Deploying Red Hat Process Automation Manager on Red Hat OpenShift Container Platform

Procedure

1. In the Red Hat OpenShift Container Platform web cluster console menu, select Catalog → Installed operators or Operators → Installed operators.
2. Click the name of the operator that contains businessautomation. Information about this operator is displayed.
3. Click the Installer link located on the right side of the window.
4. If prompted, log in with your OpenShift credentials.

Procedure

1. In the Application Name field, enter a name for the OpenShift application. This name is used in the default URLs for all components.

2. In the Environment list, select the type of environment. This type determines the default configuration; you can modify this configuration as necessary. The following types are available for Red Hat Process Automation Manager:

   • rhpam-trial: A trial environment that you can set up quickly and use to evaluate or demonstrate developing and running assets. Includes Business Central and a KIE Server. This environment does not use any persistent storage, and any work you do in the environment is not saved.
   • rhpam-authoring: An environment for creating and modifying services using Business Central. It consists of pods that provide Business Central for the authoring work and a KIE Server for test execution of the services.

   • rhpam-authoring-ha: An environment for creating and modifying services using Business Central. It consists of pods that provide Business Central for the authoring work and a KIE Server for test execution of the services. This version of the authoring environment supports scaling the Business Central pod to ensure high availability.

     Important

     In Red Hat Process Automation Manager 7.11, high-availability Business Central functionality deployment using the operator is for Technology Preview only. For more information about Red Hat Technology Preview features, see Technology Preview Features Support Scope. For a fully supported high-availability deployment, use the high-availability authoring template on Red Hat OpenShift Container Platform version 3.11. For instructions about deploying this template, see Part II, “Deploying a Red Hat Process Automation Manager environment on Red Hat OpenShift Container Platform 3 using templates”.

   • rhpam-production: An environment for running existing services for staging and production purposes. This environment includes Business Central Monitoring, Smart Router, and two groups of KIE Server pods. You can deploy and undeploy services on every such group and also scale the group up or down as necessary. Use Business Central Monitoring to deploy, run, and stop the services and to monitor their execution.

   • rhpam-production-immutable: An alternate environment for running existing services for staging and production purposes. You can configure one or more KIE Server pods that build services from source or pull them from a Maven repository. You can then replicate each pod as necessary.

     You cannot remove any service from the pod or add any new service to the pod. If you want to use another version of a service or to modify the configuration in any other way, deploy a new server image to replace the old one. You can use any container-based integration workflows to manage the pods.

     When configuring this environment, in the KIE Servers tab you must customize the KIE Server and either click the Set immutable server configuration button or set the KIE_SERVER_CONTAINER_DEPLOYMENT environment variable. For instructions about configuring the KIE Server, see Section 3.2.5, “Setting custom KIE Server configuration of the environment”.

     Optionally, you can also use the Console tab to include Business Central Monitoring in this environment to monitor, stop, and restart the execution of process services. For instructions about configuring Business Central Monitoring, see Section 3.2.4, “Setting the Business Central configuration of the environment”.

3. If you want to enable automatic upgrades to new versions, select the Enable Upgrades box. If this box is selected, when a new patch version of Red Hat Process Automation Manager 7.11 becomes available, the operator automatically upgrades your deployment to this version. All services are preserved and normally remain available throughout the upgrade process.

   If you also want to enable the same automatic upgrade process when a new minor version of Red Hat Process Automation Manager 7.x becomes available, select the Include minor version upgrades box.

   Note

   Disable automatic updates if you want to use a custom image for any component of Red Hat Process Automation Manager.

4. Optional: If you want to use image tags for downloading images, select the Use Image Tags box. This setting is useful if you use a custom registry or if you are directed by Red Hat support.
5. Optional: If you want to use the OpenShift CA bundle as the trust store for HTTPS communication, select the Use OpenShift CA Bundle box.

6. If you want to use a custom image registry, under Custom registry, enter the URL of the registry in the Image registry field. If this registry does not have a properly signed and recognized SSL certificate, select the Insecure box.

   Note

   To use particular images from the custom registry, set the image context, name, and tag in the Console and KIE Server tabs.

7. Under Admin user, enter the user name and password for the administrative user for Red Hat Process Automation Manager in the Username and Password fields.

   Important

   If you use RH-SSO or LDAP authentication, the same user must be configured in your authentication system with the kie-server,rest-all,admin roles for Red Hat Process Automation Manager.

Procedure

1. If the Installation tab is open, click Next to view the Security tab.

2. In the Authentication mode list, select one of the following modes:

   • Internal: You configure the initial administration user when deploying the environment. The user can use Business Central to set up other users as necessary.
   • RH-SSO: Red Hat Process Automation Manager uses Red Hat Single Sign-On for authentication.
   • LDAP: Red Hat Process Automation Manager uses LDAP for authentication

3. Complete the security configuration based on the Authentication mode that you selected.

   If you selected RH-SSO, configure RH-SSO authentication:

   1. In the RH-SSO URL field, enter the RH-SSO URL.
   2. In the Realm field, enter the RH-SSO realm name.
   3. If you did not create RH-SSO clients for components of your environment enter the credentials of an administrative user for your RH-SSO system in the SSO admin user and SSO admin password fields.
   4. If your RH-SSO system does not have a proper signed SSL certificate, select the Disable SSL cert validation box.
   5. If you want to change the RH-SSO principal attribute used for the user name, in the Principal attribute field enter the name of the new attribute.

   If you selected LDAP, configure LDAP authentication:

   1. In the LDAP URL field, enter the LDAP URL.

   2. Configure LDAP parameters that correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended Login Module.

      Note

      If you want to enable LDAP failover, you can set two or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

4. If you selected RH-SSO or LDAP, if your RH-SSO or LDAP system does not define all the roles required for your deployment, you can map authentication system roles to Red Hat Process Automation Manager roles.

   To enable role mapping, you must provide a role mapping configuration file in an OpenShift configuration map or secret object in the project namespace. The file must contain entries in the following format:

   ldap_role = product_role1, product_role2...

   For example:

   admins = kie-server,rest-all,admin

   To enable the use of this file, make the following changes:

   1. Under RoleMapper, in the Roles properties file field, enter the fully qualified path name of the role mapping configuration file, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties.
   2. If you want to replace roles defined in the authentication system with roles that you define in the mapping file, select the Replace roles box. Otherwise, both the roles defined in RH-SSO or LDAP and the roles defined in the configuration file are available.
   3. In the fields under RoleMapper Configuration object, select the Kind of the object that provides the file (ConfigMap or Secret) and enter the Name of the object. This object is automatically mounted on Business Central and KIE Server pods in the path that you specified for the role mapping configuration file.

5. Configure other passwords, if necessary:

   • AMQ password and AMQ cluster password are passwords for interaction with ActiveMQ using the JMS API.
   • Keystore password is the password for the keystore files used in secrets for HTTPS communication. Set this password if you created secrets according to instructions in Section 2.2, “Creating the secrets for KIE Server” or Section 2.3, “Creating the secrets for Business Central”.
   • Database password is the password for database server pods that are a part of the environments.

Procedure

1. If the Installation or Security tab is open, click Next until you view the Console tab.
2. If you created the secret for Business Central according to the instructions in Section 2.3, “Creating the secrets for Business Central”, enter the name of the secret in the Keystore secret field.

3. Optional: If you want to use a custom image for the Business Central deployment, complete the following additional steps:

   1. Set the custom registry in the Installation tab. If you do not set the custom registry, the installation uses the default Red Hat registry. For more information about setting the custom registry value, see Section 3.2.2, “Setting the basic configuration of the environment”.

   2. In the Console tab, set the following fields:

      • Image context: The context of the image in the registry.
      • Image: The name of the image.

      • Image tag: The tag of the image. If you do not set this field, the installation uses the latest tag.

        For example, if the full address of the image is registry.example.com/mycontext/mycentral:1.0-SNAPSHOT, set the custom registry to registry.example.com, the Image context field to mycontext, the Image field to mycentral, and the Image tag field to 1.0-SNAPSHOT.

4. Optional: Configure Git hooks.

   In an authoring environment, you can use Git hooks to facilitate interaction between the internal Git repository of Business Central and an external Git repository. If you want to use Git hooks, you must prepare a Git hooks directory in an OpenShift configuration map, secret, or persistent volume claim object in the project namespace. You can also prepare a secret with the SSH key and known hosts files for Git SSH authentication. For instructions about preparing Git hooks, see Section 2.7, “Preparing Git hooks”.

