparing a Maven mirror repository for offline use” in the Maven mirror URL field.
- In the Artifact directory field, enter the path within the project that contains the required binary files (KJAR files and any other necessary files) after a successful Maven build. Normally this directory is the target directory of the build. However, you can provide prebuilt binaries in this directory in the Git repository.
-
If you want to use a custom base KIE Server image for the S2I build, click Set Base build image and then enter the name of the image stream in the Name field. If the image stream is not in the
openshift
namespace, enter the namespace in the Namespace field. If you want to use a Docker image name and not an OpenShift image stream tag, change the Kind value toDockerImage
. Click Set Git source and enter information in the following fields:
- S2I Git URI:The URI for the Git repository that contains the source for your services.
- Reference: The branch in the Git repository.
Context directory: (Optional) The path to the source within the project downloaded from the Git repository. By default, the root directory of the downloaded project is the source directory.
NoteIf you do not configure a Git source, the immutable KIE Server does not use an S2I build. Instead, it pulls the artifacts that you define in the KIE Server container deployment field from the configured Maven repository.
- If you are using S2I and want to set a Git Webhook so that changes in the Git repository cause an automatic rebuild of the KIE Server, click Add new Webhook. Then select the type of the Webhook in the Type field and enter the secret string for the Webhook in the Secret field.
- If you want to set a build environment variable for the S2I build, click Add new Build Config Environment variable and then enter the name and value for the variable in the Name and Value fields.
- Optional: Enter requested and maximum CPU and memory limits in the fields under Resource quotas. If you are configuring several KIE Servers, the limits apply to each server separately.
If you selected RH-SSO authentication, configure RH-SSO for the KIE Server:
- Enter the client name in the Client name field and the client secret in the Client secret field. If a client with this name does not exist, the deployment attempts to create a new client with this name and secret.
- If the deployment is to create a new client, enter the HTTP and HTTPS URLs that will be used for accessing this KIE Server instance into the SSO HTTP URL and SSO HTTPS URL fields. This information is recorded in the client.
If you want to interact with the KIE Server through JMS API using an external AMQ message broker, enable the Enable JMS Integration setting. Additional fields for configuring JMS Integration are displayed and you must enter the values as necessary:
- User name, Password: The user name and password of a standard broker user, if user authentication in the broker is required in your environment.
- Executor: Select this setting to disable the JMS executor. The executor is enabled by default.
- Executor transacted: Select this setting to enable JMS transactions on the executor queue.
- Enable signal: Select this setting to enable signal configuration through JMS.
- Enable audit: Select this setting to enable audit logging through JMS.
- Audit transacted: Select this setting to enable JMS transactions on the audit queue.
- Queue executor, Queue request, Queue response, Queue signal, Queue audit: Custom JNDI names of the queues to use. If you set any of these values, you must also set the AMQ queues parameter.
- AMQ Queues: AMQ queue names, separated by commas. These queues are automatically created when the broker starts and are accessible as JNDI resources in the JBoss EAP server. If you are using any custom queue names, you must enter the names of all the queues uses by the server in this field.
- Enable SSL integration: Select this setting if you want to use an SSL connection to the AMQ broker. In this case you must also provide the name of the secret that you created in Section 2.4, “Creating the secrets for the AMQ broker connection” and the names and passwords of the key store and trust store that you used for the secret.
- If you want to customize the configuration of the Java virtual machine on the KIE Server pods, select the Enable JVM configuration box and then enter information in any of the fields under Enable JVM configuration. All fields are optional. For the JVM parameters that you can configure, see Section 3.5, “JVM configuration parameters”.
Optional: If you want to configure the proxy settings, use the following environment variables:
-
https_proxy
: The location of the https proxy. This takes precedence overHTTPS_PROXY
,http_proxy
, andHTTP_PROXY
, and is used for both Maven builds and Java runtime. For example:myuser:mypass@127.0.0.1:8080
. -
HTTPS_PROXY
: The location of the https proxy. This takes precedence overhttp_proxy
andHTTP_PROXY
, and is used for both Maven builds and Java runtime. For example:myuser@127.0.0.1:8080
. -
http_proxy
: The location of the http proxy. This takes precedence overHTTP_PROXY
and is used for both Maven builds and Java runtime. For example:http://127.0.0.1:8080
. -
HTTP_PROXY
: The location of the http proxy. This is used for both Maven builds and Java runtime. For example:127.0.0.1:8080
. -
no_proxy
: A comma separated lists of hosts, IP addresses, or domains that can be accessed directly. This takes precedence overNO_PROXY
and is used for both Maven builds and Java runtime. For example:*.example.com
. -
NO_PROXY
: A comma separated lists of hosts, IP addresses, or domains that can be accessed directly. This is used for both Maven builds and Java runtime. For example:foo.example.com,bar.example.com
.