   To use a Git hooks directory, make the following changes:

   1. Under GitHooks, in the Mount path field, enter a fully qualified path for the directory, for example, /opt/kie/data/git/hooks.
   2. In the fields under GitHooks Configuration object, select the Kind of the object that provides the file (ConfigMap, Secret, or PersistentVolumeClaim) and enter the Name of the object. This object is automatically mounted on the Business Central pods in the path that you specified for the Git hooks directory.
   3. Optional: In the SSH secret field enter the name of the secret with the SSH key and known hosts files.
5. Optional: Enter the number of replicas for Business Central or Business Central monitoring in the Replicas field. Do not change this number in a rhpam-authoring environment.
6. Optional: To set the Business Central persistent volume size pvSize, on the Console component page, enter the desired size in the Persistent Volume Size field. The default size is 1Gi for Business Central and 64Mb for Business Central Monitoring.
7. Optional: Enter requested and maximum CPU and memory limits in the fields under Resource quotas.
8. If you want to customize the configuration of the Java virtual machine on the Business Central pods, select the Enable JVM configuration box and then enter information in any of the fields under Enable JVM configuration. All fields are optional. For the JVM parameters that you can configure, see Section 3.4, “JVM configuration parameters”.

9. If you selected RH-SSO authentication, configure RH-SSO for Business Central:

   1. Enter the client name in the Client name field and the client secret in the Client secret field. If a client with this name does not exist, the deployment attempts to create a new client with this name and secret.
   2. If the deployment is to create a new client, enter the HTTP and HTTPS URLs that will be used for accessing the KIE Server into the SSO HTTP URL and SSO HTTPS URL fields. This information is recorded in the client.

10. Optional: Depending on your needs, set environment variables. To set an environment variable, click Add new Environment variable, then enter the name and value for the variable in the Name and Value fields.

    • In a rhpam-production or rhpam-production-immutable environment, if you want Business Central Monitoring to run in a simplified mode that does not use a file system, set the ORG_APPFORMER_SIMPLIFIED_MONITORING_ENABLED to true.

      In the simplified mode, Business Central Monitoring does not require a persistent volume claim. You can use this mode in environments that do not support ReadWriteMany access to persistent storage. You can not use Business Central Monitoring in the simplified mode to design custom dashboards.

    • If you want to use an external Maven repository, set the following variables:

      • MAVEN_REPO_URL: The URL for the Maven repository
      • MAVEN_REPO_ID: An identifier for the Maven repository, for example, repo-custom
      • MAVEN_REPO_USERNAME: The user name for the Maven repository

      • MAVEN_REPO_PASSWORD The password for the Maven repository

        Important

        In an authoring environment, if you want Business Central to push a project into an external Maven repository, you must configure this repository during deployment and also configure exporting to the repository in every project. For information about exporting Business Central projects to an external Maven repository, see Packaging and deploying a Red Hat Process Automation Manager project.

    • If your OpenShift environment does not have a connection to the public Internet, configure access to a Maven mirror that you set up according to Section 2.11, “Preparing a Maven mirror repository for offline use”. Set the following variables:

      • MAVEN_MIRROR_URL: The URL for the Maven mirror repository that you set up in Section 2.11, “Preparing a Maven mirror repository for offline use”. This URL must be accessible from a pod in your OpenShift environment.

      • MAVEN_MIRROR_OF: The value that determines which artifacts are to be retrieved from the mirror. For instructions about setting the mirrorOf value, see Mirror Settings in the Apache Maven documentation. The default value is external:*. With this value, Maven retrieves every required artifact from the mirror and does not query any other repositories.

        If you configure an external Maven repository (MAVEN_REPO_URL), change MAVEN_MIRROR_OF to exclude the artifacts in this repository from the mirror, for example, external:*,!repo-custom. Replace repo-custom with the ID that you configured in MAVEN_REPO_ID.

        If your authoring environment uses a built-in Business Central Maven repository, change MAVEN_MIRROR_OF to exclude the artifacts in this repository from the mirror: external:*,!repo-rhpamcentr.

    • In some cases, you might want to persist the Maven repository cache for Business Central. By default, the cache is not persisted, so when you restart or scale a Business Central pod, all Maven artifacts are downloaded again and all projects within Business Central must be built again. If you enable persistence for the cache, the download is not necessary and startup time can improve in some situations. However, significant additional space on the Business Central persistence volume is required.

      To enable persistence for the Maven repository cache, set the KIE_PERSIST_MAVEN_REPO environment variable to true.

      If you set KIE_PERSIST_MAVEN_REPO to true, you can optionally set a custom path for the cache using the KIE_M2_REPO_DIR variable. The default path is /opt/kie/data/m2. Files in the /opt/kie/data directory tree are persisted.

    • In some authoring environments, you might need to ensure that several users can deploy services on the same KIE Server at the same time. By default, after deploying a service onto a KIE Server using Business Central, the user needs to wait for some seconds before more services can be deployed. The OpenShiftStartupStrategy setting is enabled by default and causes this limitation. To remove the limitation, you can configure an rhpam-authoring environment to use the controller strategy. Do not make this change unless a specific need for it exists; if you decide to enable controller strategy, make this change on Business Central and on all KIE Servers in the same environment.

      Note

      Do not enable the controller strategy in an environment with a high-availability Business Central. In such environments the controller strategy does not function correctly.

      To enable the controller strategy on Business Central, set the KIE_SERVER_CONTROLLER_OPENSHIFT_ENABLED environment variable to false.

Procedure

1. If the Installation, Security, or Console tab is open, click Next until you view the KIE Servers tab.
2. Click Add new KIE Server to add a new KIE Server configuration.
3. In the Id field, enter an identifier for the KIE Server. If the KIE Server connects to a Business Central or Business Central Monitoring instance, this identifier determines which server group the server joins.
4. In the Name field, enter a name for the KIE Server.
5. In the Deployments field, enter the number of similar KIE Servers that are to be deployed. The installer can deploy several KIE Servers with the same configuration. The identifiers and names of the KIE Servers are modified automatically and remain unique.
6. If you created the secret for KIE Server according to the instructions in Section 2.2, “Creating the secrets for KIE Server”, enter the name of the secret in the Keystore secret field.
7. Optional: Enter the number of replicas for the KIE Server deployment in the Replicas field.

8. Optional: If you want to use a custom image for the KIE Server deployment, complete one the following sets of additional steps:

   1. If you want to use a Docker image by specifying the image in the registry:

      1. Set the custom registry in the Installation tab. If you do not set the custom registry, the installation uses the default Red Hat registry. For more information about setting the custom registry value, see Section 3.2.2, “Setting the basic configuration of the environment”.

      2. In the KIE Server tab, set the following fields:

         • Image context: The context of the image in the registry.
         • Image: The name of the image.

         • Image tag: The tag of the image. If you do not set this field, the installation uses the latest tag.

           For example, if the full address of the image is registry.example.com/mycontext/myserver:1.0-SNAPSHOT, set the custom registry to registry.example.com, the Image context field to mycontext, the Image field to myserver, and the Image tag field to 1.0-SNAPSHOT.

   2. If you want to use an image from an existing OpenShift image stream:

      1. Click Set KIE Server image.
      2. Enter the name of the image stream tag in the Name field.

      3. If the image stream is not in the openshift namespace, enter the namespace in the Namespace field.

         If the image stream tag is already configured in your OpenShift environment, the installation uses this tag. If the tag is not configured, the installation creates an image stream tag with the default image names and tags.

         Note

         Do not change the Kind value to DockerImage. This option does not work in Red Hat Process Automation Manager 7.11.0.

         For instructions about creating custom images, see Section 3.5, “Creating custom images for KIE Server and Smart Router”.

9. If you want to configure an immutable KIE Server using a Source to Image (S2I) build, complete the following additional steps:

   Important

   If you want to configure an immutable KIE Server that pulls services from the Maven repository, do not click Set Immutable server configuration and do not complete these steps. Instead, set the KIE_SERVER_CONTAINER_REPLOYMENT environment variable.

   1. Click Set Immutable server configuration.
   2. In the KIE Server container deployment field, enter the identifying information of the services (KJAR files) that the deployment must extract from the result of a Source to Image (S2I) build. The format is <containerId>=<groupId>:<artifactId>:<version> or, if you want to specify an alias name for the container, <containerId>(<aliasId>)=<groupId>:<artifactId>:<version>. You can provide two or more KJAR files using the | separator, as illustrated in the following example: containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2.
   3. If your OpenShift environment does not have a connection to the public Internet, enter the URL of the Maven mirror that you set up according to Section 2.11, “Preparing a Maven mirror repository for offline use” in the Maven mirror URL field.
   4. In the Artifact directory field, enter the path within the project that contains the required binary files (KJAR files and any other necessary files) after a successful Maven build. Normally this directory is the target directory of the build. However, you can provide prebuilt binaries in this directory in the Git repository.
   5. If you want to use a custom base KIE Server image for the S2I build, click Set Base build image and then enter the name of the image stream in the Name field. If the image stream is not in the openshift namespace, enter the namespace in the Namespace field. If you want to use a Docker image name and not an OpenShift image stream tag, change the Kind value to DockerImage.

   6. Click Set Git source and enter information in the following fields:

      • S2I Git URI:The URI for the Git repository that contains the source for your services.
      • Reference: The branch in the Git repository.

      • Context directory: (Optional) The path to the source within the project downloaded from the Git repository. By default, the root directory of the downloaded project is the source directory.

        Note

        If you do not configure a Git source, the immutable KIE Server does not use an S2I build. Instead, it pulls the artifacts that you define in the KIE Server container deployment field from the configured Maven repository.

   7. If you are using S2I and want to set a Git Webhook so that changes in the Git repository cause an automatic rebuild of the KIE Server, click Add new Webhook. Then select the type of the Webhook in the Type field and enter the secret string for the Webhook in the Secret field.
   8. If you want to set a build environment variable for the S2I build, click Add new Build Config Environment variable and then enter the name and value for the variable in the Name and Value fields.
10. Optional: Enter requested and maximum CPU and memory limits in the fields under Resource quotas. If you are configuring several KIE Servers, the limits apply to each server separately.

11. If you selected RH-SSO authentication, configure RH-SSO for the KIE Server:

    1. Enter the client name in the Client name field and the client secret in the Client secret field. If a client with this name does not exist, the deployment attempts to create a new client with this name and secret.
    2. If the deployment is to create a new client, enter the HTTP and HTTPS URLs that will be used for accessing the KIE Server into the SSO HTTP URL and SSO HTTPS URL fields. This information is recorded in the client.

12. If you want to interact with the KIE Server through JMS API using an external AMQ message broker, enable the Enable JMS Integration setting. Additional fields for configuring JMS Integration are displayed and you must enter the values as necessary:

    • User name, Password: The user name and password of a standard broker user, if user authentication in the broker is required in your environment.
    • Executor: Select this setting to disable the JMS executor. The executor is enabled by default.
    • Executor transacted: Select this setting to enable JMS transactions on the executor queue.
    • Enable signal: Select this setting to enable signal configuration through JMS.
    • Enable audit: Select this setting to enable audit logging through JMS.
    • Audit transacted: Select this setting to enable JMS transactions on the audit queue.
    • Queue executor, Queue request, Queue response, Queue signal, Queue audit: Custom JNDI names of the queues to use. If you set any of these values, you must also set the AMQ queues parameter.
    • AMQ Queues: AMQ queue names, separated by commas. These queues are automatically created when the broker starts and are accessible as JNDI resources in the JBoss EAP server. If you are using any custom queue names, you must enter the names of all the queues uses by the server in this field.
    • Enable SSL integration: Select this setting if you want to use an SSL connection to the AMQ broker. In this case you must also provide the name of the secret that you created in Section 2.4, “Creating the secrets for the AMQ broker connection” and the names and passwords of the key store and trust store that you used for the secret.
13. If you want to customize the configuration of the Java virtual machine on the KIE Server pods, select the Enable JVM configuration box and then enter information in any of the fields under Enable JVM configuration. All fields are optional. For the JVM parameters that you can configure, see Section 3.4, “JVM configuration parameters”.

14. In the Database type field, select the database that the KIE Server must use. The following values are available:

    • mysql: A MySQL server, created in a separate pod.
    • postgresql: A PostgreSQL server, created in a separate pod. Use this setting unless you have a specific reason to use any other setting.
    • h2: A built-in h2 database engine that does not require a separate pod. Do not scale the KIE Server pod if you use this setting.
    • external: An external database server.

15. If you selected any database except external, a Persistent Volume Claim will be created to store the database. Optionally, set configuration parameters for the persistent volume:

    • In the Size field, enter the size of the persistence volume.
    • In the StorageClass name field, enter the storage class name for the persistent volume.

16. Optional: If you selected the external database, configure the KIE Server extension image. If you want to use any database server except PostgreSQL, MySQL, or MariaDB, you must provide a KIE Server extension image with the database server driver according to instructions in Section 2.6, “Building a custom KIE Server extension image for an external database”. To configure the KIE Server to use this extension image, make the following changes:

    1. Select the Enable extension image stream box.
    2. In the Extension image stream tag field, enter the ImageStreamTag definition for the image that you created, for example, jboss-kie-db2-extension-openshift-image:11.1.4.4
    3. Optional: In the Extension image stream namespace field, enter the namespace into which you pushed the image. If you do not enter any value in this field, the operator expects the image to be in the openshift namespace.
    4. Optional: In the Extension image install directory field, enter the directory within the extensions image where the extensions are located. If you used the procedure in Section 2.6, “Building a custom KIE Server extension image for an external database” to build the image, do not enter any value for this field.

17. If you selected an external database server, provide the following information in additional fields:

    1. Driver: Enter the database server driver, depending on the server type:

       • mysql
       • postgresql
       • mariadb
       • mssql
       • db2
       • oracle
       • sybase

    2. Dialect: Enter the Hibernate dialect for the server, depending on the server type. The common settings are:

       • org.hibernate.dialect.MySQL5InnoDBDialect
       • org.hibernate.dialect.MySQL8Dialect
       • org.hibernate.dialect.MariaDB102Dialect
       • org.hibernate.dialect.PostgreSQL95Dialect
       • org.hibernate.dialect.PostgresPlusDialect (used for EntrepriseDB Postgres Advanced Server)
       • org.hibernate.dialect.SQLServer2012Dialect (used for MS SQL)
       • org.hibernate.dialect.DB2Dialect
       • org.hibernate.dialect.Oracle10gDialect

       • org.hibernate.dialect.SybaseASE15Dialect

         For a complete list of supported dialects, see the Hibernate SQL Dialects table in Hibernate properties in the Red Hat JBoss EAP documentation.

    3. Host: Enter the host name of the external database server.
    4. Port: Enter the port number of the external database server.

    5. Jdbc URL: Enter the JDBC URL for the external database server.

       Note

       If you are using the EntrepriseDB Postgres database server, use an URL starting with jdbc:postgresql:// and not with jdbc:edb://. Alternatively, do not set the URL and set the host and port parameters instead.

    6. NonXA: Select this box if you want to configure the data source in non-XA mode.
    7. JNDI name: Enter the JNDI name that the application uses for the data source.
    8. User name and Password: Enter the user name and password for the external database server.
    9. Background validation: Optionally, select this box to enable background SQL validation and enter the background validation interval.
    10. Optional: Set the minimum and maximum connection pool sizes, valid connection checker class, and exception sorter class for the database server.

18. If you are using a MySQL version 8 external database server, enable the mysql_native_password plugin and use it for authentication. For instructions about this pluding, see Native Pluggable Authentication in the MySQL 8.0 Reference Manual.

    If you are using a MySQL version 8 image provided by Red Hat on Red Hat OpenShift Container Platform, to enable the plugin, set the MYSQL_DEFAULT_AUTHENTICATION_PLUGIN environment variable to mysql_native_password.

    If you created users on the MySQL version 8 server before enabling the mysql_native_password plugin, you must update the mysql-user table after you enable the plugin.

19. Optional: Depending on your needs, set environment variables. To set an environment variable, click Add new Environment variable, then enter the name and value for the variable in the Name and Value fields.

    • If you want to configure an immutable KIE server that pulls services from the configured Maven repository, enter the following settings:

      1. Set the KIE_SERVER_CONTAINER_DEPLOYMENT environment variable. The variable must contain the identifying information of the services (KJAR files) that the deployment must pull from the Maven repository. The format is <containerId>=<groupId>:<artifactId>:<version> or, if you want to specify an alias name for the container, <containerId>(<aliasId>)=<groupId>:<artifactId>:<version>. You can provide two or more KJAR files using the | separator, as illustrated in the following example: containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2.
      2. Configure an external Maven repository.

    • If you want to configure an external Maven repository, set the following variables:

      • MAVEN_REPO_URL: The URL for the Maven repository
      • MAVEN_REPO_ID: An identifier for the Maven repository, for example, repo-custom
      • MAVEN_REPO_USERNAME: The user name for the Maven repository
      • MAVEN_REPO_PASSWORD: The password for the Maven repository

    • If your OpenShift environment does not have a connection to the public Internet, configure access to a Maven mirror that you set up according to Section 2.11, “Preparing a Maven mirror repository for offline use”. Set the following variables:

      • MAVEN_MIRROR_URL: The URL for the Maven mirror repository that you set up in Section 2.11, “Preparing a Maven mirror repository for offline use”. This URL must be accessible from a pod in your OpenShift environment. If you configured this KIE Server as S2I, you already entered this URL.