-
Optional: Depending on your needs, set environment variables. To set an environment variable, click Add new Environment variable, then enter the name and value for the variable in the Name and Value fields.
If you want to configure an immutable KIE server that pulls services from the configured Maven repository, enter the following settings:
-
Set the
KIE_SERVER_CONTAINER_DEPLOYMENT
environment variable. The variable must contain the identifying information of the services (KJAR files) that the deployment must pull from the Maven repository. The format is<containerId>=<groupId>:<artifactId>:<version>
or, if you want to specify an alias name for the container,<containerId>(<aliasId>)=<groupId>:<artifactId>:<version>
. You can provide two or more KJAR files using the|
separator, as illustrated in the following example:containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2
. - Configure an external Maven repository.
-
Set the
If you want to configure an external Maven repository, set the following variables:
-
MAVEN_REPO_URL
: The URL for the Maven repository -
MAVEN_REPO_ID
: An identifier for the Maven repository, for example,repo-custom
-
MAVEN_REPO_USERNAME
: The user name for the Maven repository -
MAVEN_REPO_PASSWORD
: The password for the Maven repository
-
If your OpenShift environment does not have a connection to the public Internet, configure access to a Maven mirror that you set up according to Section 2.9, “Preparing a Maven mirror repository for offline use”. Set the following variables:
-
MAVEN_MIRROR_URL
: The URL for the Maven mirror repository that you set up in Section 2.9, “Preparing a Maven mirror repository for offline use”. This URL must be accessible from a pod in your OpenShift environment. If you configured this KIE Server as S2I, you already entered this URL. MAVEN_MIRROR_OF
: The value that determines which artifacts are to be retrieved from the mirror. If you configured this KIE Server as S2I, do not set this value. For instructions about setting themirrorOf
value, see Mirror Settings in the Apache Maven documentation. The default value isexternal:*
. With this value, Maven retrieves every required artifact from the mirror and does not query any other repositories.If you configure an external Maven repository (
MAVEN_REPO_URL
), changeMAVEN_MIRROR_OF
to exclude the artifacts in this repository from the mirror, for example,external:*,!repo-custom
. Replacerepo-custom
with the ID that you configured inMAVEN_REPO_ID
.If your authoring environment uses a built-in Business Central Maven repository, change
MAVEN_MIRROR_OF
to exclude the artifacts in this repository from the mirror:external:*,!repo-rhpamcentr
.
-
-
If you want to configure your KIE Server deployment to use Prometheus to collect and store metrics, set the
PROMETHEUS_SERVER_EXT_DISABLED
environment variable tofalse
. For instructions about configuring Prometheus metrics collection, see Managing and monitoring KIE Server. If you are using Red Hat Single Sign-On authentication and the interaction of your application with Red Hat Single Sign-On requires support for cross-origin resource sharing (CORS), configure CORS Filters configuration:
- To use CORS with the default configuration, ensure Default configuration is selected from the CORS Filters configuration list and select Enable CORS with Default values.
- To use CORS with a custom configuration, select Custom configuration from the CORS Filters configuration list and enter the relevant values for the CORS filters.
Next steps
To configure additional KIE Servers, click Add new KIE Server again and repeat the procedure for the new server configuration.
Click Finish and then click Deploy to deploy the environment.
3.3. Modifying an environment that is deployed using operators
If an environment is deployed using operators, you cannot modify it using typical OpenShift methods. For example, if you delete a deployment configuration or a service, it is re-created automatically with the same parameters.
To modify the environment, you must modify the YAML description of the environment. You can change common settings such as passwords, add new KIE Servers, and scale KIE Servers.
Procedure
- Enter your project in the OpenShift web cluster console.