      • MAVEN_MIRROR_OF: The value that determines which artifacts are to be retrieved from the mirror. If you configured this KIE Server as S2I, do not set this value. For instructions about setting the mirrorOf value, see Mirror Settings in the Apache Maven documentation. The default value is external:*. With this value, Maven retrieves every required artifact from the mirror and does not query any other repositories.

        If you configure an external Maven repository (MAVEN_REPO_URL), change MAVEN_MIRROR_OF to exclude the artifacts in this repository from the mirror, for example, external:*,!repo-custom. Replace repo-custom with the ID that you configured in MAVEN_REPO_ID.

        If your authoring environment uses a built-in Business Central Maven repository, change MAVEN_MIRROR_OF to exclude the artifacts in this repository from the mirror: external:*,!repo-rhpamcentr.

    • If you want to configure your KIE Server deployment to use Prometheus to collect and store metrics, set the PROMETHEUS_SERVER_EXT_DISABLED environment variable to false. For instructions about configuring Prometheus metrics collection, see Managing and monitoring KIE Server.
    • If you are using Red Hat Single Sign-On authentication and the interaction of your application with Red Hat Single Sign-On requires support for CORS, set the SSO_ENABLE_CORS variable to true.

    • In some authoring environments, you might need to ensure that several users can deploy services on the same KIE Server at the same time. By default, after deploying a service onto a KIE Server using Business Central, the user needs to wait for some seconds before more services can be deployed. The OpenShiftStartupStrategy setting is enabled by default and causes this limitation. To remove the limitation, you can configure an rhpam-authoring environment to use the controller strategy. Do not make this change unless a specific need for it exists; if you decide to enable controller strategy, make this change on Business Central and on all KIE Servers in the same environment.

      Note

      Do not enable the controller strategy in an environment with a high-availability Business Central. In such environments the controller strategy does not function correctly.

      To enable controller strategy on a KIE Server, set the KIE_SERVER_STARTUP_STRATEGY environment variable to ControllerBasedStartupStrategy and the KIE_SERVER_CONTROLLER_OPENSHIFT_ENABLED environment variable to false.

Procedure

1. If the Installation, Security, Console, or KIE Servers tab is open, click Next until you view the Smart Router tab.
2. Click Set Smart Router to add Smart Router to the environment and to configure Smart Router.

3. If you have created a custom Smart Router image according to the instructions in Section 3.5.3, “Creating a custom Smart Router image with an additional JAR file to implement custom routing”, set the following values:

   • Image context: The project name, for example, rhpam-project

   • Image: The custom image name, for example, rhpam-smartrouter-rhel8-custom

     If you used a custom tag for the image, set the Image tag field to this tag.

4. If you created the secret for Smart Router according to the instructions in Section 2.5, “Creating the secrets for Smart Router”, enter the name of the secret in the Secret field.
5. Optional: Enter the number of replicas for the Smart Router in the Replicas field.
6. Optional: Enter requested and maximum CPU and memory limits in the fields under Resource quotas.

7. Optional: Set the logging level using an environment variable:

   1. Click Add new Environment variable.
   2. In the Name field, enter LOG_LEVEL.
   3. In the Value field, enter a Java logging level. For a list of the available logging levels, see class Level.

   4. Optional: Set different logging levels for components by package name:

      1. Click Add new Environment variable.
      2. In the Name field, enter LOG_LEVEL.

      3. In the Value field, enter packages and logging levels for them, formatted as in the following example:

         com.example.abc=FINEST,com.example.def=SEVERE,com.example.xyz=FINE

Procedure

1. If the Installation, Security, Console, KIE Servers, or Smart Router tab is open, click Next until you view the Process Instance Migration tab.
2. Click Set Process Instance Migration to add PIM to the environment and to configure PIM.

3. In the Database type field, select the database that the PIM service must use. The following values are available:

   • mysql: A MySQL server, created in a separate pod.
   • postgresql: A PostgreSQL server, created in a separate pod. Use this setting unless you have a specific reason to use any other setting.
   • h2: A built-in h2 database engine that does not require a separate pod.

4. Optional: Set configuration parameters of the persistent volume for the database:

   • In the Size field, enter the size of the persistence volume
   • In the StorageClass name field, enter the storage class name for the persistent volume

Procedure

1. Authenticate to the registry.redhat.io registry using the podman login command. For instructions about authenticating to the registry, see Red Hat Container Registry Authentication.

2. To download the supported KIE Server base image, enter the following command:

   podman pull registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.11.0

3. Create a Dockerfile that defines a custom image based on the base image. The file must change the current user to root, install the RPM package using the yum command, and then revert to USER 185, the Red Hat JBoss EAP user. The following example shows the content of the Dockerfile file:

   FROM registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.11.0
   USER root
   RUN yum -y install procps-ng
   USER 185

   Replace the name of the RPM file as necessary. The yum command automatically installs all dependencies from the Red Hat Enterprise Linux 8 repository. You might need to install several RPM files, in this case, use several RUN commands.

4. Build the custom image using the Dockerfile. Supply the fully qualified name for the image, including the registry name. You must use the same version tag as the version of the base image. To build the image, enter the following command:

   podman build . --tag registry_address/image_name:7.11.0

   For example:

   podman build . --tag registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0

5. After the build completes, run the image, log in to it, and verify that the customization was successful. Enter the following command:

   podman run -it --rm registry_address/image_name:7.11.0 /bin/bash

   For example:

   podman run -it --rm registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0 /bin/bash

   In the shell prompt for the image, enter the command to test that the RPM is installed, then enter exit. For example, for procps-ng, run the ps command:

   [jboss@c2fab36b778e ~]$ ps
   PID TTY          TIME CMD
     1 pts/0    00:00:00 bash
    13 pts/0    00:00:00 ps
   [jboss@c2fab36b778e ~]$ exit

6. To push the custom image into your registry, enter the following command:

   podman push registry_address/image_name:7.11.0 docker://registry_address/image_name:7.11.0

   For example:

   podman push registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0 docker://registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0

Procedure

1. Develop a custom library that works with the KIE Server. You can use the following documentation and examples to develop the library:

   • KIE Server capabilities and extensions in Managing and monitoring KIE Server.
   • Domain-specific Prometheus metrics with Red Hat Process Automation Manager and Decision Manager
   • Extend KIE Server with additional transport
2. Build the library using Maven, so that the JAR file is placed in the target directory. This example uses the custom-kieserver-ext-1.0.0.Final.jar file name.
3. Authenticate to the registry.redhat.io registry using the podman login command. For instructions about authenticating to the registry, see Red Hat Container Registry Authentication.

4. To download the supported KIE Server base image, enter the following command:

   podman pull registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.11.0

5. Create a Dockerfile that defines a custom image based on the base image. The file must copy the JAR file (or several JAR files) into the /opt/eap/standalone/deployments/ROOT.war/WEB-INF/lib/ directory. The following example shows the content of the Dockerfile file:

   FROM registry.redhat.io/rhpam-7/rhpam-kieserver-rhel8:7.11.0
   COPY target/custom-kieserver-ext-1.0.0.Final.jar /opt/eap/standalone/deployments/ROOT.war/WEB-INF/lib/

6. Build the custom image using the Dockerfile. Supply the fully qualified name for the image, including the registry name. You must use the same version tag as the version of the base image. To build the image, enter the following command:

   podman build . --tag registry_address/image_name:7.11.0

   For example:

   podman build . --tag registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0

7. To push the custom image into your registry, enter the following command:

   podman push registry_address/image_name:7.11.0 docker://registry_address/image_name:7.11.0

   For example:

   podman push registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0 docker://registry.example.com/custom/rhpam-kieserver-rhel8:7.11.0

Procedure

1. Download the sample source of the router extention from the GitHub repository.
2. Modify the sample source of the router extension as necessary. The existing code implements simple routing based on the version of the container.

3. Build the source code with Maven:

   mvn clean package

   The build process generates the following JAR file: target/router-ext-0.0.1-SNAPSHOT.jar

4. Create a working directory for creating the custom image, copy the generated JAR file into the directory, and then change to the directory, for example:

   mkdir /tmp/smartrouter
   cp target/router-ext-0.0.1-SNAPSHOT.jar /tmp/smartrouter
   cd /tmp/smartrouter

5. Authenticate to the registry.redhat.io registry using the podman login command. For instructions about authenticating to the registry, see Red Hat Container Registry Authentication.