-
In the OpenShift Web console navigation panel, select Catalog
Installed operators or Operators Installed operators. -
Find the
Business Automation
operator line in the table and clickKieApp
in the line. Information about the environments that you deployed using this operator is displayed. - Click the name of a deployed environment.
Select the YAML tab.
A YAML source is displayed. In this YAML source, you can edit the content under
spec:
to change the configuration of the environment.If you want to change the deployed version of Red Hat Decision Manager, add the following line under
spec:
version: 7.13.5
You can replace
7.13.5
with another required version. Use this setting to upgrade Red Hat Decision Manager to a new version if automatic updates are disabled, for example, if you use a custom image.-
If you want to change common settings, such as passwords, edit the values under
commonConfig:
. If you want to add new KIE Servers, add their descriptions at the end of the block under
servers:
, as shown in the following examples:To add two servers named
server-a
andserver-a-2
, add the following lines:- deployments: 2 name: server-a
To add an immutable KIE Server that includes services built from source in an S2I process, add the following lines:
- build: kieServerContainerDeployment: <deployment> gitSource: uri: <url> reference: <branch> contextDir: <directory>
Replace the following values:
-
<deployment>
: The identifying information of the decision service (KJAR file) that is built from your source. The format is<containerId>=<groupId>:<artifactId>:<version>
. You can provide two or more KJAR files using the|
separator, for examplecontainerId=groupId:artifactId:version|c2=g2:a2:v2
. The Maven build process must produce all these files from the source in the Git repository. -
<url>
: The URL for the Git repository that contains the source for your decision service. -
<branch>
: The branch in the Git repository. -
<directory>
: The path to the source within the project downloaded from the Git repository.
-
-
If you want to scale a KIE Server, find the description of the server in the block under
servers:
and add areplicas:
setting under that description. For example,replicas: 3
scales the server to three pods. If you want to make other changes, review the CRD source for the available settings. To view the CRD source, log in to the Red Hat OpenShift Container Platform environment with the
oc
command as an administrative user and then enter the following command:oc get crd kieapps.app.kiegroup.org -o yaml
-
Click Save and then wait for a
has been updated
pop-up message. - Click Reload to view the new YAML description of the environment.
3.4. Providing Elytron user configuration or other post-configuration settings
If you do not use LDAP or RH-SSO authentication, Red Hat Decision Manager relies on internal users in the Elytron subsystem of Red Hat JBoss EAP. By default, only the administrative user is created. You might need to add other users to the Elytron security subsystem of Red Hat JBoss EAP. To do so, you must run an Red Hat JBoss EAP post-configuration script.
You can configure this post-configuration script, or any other Red Hat JBoss EAP post-configuration script, in a deployment of Red Hat Decision Manager on Red Hat OpenShift Container Platform.
Procedure
- Download sample files from the GitHub repository.
Prepare the following files based on the sample files:
-
postconfigure.sh
: The post-configuration shell script that Red Hat JBoss EAP must run. In the example, this script uses theadd-users.cli
script to add Elytron users. If you want to complete post-configuration tasks outside of the CLI script, modify this script. -
delayedpostconfigure.sh
: An empty file, required in Red Hat Decision Manager version 7.13.5. add-users.cli
: The Red Hat JBoss EAP command line interface script for configuring Elytron users or for any other CLI tasks. Add your commands between the following lines:embed-server --std-out=echo --server-config=standalone-openshift.xml batch <your jboss-cli commands> run-batch quit
-
-
Log in to your Red Hat OpenShift Container Platform cluster with the
oc
command and change to the namespace of your deployment. Create a ConfigMap with the files that you prepared by using the following command:
oc create configmap postconfigure \ --from-file=add-users.cli=add-users.cli \ --from-file=delayedpostconfigure.sh=delayedpostconfigure.sh \ --from-file=postconfigure.sh=postconfigure.sh
Enter the following command to edit the
kieconfigs-7.13.5
config map:oc edit cm kieconfigs-7.13.5
In the file, modify the deployment configuration under the
console:
section to add the configuration to Business Central and modify all deployment configurations under theservers:
section to add the configuration to KIE Server instances.In each deployment configuration, make the following changes:
Under
deploymentConfigs.metadata.spec.template.spec.containers.volumeMounts
, add the following lines:- name: postconfigure-mount mountPath: /opt/eap/extensions
Under
deploymentConfigs.metadata.spec.template.spec.containers.volumeMounts
, add the following lines:- name: "postconfigure-mount" configMap: name: "postconfigure" defaultMode: 0555
- Save the file. After this point, new operator deployments contain the post-configuration settings.