6. To download the supported Smart Router base image, enter the following command:

   podman pull registry.redhat.io/rhpam-7/rhpam-smartrouter-rhel8:7.11.0

7. Extract the openshift-launch.sh file from the official Smart Router image:

   podman run --rm registry.redhat.io/rhpam-7/rhpam-smartrouter-rhel8:7.11.0 \
      cat /opt/rhpam-smartrouter/openshift-launch.sh > openshift-launch.sh

8. Edit the openshift-launch.sh file. In the last line of the file, find the exec instruction that looks like the following text:

   exec ${JAVA_HOME}/bin/java ${SHOW_JVM_SETTINGS} ${JAVA_OPTS} ${JAVA_OPTS_APPEND} ${JAVA_PROXY_OPTIONS} "${D_ARR[@]}" -jar /opt/${JBOSS_PRODUCT}/${KIE_ROUTER_DISTRIBUTION_JAR}

   Change the instruction to the following text:

   exec ${JAVA_HOME}/bin/java ${SHOW_JVM_SETTINGS} "${D_ARR[@]}" \
       -cp /opt/${JBOSS_PRODUCT}/router-ext-0.0.1-SNAPSHOT.jar:/opt/${JBOSS_PRODUCT}/${KIE_ROUTER_DISTRIBUTION_JAR} \
       org.kie.server.router.KieServerRouter

   This change adds the extension JAR file to the Java Class Path.

9. Create a Dockerfile file that defines a custom image based on the base image. The following example shows the content of the Dockerfile file:

   FROM registry.redhat.io/rhpam-7/rhpam-smartrouter-rhel8:7.11.0
   RUN rm -rfv /opt/rhpam-smartrouter/openshift-launch.sh
   COPY openshift-launch.sh  /opt/rhpam-smartrouter/openshift-launch.sh
   COPY router-ext-0.0.1-SNAPSHOT.jar /opt/rhpam-smartrouter/router-ext-0.0.1-SNAPSHOT.jar
   
   USER root
   RUN chown jboss. /opt/rhpam-smartrouter/router-ext-0.0.1-SNAPSHOT.jar /opt/rhpam-smartrouter/openshift-launch.sh
   RUN chmod +x /opt/rhpam-smartrouter/openshift-launch.sh
   USER 185

   This file includes the following actions:

   • Add the JAR file and the new openshift-launch.sh file
   • Change the current user to root
   • Set the necessary permissions for the openshift-launch.sh file
   • Revert to USER 185, the Red Hat JBoss EAP user
10. Log in to your Red Hat OpenShift Container Platform cluster with the oc command.
11. Log in to the Red Hat OpenShift Container Platform cluster registry with the podman login command.

12. Build the custom image using the Dockerfile. Tag the image for your Red Hat OpenShift Container Platform cluster registry and your project namespace. Use a custom name for the image and the same version tag as the version of the base image. To build the image, enter the following command:

    podman build . --tag registry-route/project-name_/image-name:7.11.0

    For example:

    podman build . --tag route-openshift-image-registry.openshift.example.com/rhpam-project/rhpam-smartrouter-rhel8-custom:7.11.0

13. After the build completes, run the image and verify that the customization was successful. Enter the following command:

    podman run registry-route/project-name/image-name:7.11.0

    For example:

    podman run route-openshift-image-registry.openshift.example.com/rhpam-project/rhpam-smartrouter-rhel8-custom:7.11.0

    Ensure that the output mentions the custom service, as in the following example:

    INFO: Using 'LatestVersionContainerResolver' container resolver and restriction policy 'ByPassUserNotAllowedRestrictionPolicy'

14. Push the custom image into the registry:

    podman push registry-route/project-name/image-name:7.11.0

    For example:

    podman push route-openshift-image-registry.openshift.example.com/rhpam-project/rhpam-smartrouter-rhel8-custom:7.11.0

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the required template file.

3. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the <template-file-name>.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/<template-file-name>.yaml -p BUSINESS_CENTRAL_HTTPS_SECRET=businesscentral-app-secret -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Replace <template-file-name> with the name of the template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • Business Central Server Keystore Secret Name (BUSINESS_CENTRAL_HTTPS_SECRET): The name of the secret for Business Central, as created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for KIE Server, as created in Section 7.2, “Creating the secrets for KIE Server”.
   • Business Central Server Certificate Name (BUSINESS_CENTRAL_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • Business Central Server Keystore Password (BUSINESS_CENTRAL_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central.
      • Business Central RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string that is set in RH-SSO for the client for Business Central.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The RH-SSO client name for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string that is set in RH-SSO for the client for KIE Server.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The name of the client to create in RH-SSO for Business Central.
      • Business Central RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string to set in RH-SSO for the client for Business Central.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The name of the client to create in RH-SSO for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string to set in RH-SSO for the client for KIE Server.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Set the following parameters:

   • KIE Server External Database Driver (KIE_SERVER_EXTERNALDB_DRIVER): The driver for the server, depending on the server type:

     • mysql
     • postgresql
     • mariadb
     • mssql
     • db2
     • oracle
     • sybase
   • KIE Server External Database User (KIE_SERVER_EXTERNALDB_USER) and KIE Server External Database Password (KIE_SERVER_EXTERNALDB_PWD): The user name and password for the external database server

   • KIE Server External Database URL (KIE_SERVER_EXTERNALDB_URL): The JDBC URL for the external database server

     Note

     If you are using the EntrepriseDB Postgres database server, use an URL starting with jdbc:postgresql:// and not with jdbc:edb://. Alternatively, do not set the URL and set the host and port parameters instead.

   • KIE Server External Database Host (KIE_SERVER_EXTERNALDB_SERVICE_HOST) and KIE Server External Database Port (KIE_SERVER_EXTERNALDB_SERVICE_PORT): The host name and port number of the external database server. You can set these parameters as an alternative to setting the KIE_SERVER_EXTERNALDB_URL parameter.

   • KIE Server External Database Dialect (KIE_SERVER_EXTERNALDB_DIALECT): The Hibernate dialect for the server, depending on the server type. The common settings are:

     • org.hibernate.dialect.MySQL5InnoDBDialect
     • org.hibernate.dialect.MySQL8Dialect
     • org.hibernate.dialect.MariaDB102Dialect
     • org.hibernate.dialect.PostgreSQL95Dialect
     • org.hibernate.dialect.PostgresPlusDialect (used for EntrepriseDB Postgres Advanced Server)
     • org.hibernate.dialect.SQLServer2012Dialect (used for MS SQL)
     • org.hibernate.dialect.DB2Dialect
     • org.hibernate.dialect.Oracle10gDialect

     • org.hibernate.dialect.SybaseASE15Dialect

       For a complete list of supported dialects, see the Hibernate SQL Dialects table in Hibernate properties in the Red Hat JBoss EAP documentation.

   • KIE Server External Database name (KIE_SERVER_EXTERNALDB_DB): The database name to use on the external database server
   • JDBC Connection Checker class (KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER): The name of the JDBC connection checker class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.
   • JDBC Exception Sorter class (KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER): The name of the JDBC exception sorter class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.

2. If you created a custom image for using an external database server, as described in Section 7.10, “Building a custom KIE Server extension image for an external database”, set the following parameters:

   • Drivers Extension Image (EXTENSIONS_IMAGE): The ImageStreamTag definition of the extension image, for example, jboss-kie-db2-extension-openshift-image:11.1.4.4
   • Drivers ImageStream Namespace (EXTENSIONS_IMAGE_NAMESPACE): The namespace to which you uploaded the extension image, for example, openshift or your project namespace.

3. If you are using a MySQL version 8 external database server, enable the mysql_native_password plugin and use it for authentication. For instructions about this pluding, see Native Pluggable Authentication in the MySQL 8.0 Reference Manual.

   If you are using a MySQL version 8 image provided by Red Hat on Red Hat OpenShift Container Platform, to enable the plugin, set the MYSQL_DEFAULT_AUTHENTICATION_PLUGIN environment variable to mysql_native_password.

   If you created users on the MySQL version 8 server before enabling the mysql_native_password plugin, you must update the mysql-user table after you enable the plugin.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the rhpam711-immutable-monitor.yaml template file.

3. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the rhpam711-immutable-monitor.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/rhpam711-immutable-monitor.yaml -p BUSINESS_CENTRAL_HTTPS_SECRET=businesscentral-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • Business Central Monitoring Server Keystore Secret Name (BUSINESS_CENTRAL_HTTPS_SECRET): The name of the secret for Business Central, as created in Section 7.3, “Creating the secrets for Business Central”.
   • Smart Router Keystore Secret Name (KIE_SERVER_ROUTER_HTTPS_SECRET): The name of the secret for Smart Router, as created in Section 7.4, “Creating the secrets for Smart Router”.
   • Business Central Monitoring Server Certificate Name (BUSINESS_CENTRAL_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • Business Central Monitoring Server Keystore Password (BUSINESS_CENTRAL_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • Smart Router Certificate Name (KIE_SERVER_ROUTER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.4, “Creating the secrets for Smart Router”.
   • Smart Router Keystore Password (KIE_SERVER_ROUTER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.4, “Creating the secrets for Smart Router”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts.
   • Enable KIE server global discovery (KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED): Set this parameter to true if you want Business Central Monitoring to discover all KIE Servers with the OpenShiftStartupStrategy in the same namespace. By default, Business Central Monitoring discovers only KIE Servers that are deployed with the same value of the APPLICATION_NAME parameter as Business Central Monitoring itself.
   • Maven repository URL (MAVEN_REPO_URL): A URL for a Maven repository. You must upload all the processes (KJAR files) that are to be deployed on any KIE Servers in your environment into this repository.
   • Maven repository ID (MAVEN_REPO_ID): An identifier for the Maven repository. The default value is repo-custom.
   • Maven repository username (MAVEN_REPO_USERNAME): The user name for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The password for the Maven repository.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the client for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central Monitoring.
      • Business Central Monitoring RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string that is set in RH-SSO for the client for Business Central Monitoring.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The name of the client to create in RH-SSO for Business Central Monitoring.
      • Business Central Monitoring RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string to set in RH-SSO for the client for Business Central Monitoring.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the required template file.
3. By default, the template includes two KIE Servers. Each of the serves uses a PostgreSQL database server in a pod. To change the number of KIE Servers or to use a MySQL database server in a pod or an external database server, modify the template as described in Section 10.3, “Modifying the template for deploying an immutable KIE Server using S2I”.

4. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the <template-file-name>.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/<template-file-name>.yaml -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Replace <template-file-name> with the name of the template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for KIE Server, as created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts. You can deploy several applications using the same template into the same project, as long as you use different application names. Also, the application name determines the name of the server configuration (server template) that the KIE Server joins on Business Central or Business Central Monitoring. If you are deploying several KIE Servers, you must ensure each of the servers has a different application name.

   • KIE Server Container Deployment (KIE_SERVER_CONTAINER_DEPLOYMENT): The identifying information of the decision service (KJAR file) that the deployment must pull from the local or external repository after building your source. The format is <containerId>=<groupId>:<artifactId>:<version> or, if you want to specify an alias name for the container, <containerId>(<aliasId>)=<groupId>:<artifactId>:<version>. You can provide two or more KJAR files using the | separator, as illustrated in the following example:

     containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2

     To avoid duplicate container IDs, the artifact ID must be unique for each artifact built or used in your project.

   • Git Repository URL (SOURCE_REPOSITORY_URL): The URL for the Git repository that contains the source for your services.
   • Git Reference (SOURCE_REPOSITORY_REF): The branch in the Git repository.
   • Context Directory (CONTEXT_DIR): The path to the source within the project downloaded from the Git repository.
   • Artifact Directory (ARTIFACT_DIR): The path within the project that contains the required binary files (KJAR files and any other necessary files) after a successful Maven build. Normally this directory is the target directory of the build. However, you can provide prebuilt binaries in this directory in the Git repository.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • Name of the Business Central service (BUSINESS_CENTRAL_SERVICE): The OpenShift service name for the Business Central or Business Central Monitoring.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the client for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central or Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central or Business Central Monitoring.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The RH-SSO client name for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string that is set in RH-SSO for the client for KIE Server.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The name of the client to create in RH-SSO for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string to set in RH-SSO for the client for KIE Server.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Set the following parameters:

   • KIE Server External Database Driver (KIE_SERVER_EXTERNALDB_DRIVER): The driver for the server, depending on the server type:

     • mysql
     • postgresql
     • mariadb
     • mssql
     • db2
     • oracle
     • sybase
   • KIE Server External Database User (KIE_SERVER_EXTERNALDB_USER) and KIE Server External Database Password (KIE_SERVER_EXTERNALDB_PWD): The user name and password for the external database server

   • KIE Server External Database URL (KIE_SERVER_EXTERNALDB_URL): The JDBC URL for the external database server

     Note

     If you are using the EntrepriseDB Postgres database server, use an URL starting with jdbc:postgresql:// and not with jdbc:edb://. Alternatively, do not set the URL and set the host and port parameters instead.

   • KIE Server External Database Host (KIE_SERVER_EXTERNALDB_SERVICE_HOST) and KIE Server External Database Port (KIE_SERVER_EXTERNALDB_SERVICE_PORT): The host name and port number of the external database server. You can set these parameters as an alternative to setting the KIE_SERVER_EXTERNALDB_URL parameter.

   • KIE Server External Database Dialect (KIE_SERVER_EXTERNALDB_DIALECT): The Hibernate dialect for the server, depending on the server type. The common settings are:

     • org.hibernate.dialect.MySQL5InnoDBDialect
     • org.hibernate.dialect.MySQL8Dialect
     • org.hibernate.dialect.MariaDB102Dialect
     • org.hibernate.dialect.PostgreSQL95Dialect
     • org.hibernate.dialect.PostgresPlusDialect (used for EntrepriseDB Postgres Advanced Server)
     • org.hibernate.dialect.SQLServer2012Dialect (used for MS SQL)
     • org.hibernate.dialect.DB2Dialect
     • org.hibernate.dialect.Oracle10gDialect

     • org.hibernate.dialect.SybaseASE15Dialect

       For a complete list of supported dialects, see the Hibernate SQL Dialects table in Hibernate properties in the Red Hat JBoss EAP documentation.

   • KIE Server External Database name (KIE_SERVER_EXTERNALDB_DB): The database name to use on the external database server
   • JDBC Connection Checker class (KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER): The name of the JDBC connection checker class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.
   • JDBC Exception Sorter class (KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER): The name of the JDBC exception sorter class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.

2. If you created a custom image for using an external database server, as described in Section 7.10, “Building a custom KIE Server extension image for an external database”, set the following parameters:

   • Drivers Extension Image (EXTENSIONS_IMAGE): The ImageStreamTag definition of the extension image, for example, jboss-kie-db2-extension-openshift-image:11.1.4.4
   • Drivers ImageStream Namespace (EXTENSIONS_IMAGE_NAMESPACE): The namespace to which you uploaded the extension image, for example, openshift or your project namespace.

3. If you are using a MySQL version 8 external database server, enable the mysql_native_password plugin and use it for authentication. For instructions about this pluding, see Native Pluggable Authentication in the MySQL 8.0 Reference Manual.

   If you are using a MySQL version 8 image provided by Red Hat on Red Hat OpenShift Container Platform, to enable the plugin, set the MYSQL_DEFAULT_AUTHENTICATION_PLUGIN environment variable to mysql_native_password.

   If you created users on the MySQL version 8 server before enabling the mysql_native_password plugin, you must update the mysql-user table after you enable the plugin.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the required template file.

3. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the <template-file-name>.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/<template-file-name>.yaml -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Replace <template-file-name> with the name of the template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for KIE Server, as created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts. You can deploy several applications using the same template into the same project, as long as you use different application names. Also, the application name determines the name of the server configuration (server template) that the KIE Server joins on Business Central or Business Central Monitoring. If you are deploying several KIE Servers, you must ensure each of the servers has a different application name.
   • Maven repository URL (MAVEN_REPO_URL): A URL for a Maven repository. You must upload all the processes (KJAR files) that are to be deployed on the KIE Server into this repository.
   • Maven repository ID (MAVEN_REPO_ID): An identifier for the Maven repository. The default value is repo-custom.
   • Maven repository username (MAVEN_REPO_USERNAME): The user name for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The password for the Maven repository.

   • KIE Server Container Deployment (KIE_SERVER_CONTAINER_DEPLOYMENT): The identifying information of the decision services (KJAR files) that the deployment must pull from the Maven repository. The format is <containerId>=<groupId>:<artifactId>:<version> or, if you want to specify an alias name for the container, <containerId>(<aliasId>)=<groupId>:<artifactId>:<version>. You can provide two or more KJAR files using the | separator, as illustrated in the following example:

     containerId=groupId:artifactId:version|c2(alias2)=g2:a2:v2

   • KIE Server Mode (KIE_SERVER_MODE): In the rhpam711-kieserver-*.yaml templates the default value is PRODUCTION. In PRODUCTION mode, you cannot deploy SNAPSHOT versions of KJAR artifacts on the KIE Server and cannot change versions of an artifact in an existing container. To deploy a new version with PRODUCTION mode, create a new container on the same KIE Server. To deploy SNAPSHOT versions or to change versions of an artifact in an existing container, set this parameter to DEVELOPMENT.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • Name of the Business Central service (BUSINESS_CENTRAL_SERVICE): The OpenShift service name for the Business Central or Business Central Monitoring.