In existing deployments, if the the post-configuration settings are not added automatically, you can delete the Business Central and KIE Server pods. The operator automatically starts updated versions with the post-configuration settings.
3.5. JVM configuration parameters
When deploying Red Hat Decision Manager using the operator, you can optionally set a number of JVM configuration parameters for Business Central and KIE Servers. These parameters set environment variables for the corresponding containers.
The following table lists all JVM configuration parameters that you can set when deploying Red Hat Decision Manager using the operator.
The default settings are optimal for most use cases. Make any changes only when they are required.
Configuration field | Environment variable | Description | Example |
---|---|---|---|
Java Opts append | JAVA_OPTS_APPEND | User specified Java options to be appended to generated options in JAVA_OPTS. |
|
Java max memory ratio | JAVA_MAX_MEM_RATIO |
The maximum percentage of container memory that can be used for the Java Virtual Machine. The remaining memory is used for the operating system. The default value is |
|
Java initial memory ratio | JAVA_INITIAL_MEM_RATIO |
The percentage of container memory that is initially used for the Java Virtual Machine. The default value is |
|
Java max initial memory | JAVA_MAX_INITIAL_MEM |
The maximum amount of memory, in megabytes, that can be initially used for the Java Virtual Machine. If the initial allocated memory, as set in the Java initial memory ratio parameter, would otherwise be greater than this value, the amount of memory set in this value is allocated using the |
|
Java diagnostics | JAVA_DIAGNOSTICS | Enable this setting to enable output of additional JVM diagnostic information to the standard output. Disabled by default. |
|
Java debug | JAVA_DEBUG |
Enable this setting to switch on remote debugging. Disabled by default. Adds the |
|
Java debug port | JAVA_DEBUG_PORT |
The port that is used for remote debugging. The default value is |
|
GC min heap free ratio | GC_MIN_HEAP_FREE_RATIO |
Minimum percentage of heap free after garbage collection (GC) to avoid expansion. Sets the |
|
GC max heap free ratio | GC_MAX_HEAP_FREE_RATIO |
Maximum percentage of heap free after GC to avoid shrinking. Sets the |
|
GC time ratio | GC_TIME_RATIO |
Specifies the ratio of the time spent outside the garbage collection (for example, the time spent for application execution) to the time spent in the garbage collection. Sets the |
|
GC adaptive size policy weight | GC_ADAPTIVE_SIZE_POLICY_WEIGHT |
The weighting given to the current GC time versus previous GC times. Sets the |
|
GC max metaspace size | GC_MAX_METASPACE_SIZE |
The maximum metaspace size. Sets the |
|
3.6. KIE configuration and ConfigMaps
When installing the Red Hat Decision Manager operator, the operator creates ConfigMaps, a YAML file, prefixed as kieconfig-$VERSION
, for the current namespace. A ConfigMap is a YAML file containing the configuration for functionality such as DeploymentConfigs
, secrets, routes, and services for the Red Hat Decision Manager components for that namespace.
Example ConfigMap:
# Please edit the object below. Lines beginning with a '#' will be ignored, # and an empty file will abort the edit. If an error occurs while saving this file will be # reopened with the relevant failures. # apiVersion: v1 data: mysql.yaml: | ## KIE Databases BEGIN databases: ## RANGE BEGINS #[[ range $index, $Map := .Databases ]] …
The operator uses ConfigMaps to configure and deploy the components. This includes all supported Red Hat Decision Manager components such as KIE Server, Smart Router, Business Central and service-related configuration such as for persistent volumes, build configuration, and routes. When ConfigMaps are edited manually, the operator uses the new values to create the deployments when the environment is reconciled.
The Red Hat Decision Manager operator can use the current version and the previous version of Red Hat Decision Manager components concurrently, with ConfigMaps for each version, for example, 7.13.0 and 7.12.1.
- kieconfigs-7.13.5
This contains the
common.yaml
configuration file. For more information, seecommon.yaml
on GitHub. You can configure the following components using this configuration file:-
KIE Server, the server object, is identified by the
## KIE Servers BEGIN
placeholder. -
Business Central and Business Central Monitoring, the console object, is defined on the first line of the
common.yaml
. -
Smartrouter, the smartrouter object, is identified by the
## KIE smartrouter BEGIN
placeholder.
-
KIE Server, the server object, is identified by the
kieconfigs-7.13.5
also holds the routes and services relating to these three components.
- kieconfigs-7.13.5-dashbuilder
This contains the configuration YAML file for the Dashbuilder component.
For more information, see
rhpam-standalone-dashbuilder.yaml
on GitHub.- kieconfigs-7.13.5-dbs
This contains the base
DeploymentConfig
for the MySQL and PostgreSQL databases.For more information about the MySQL configuration, see
mysql.yaml
on GitHub.For more information about the PostgreSQL configuration, see
postgresql.yaml
on GitHub.- kieconfigs-7.13.5-dbs-pim
This contains the snippet configuration for the Process Instance Migration (PIM) supported databases; external, MySQL, and PostgreSQL.
For more information about the PIM external configuration, see
external.yaml
on GitHub.For more information about the PIM MySQL configuration, see
mysql.yaml
on GitHub.For more information about the PIM PostgreSQL configuration, see
postgresql.yaml
on GitHub.NoteThese YAML files only hold the specific configuration for the PIM database configured using
application.properties
in this configMap.- kieconfigs-7.13.5-dbs-servers
This contains the snippet configuration for the supported database configurations; external, h2, MySQL, and PostgreSQL.
For more information about the external configuration, see
external.yaml
on GitHub.For more information about the h2 configuration, see
h2.yaml
on GitHub. Note that the h2 configuration is not supported on production environments.For more information about the MySQL configuration, see
mysql.yaml
on GitHub.For more information about the PostgreSQL configuration, see
postgresql.yaml
on GitHub.- kieconfigs-7.13.5-envs
This contains the specific configurations for each Red Hat Decision Manager environment such as the authoring or trial environments. This ConfigMap contains the following YAML files:
- rhdm-authoring-ha.yaml
- rhdm-authoring.yaml
- rhdm-production-immutable.yaml
- rhdm-trial.yaml
- rhpam-authoring-ha.yaml
- rhpam-authoring.yaml
- rhpam-production-immutable.yaml
- rhpam-production.yaml
- rhpam-standalone-dashbuilder.yaml
rhpam-trial.yaml
For more information about specific configurations for each Red Hat Decision Manager environment, see ConfigMaps for Red Hat Decision Manager environments on GitHub.
- kieconfigs-7.13.5-jms
-
This contains the ActiveMQ configuration for KIE Server when the JMS Executor is enabled. For more information about the JMS Executor configuration, see
activemq-jms-config
on GitHub. - kieconfigs-7.13.5-pim
-
This contains the process instance migration (PIM) DeploymentConfig and related PIM configuration. If you are using MySQL or any other database with PIM you must use the
kieconfigs-7.13.5-dbs-pim
configMap and edit themysql.yaml
file.
3.6.1. Using ConfigMaps
You can use ConfigMaps to customize the Red Hat Decision Manager Operator and apply the related configuration. To make changes to ConfigMaps, you can use the oc
command tool or the Red Hat OpenShift Container Platform console.
Prerequisites
- Operator is installed in your current namespace.
- A KieApp is available.