2. Ensure that the following settings are set to the same value as the same settings for the Business Central or Business Central Monitoring:

   • Maven repository URL (MAVEN_REPO_URL): A URL for the external Maven repository from which services must be deployed.
   • Maven repository username (MAVEN_REPO_USERNAME): The user name for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The password for the Maven repository.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the client for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central or Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central or Business Central Monitoring.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The RH-SSO client name for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string that is set in RH-SSO for the client for KIE Server.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The name of the client to create in RH-SSO for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string to set in RH-SSO for the client for KIE Server.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Set the following parameters:

   • KIE Server External Database Driver (KIE_SERVER_EXTERNALDB_DRIVER): The driver for the server, depending on the server type:

     • mysql
     • postgresql
     • mariadb
     • mssql
     • db2
     • oracle
     • sybase
   • KIE Server External Database User (KIE_SERVER_EXTERNALDB_USER) and KIE Server External Database Password (KIE_SERVER_EXTERNALDB_PWD): The user name and password for the external database server

   • KIE Server External Database URL (KIE_SERVER_EXTERNALDB_URL): The JDBC URL for the external database server

     Note

     If you are using the EntrepriseDB Postgres database server, use an URL starting with jdbc:postgresql:// and not with jdbc:edb://. Alternatively, do not set the URL and set the host and port parameters instead.

   • KIE Server External Database Host (KIE_SERVER_EXTERNALDB_SERVICE_HOST) and KIE Server External Database Port (KIE_SERVER_EXTERNALDB_SERVICE_PORT): The host name and port number of the external database server. You can set these parameters as an alternative to setting the KIE_SERVER_EXTERNALDB_URL parameter.

   • KIE Server External Database Dialect (KIE_SERVER_EXTERNALDB_DIALECT): The Hibernate dialect for the server, depending on the server type. The common settings are:

     • org.hibernate.dialect.MySQL5InnoDBDialect
     • org.hibernate.dialect.MySQL8Dialect
     • org.hibernate.dialect.MariaDB102Dialect
     • org.hibernate.dialect.PostgreSQL95Dialect
     • org.hibernate.dialect.PostgresPlusDialect (used for EntrepriseDB Postgres Advanced Server)
     • org.hibernate.dialect.SQLServer2012Dialect (used for MS SQL)
     • org.hibernate.dialect.DB2Dialect
     • org.hibernate.dialect.Oracle10gDialect

     • org.hibernate.dialect.SybaseASE15Dialect

       For a complete list of supported dialects, see the Hibernate SQL Dialects table in Hibernate properties in the Red Hat JBoss EAP documentation.

   • KIE Server External Database name (KIE_SERVER_EXTERNALDB_DB): The database name to use on the external database server
   • JDBC Connection Checker class (KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER): The name of the JDBC connection checker class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.
   • JDBC Exception Sorter class (KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER): The name of the JDBC exception sorter class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.

2. If you created a custom image for using an external database server, as described in Section 7.10, “Building a custom KIE Server extension image for an external database”, set the following parameters:

   • Drivers Extension Image (EXTENSIONS_IMAGE): The ImageStreamTag definition of the extension image, for example, jboss-kie-db2-extension-openshift-image:11.1.4.4
   • Drivers ImageStream Namespace (EXTENSIONS_IMAGE_NAMESPACE): The namespace to which you uploaded the extension image, for example, openshift or your project namespace.

3. If you are using a MySQL version 8 external database server, enable the mysql_native_password plugin and use it for authentication. For instructions about this pluding, see Native Pluggable Authentication in the MySQL 8.0 Reference Manual.

   If you are using a MySQL version 8 image provided by Red Hat on Red Hat OpenShift Container Platform, to enable the plugin, set the MYSQL_DEFAULT_AUTHENTICATION_PLUGIN environment variable to mysql_native_password.

   If you created users on the MySQL version 8 server before enabling the mysql_native_password plugin, you must update the mysql-user table after you enable the plugin.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the rhpam711-managed.yaml template file.

3. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the rhpam711-managed.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/rhpam711-managed.yaml -p BUSINESS_CENTRAL_HTTPS_SECRET=businesscentral-app-secret -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • Business Central Monitoring Server Keystore Secret Name (BUSINESS_CENTRAL_HTTPS_SECRET): The name of the secret for Business Central, as created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for KIE Server, as created in Section 7.2, “Creating the secrets for KIE Server”.
   • Business Central Monitoring Server Certificate Name (BUSINESS_CENTRAL_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • Business Central Monitoring Server Keystore Password (BUSINESS_CENTRAL_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts.
   • Enable KIE server global discovery (KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED): Set this parameter to true if you want Business Central Monitoring to discover all KIE Servers with the OpenShiftStartupStrategy in the same namespace. By default, Business Central Monitoring discovers only KIE Servers that are deployed with the same value of the APPLICATION_NAME parameter as Business Central Monitoring itself.
   • Maven repository URL (MAVEN_REPO_URL): A URL for a Maven repository. You must upload all the processes (KJAR files) that are to be deployed on any KIE Servers in your environment into this repository.
   • Maven repository ID (MAVEN_REPO_ID): An identifier for the Maven repository. The default value is repo-custom.
   • Maven repository username (MAVEN_REPO_USERNAME): The user name for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The password for the Maven repository.
   • KIE Server Mode (KIE_SERVER_MODE): In the rhpam711-managed.yaml template the default value is PRODUCTION. In PRODUCTION mode, you cannot deploy SNAPSHOT versions of KJAR artifacts on the KIE Server and cannot change versions of an artifact in an existing container. To deploy a new version with PRODUCTION mode, create a new container on the same KIE Server. To deploy SNAPSHOT versions or to change versions of an artifact in an existing container, set this parameter to DEVELOPMENT.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central Monitoring.
      • Business Central Monitoring RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string that is set in RH-SSO for the client for Business Central Monitoring.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The RH-SSO client name for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string that is set in RH-SSO for the client for KIE Server.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The name of the client to create in RH-SSO for Business Central Monitoring.
      • Business Central Monitoring RH-SSO Client Secret (BUSINESS_CENTRAL_SSO_SECRET): The secret string to set in RH-SSO for the client for Business Central Monitoring.
      • KIE Server RH-SSO Client name (KIE_SERVER_SSO_CLIENT): The name of the client to create in RH-SSO for KIE Server.
      • KIE Server RH-SSO Client Secret (KIE_SERVER_SSO_SECRET): The secret string to set in RH-SSO for the client for KIE Server.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the {template_name} template file.

3. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the {template_name} file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/{template_name}  -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • Name of the Business Central service (BUSINESS_CENTRAL_SERVICE): The OpenShift service name for the Business Central Monitoring.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central Monitoring.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.

Procedure

1. Set the AUTH_LDAP* parameters of the template. These parameters correspond to the settings of the LdapExtended Login module of Red Hat JBoss EAP. For instructions about using these settings, see LdapExtended login module.

   Note

   If you want to enable LDAP failover, you can put set or more LDAP server addresses in the AUTH_LDAP_URL parameter, separated by a space.

   If the LDAP server does not define all the roles required for your deployment, you can map LDAP groups to Red Hat Process Automation Manager roles. To enable LDAP role mapping, set the following parameters:

   • RoleMapping rolesProperties file path (AUTH_ROLE_MAPPER_ROLES_PROPERTIES): The fully qualified path name of a file that defines role mapping, for example, /opt/eap/standalone/configuration/rolemapping/rolemapping.properties. You must provide this file and mount it at this path in all applicable deployment configurations; for instructions, see Section 13.3, “(Optional) Providing the LDAP role mapping file”.
   • RoleMapping replaceRole property (AUTH_ROLE_MAPPER_REPLACE_ROLE): If set to true, mapped roles replace the roles defined on the LDAP server; if set to false, both mapped roles and roles defined on the LDAP server are set as user application roles. The default setting is false.

Procedure

1. Set the following parameters:

   • KIE Server External Database Driver (KIE_SERVER_EXTERNALDB_DRIVER): The driver for the server, depending on the server type:

     • mysql
     • postgresql
     • mariadb
     • mssql
     • db2
     • oracle
     • sybase
   • KIE Server External Database User (KIE_SERVER_EXTERNALDB_USER) and KIE Server External Database Password (KIE_SERVER_EXTERNALDB_PWD): The user name and password for the external database server

   • KIE Server External Database URL (KIE_SERVER_EXTERNALDB_URL): The JDBC URL for the external database server

     Note

     If you are using the EntrepriseDB Postgres database server, use an URL starting with jdbc:postgresql:// and not with jdbc:edb://. Alternatively, do not set the URL and set the host and port parameters instead.