kieconfig-$VERSION-*
are available.To check if
kieconfig-$VERSION-*
are available, run the following command:$ oc get cm | grep kieconfigs
Example output of
oc get cm | grep kieconfigs
:kieconfigs-7.13.0 1 64m kieconfigs-7.13.0-dashbuilder 1 64m kieconfigs-7.13.0-dbs 2 64m kieconfigs-7.13.0-dbs-pim 3 64m kieconfigs-7.13.0-dbs-servers 4 64m kieconfigs-7.13.0-envs 10 64m kieconfigs-7.13.0-jms 1 64m kieconfigs-7.13.0-pim 1 64m kieconfigs-7.12.1 1 64m kieconfigs-7.12.1-dashbuilder 1 64m kieconfigs-7.12.1-dbs 2 64m kieconfigs-7.12.1-dbs-pim 3 64m kieconfigs-7.12.1-dbs-servers 4 64m kieconfigs-7.12.1-envs 10 64m kieconfigs-7.12.1-jms 1 64m kieconfigs-7.12.1-pim 1 64m
Procedure
Create an
rhpam-authoring environment
with one replica for Business Central and KIE Server.Example
rhpam-authoring
:apiVersion: app.kiegroup.org/v2 kind: KieApp metadata: name: rhpam-authoring annotations: consoleName: rhpam-authoring consoleTitle: PAM Authoring consoleDesc: Deploys a PAM Authoring environment spec: environment: rhpam-authoring objects: servers: - replicas: 1 console: replicas: 1
Complete one of the following steps:
To open a specific ConfigMap with the
oc
tool, run the following command:$ oc edit cm/<CONFIGMAP_NAME>
NoteThe
oc
tool is similar to thevim
text editing tool.-
To open a specific ConfigMap using the Red Hat OpenShift Container Platform console, navigate to
kieconfigs-7.13.5
on the ConfigMaps page and edit it by opening it’s YAML version.
To modify the YAML file, add
annotations
fields that contain your changes, for example:Add the following to
Console.deploymentConfigs.metadata
:annotations: my.custom.annotation/v1: v1-rhpam-app-console
To update KIE Server, add the following to the
## KIE Servers Start
placeholder identifier:annotations: my.custom.annotation/v1: v1-rhpam-app-kieserver
NoteYou can also edit the Smart Router configuration using this ConfigMap.
To save the changes, complete one of the following steps:
-
In the
oc
tool editor, to save the change the change and exit, enter:wq!
. - In the the Red Hat OpenShift Container Platform console, to save the change using the Red Hat OpenShift Container Platform console, click Save.
-
In the
If an environment is running and the operator didn’t automatically start redeployment for the component that was changed, you must manually delete the DeploymentConfig of the target component by using
oc
command tool by completing the following steps:To return the DeploymentConfig, run the following command:
$ oc get dc
The output of
oc get dc
is returned.Example output of
oc get dc
:$ oc get dc NAME REVISION DESIRED CURRENT TRIGGERED BY rhpam-authoring-kieserver 1 1 1 config rhpam-authoring-rhpamcentr 1 1 1 config
To delete the DeploymentConfig of the target components, run the following commands:
$ oc delete dc/rhpam-authoring-kieserver
$ oc delete dc/rhpam-authoring-rhpamcentr
The deployment is redeployed with the changes applied in the ConfigMap.
To verify that the change was applied by checking the annotations for the KIE Server DeploymentConfig, run the following command:
$ oc describe dc/rhpam-authoring-kieserver
Example output of
oc describe dc/rhpam-authoring-kieserver
:Name: rhpam-authoring-kieserver Namespace: examplenamespace Created: 15 minutes ago Labels: app=rhpam-authoring application=rhpam-authoring service=rhpam-authoring-kieserver services.server.kie.org/kie-server-id=rhpam-authoring-kieserver Annotations: my.custom.annotation/v1=v1-rhpam-app-kieserver
3.7. Creating custom images for KIE Server
You can create custom images to add files to KIE Server deployments. You must push the images to your own container registry. When deploying Red Hat Decision Manager, you can configure the operator to use the custom images.
If you use a custom image, you must disable automatic version updates. When you want to install a new version, build the image with the same name as before and the new version tag and push the image into your registry. You can then change the version and the operator automatically pulls the new image. For instructions about changing the product version in the operator, see Section 3.3, “Modifying an environment that is deployed using operators”.
In particular, you can create the following types of custom images:
- A custom image of KIE Server that includes an additional RPM package
- A custom image of KIE Server that includes an additional JAR class library
3.7.1. Creating a custom KIE Server image with an additional RPM package
You can create a custom KIE Server image where an additional RPM package is installed. You can push this image into your custom registry and then use it to deploy KIE Server.
You can install any package from the Red Hat Enterprise Linux 8 repository. This example installs the procps-ng
package, which provides the ps
utility, but you can modify it to install other packages.
Procedure
-
Authenticate to the
registry.redhat.io
registry using thepodman login
command. For instructions about authenticating to the registry, see Red Hat Container Registry Authentication. To download the supported KIE Server base image, enter the following command:
podman pull registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.13.5
Create a
Dockerfile
that defines a custom image based on the base image. The file must change the current user toroot
, install the RPM package using theyum
command, and then revert toUSER 185
, the Red Hat JBoss EAP user. The following example shows the content of theDockerfile
file:FROM registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.13.5 USER root RUN yum -y install procps-ng USER 185
Replace the name of the RPM file as necessary. The
yum
command automatically installs all dependencies from the Red Hat Enterprise Linux 8 repository. You might need to install several RPM files, in this case, use severalRUN
commands.Build the custom image using the
Dockerfile
. Supply the fully qualified name for the image, including the registry name. You must use the same version tag as the version of the base image. To build the image, enter the following command:podman build . --tag registry_address/image_name:7.13.5
For example:
podman build . --tag registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5
After the build completes, run the image, log in to it, and verify that the customization was successful. Enter the following command:
podman run -it --rm registry_address/image_name:7.13.5 /bin/bash
For example:
podman run -it --rm registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5 /bin/bash
In the shell prompt for the image, enter the command to test that the RPM is installed, then enter
exit
. For example, forprocps-ng
, run theps
command:[jboss@c2fab36b778e ~]$ ps PID TTY TIME CMD 1 pts/0 00:00:00 bash 13 pts/0 00:00:00 ps [jboss@c2fab36b778e ~]$ exit
To push the custom image into your registry, enter the following command:
podman push registry_address/image_name:7.13.5 docker://registry_address/image_name:7.13.5
For example:
podman push registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5 docker://registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5
Next steps
When deploying the KIE Server, set the image name and namespace to specify the custom image in your registry. Click Set KIE Server image, change the Kind value to DockerImage, and then provide the image name including the registry name, but without the version tag, for example:
registry.example.com/custom/rhpam-kieserver-rhel8
For instructions about deploying KIE Server using the operator, see Section 3.2.5, “Setting custom KIE Server configuration of the environment”.
3.7.2. Creating a custom KIE Server image with an additional JAR file
You can create a custom KIE Server image where an additional JAR file (or several JAR files) is installed to extend the capabilities of the server. You can push this image into your custom registry and then use it to deploy KIE Server.
For example, you can create a custom class JAR to provide custom Prometheus metrics in KIE Server. For instructions about creating the custom class, see Extending Prometheus metrics monitoring in KIE Server with custom metrics in Managing and monitoring KIE Server.
Procedure
Develop a custom library that works with KIE Server. You can use the following documentation and examples to develop the library:
-
Build the library using Maven, so that the JAR file is placed in the
target
directory. This example uses thecustom-kieserver-ext-1.0.0.Final.jar
file name. -
Authenticate to the
registry.redhat.io
registry using thepodman login
command. For instructions about authenticating to the registry, see Red Hat Container Registry Authentication. To download the supported KIE Server base image, enter the following command:
podman pull registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.13.5
Create a
Dockerfile
that defines a custom image based on the base image. The file must copy the JAR file (or several JAR files) into the/opt/eap/standalone/deployments/ROOT.war/WEB-INF/lib/
directory. The following example shows the content of theDockerfile
file:FROM registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.13.5 COPY target/custom-kieserver-ext-1.0.0.Final.jar /opt/eap/standalone/deployments/ROOT.war/WEB-INF/lib/
Build the custom image using the
Dockerfile
. Supply the fully qualified name for the image, including the registry name. You must use the same version tag as the version of the base image. To build the image, enter the following command:podman build . --tag registry_address/image_name:7.13.5
For example:
podman build . --tag registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5
To push the custom image into your registry, enter the following command:
podman push registry_address/image_name:7.13.5 docker://registry_address/image_name:7.13.5
For example:
podman push registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5 docker://registry.example.com/custom/rhpam-kieserver-rhel8:7.13.5
Next steps
When deploying the KIE Server, set the image name and namespace to specify the custom image in your registry. Click Set KIE Server image, change the Kind value to DockerImage, and then provide the image name including the registry name, but without the version tag, for example:
registry.example.com/custom/rhpam-kieserver-rhel8
For instructions about deploying KIE Server using the operator, see Section 3.2.5, “Setting custom KIE Server configuration of the environment”.