   • KIE Server External Database Host (KIE_SERVER_EXTERNALDB_SERVICE_HOST) and KIE Server External Database Port (KIE_SERVER_EXTERNALDB_SERVICE_PORT): The host name and port number of the external database server. You can set these parameters as an alternative to setting the KIE_SERVER_EXTERNALDB_URL parameter.

   • KIE Server External Database Dialect (KIE_SERVER_EXTERNALDB_DIALECT): The Hibernate dialect for the server, depending on the server type. The common settings are:

     • org.hibernate.dialect.MySQL5InnoDBDialect
     • org.hibernate.dialect.MySQL8Dialect
     • org.hibernate.dialect.MariaDB102Dialect
     • org.hibernate.dialect.PostgreSQL95Dialect
     • org.hibernate.dialect.PostgresPlusDialect (used for EntrepriseDB Postgres Advanced Server)
     • org.hibernate.dialect.SQLServer2012Dialect (used for MS SQL)
     • org.hibernate.dialect.DB2Dialect
     • org.hibernate.dialect.Oracle10gDialect

     • org.hibernate.dialect.SybaseASE15Dialect

       For a complete list of supported dialects, see the Hibernate SQL Dialects table in Hibernate properties in the Red Hat JBoss EAP documentation.

   • KIE Server External Database name (KIE_SERVER_EXTERNALDB_DB): The database name to use on the external database server
   • JDBC Connection Checker class (KIE_SERVER_EXTERNALDB_CONNECTION_CHECKER): The name of the JDBC connection checker class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.
   • JDBC Exception Sorter class (KIE_SERVER_EXTERNALDB_EXCEPTION_SORTER): The name of the JDBC exception sorter class for the database server. Without this information, a database server connection cannot be restored after it is lost, for example, if the database server is rebooted.

2. If you created a custom image for using an external database server, as described in Section 7.10, “Building a custom KIE Server extension image for an external database”, set the following parameters:

   • Drivers Extension Image (EXTENSIONS_IMAGE): The ImageStreamTag definition of the extension image, for example, jboss-kie-db2-extension-openshift-image:11.1.4.4
   • Drivers ImageStream Namespace (EXTENSIONS_IMAGE_NAMESPACE): The namespace to which you uploaded the extension image, for example, openshift or your project namespace.

3. If you are using a MySQL version 8 external database server, enable the mysql_native_password plugin and use it for authentication. For instructions about this pluding, see Native Pluggable Authentication in the MySQL 8.0 Reference Manual.

   If you are using a MySQL version 8 image provided by Red Hat on Red Hat OpenShift Container Platform, to enable the plugin, set the MYSQL_DEFAULT_AUTHENTICATION_PLUGIN environment variable to mysql_native_password.

   If you created users on the MySQL version 8 server before enabling the mysql_native_password plugin, you must update the mysql-user table after you enable the plugin.

Procedure

1. Download the rhpam-7.11.0-openshift-templates.zip product deliverable file from the Software Downloads page of the Red Hat Customer Portal.
2. Extract the rhpam711-prod.yaml template file.
3. By default, the template includes two KIE Servers. Each of the serves uses a PostgreSQL database server in a pod. To change the number of KIE Servers or to use a MySQL database server in a pod or an external database server, modify the template as described in Section 12.2, “Modifying a template for a fixed managed environment”.

4. Use one of the following methods to start deploying the template:

   • To use the OpenShift Web UI, in the OpenShift application console select Add to Project → Import YAML / JSON and then select or paste the rhpam711-prod.yaml file. In the Add Template window, ensure Process the template is selected and click Continue.

   • To use the OpenShift command line console, prepare the following command line:

     oc new-app -f <template-path>/rhpam711-prod.yaml -p BUSINESS_CENTRAL_HTTPS_SECRET=businesscentral-app-secret -p KIE_SERVER_HTTPS_SECRET=kieserver-app-secret -p PARAMETER=value

     In this command line, make the following changes:

     • Replace <template-path> with the path to the downloaded template file.
     • Use as many -p PARAMETER=value pairs as needed to set the required parameters.

Procedure

1. Set the following parameters:

   • Credentials secret (CREDENTIALS_SECRET): The name of the secret containing the administrative user credentials, as created in Section 7.5, “Creating the secret for the administrative user”.
   • Business Central Monitoring Server Keystore Secret Name (BUSINESS_CENTRAL_HTTPS_SECRET): The name of the secret for Business Central, as created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Keystore Secret Name (KIE_SERVER_HTTPS_SECRET): The name of the secret for KIE Server, as created in Section 7.2, “Creating the secrets for KIE Server”.
   • Smart Router Keystore Secret Name (KIE_SERVER_ROUTER_HTTPS_SECRET): The name of the secret for Smart Router, as created in Section 7.4, “Creating the secrets for Smart Router”.
   • Business Central Monitoring Server Certificate Name (BUSINESS_CENTRAL_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • Business Central Monitoring Server Keystore Password (BUSINESS_CENTRAL_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.3, “Creating the secrets for Business Central”.
   • KIE Server Certificate Name (KIE_SERVER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • KIE Server Keystore Password (KIE_SERVER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.2, “Creating the secrets for KIE Server”.
   • Smart Router Certificate Name (KIE_SERVER_ROUTER_HTTPS_NAME): The name of the certificate in the keystore that you created in Section 7.4, “Creating the secrets for Smart Router”.
   • Smart Router Keystore Password (KIE_SERVER_ROUTER_HTTPS_PASSWORD): The password for the keystore that you created in Section 7.4, “Creating the secrets for Smart Router”.
   • Application Name (APPLICATION_NAME): The name of the OpenShift application. It is used in the default URLs for Business Central Monitoring and KIE Server. OpenShift uses the application name to create a separate set of deployment configurations, services, routes, labels, and artifacts. You can deploy several applications using the same template into the same project, as long as you use different application names. Also, the application name determines the name of the server configuration (server template) that the KIE Server joins on Business Central Monitoring. If you are deploying several KIE Servers, you must ensure each of the servers has a different application name.
   • Maven repository URL (MAVEN_REPO_URL): A URL for a Maven repository. You must upload all the processes (KJAR files) that are to be deployed on the KIE Server into this repository.
   • Maven repository ID (MAVEN_REPO_ID): An identifier for the Maven repository. The default value is repo-custom.
   • Maven repository username (MAVEN_REPO_USERNAME): The user name for the Maven repository.
   • Maven repository password (MAVEN_REPO_PASSWORD): The password for the Maven repository.
   • KIE Server Mode (KIE_SERVER_MODE): In the rhpam711-kieserver-*.yaml templates the default value is PRODUCTION. In PRODUCTION mode, you cannot deploy SNAPSHOT versions of KJAR artifacts on the KIE Server and cannot change versions of an artifact in an existing container. To deploy a new version with PRODUCTION mode, create a new container on the same KIE Server. To deploy SNAPSHOT versions or to change versions of an artifact in an existing container, set this parameter to DEVELOPMENT.
   • ImageStream Namespace (IMAGE_STREAM_NAMESPACE): The namespace where the image streams are available. If the image streams were already available in your OpenShift environment (see Section 7.1, “Ensuring the availability of image streams and the image registry”), the namespace is openshift. If you have installed the image streams file, the namespace is the name of the OpenShift project.

Procedure

1. Set the following parameters:

   • RH-SSO URL (SSO_URL): The URL for RH-SSO.
   • RH-SSO Realm name (SSO_REALM): The RH-SSO realm for Red Hat Process Automation Manager.
   • RH-SSO Disable SSL Certificate Validation (SSO_DISABLE_SSL_CERTIFICATE_VALIDATION): Set to true if your RH-SSO installation does not use a valid HTTPS certificate.

2. Complete one of the following procedures:

   1. If you created the client for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • Business Central Monitoring RH-SSO Client name (BUSINESS_CENTRAL_SSO_CLIENT): The RH-SSO client name for Business Central Monitoring.

      • For each KIE Server defined in the template:

        • KIE Server n RH-SSO Client name (KIE_SERVERn_SSO_CLIENT): The RH-SSO client name for this KIE Server.
        • KIE Server n RH-SSO Client Secret (KIE_SERVERn_SSO_SECRET): The secret string that is set in RH-SSO for the client for this KIE Server.

   2. To create the clients for Red Hat Process Automation Manager within RH-SSO, set the following parameters in the template:

      • For each KIE Server defined in the template:

        • KIE Server n RH-SSO Client name (KIE_SERVERn_SSO_CLIENT): The name of the client to create in RH-SSO for this KIE Server.
        • KIE Server n RH-SSO Client Secret (KIE_SERVERn_SSO_SECRET): The secret string to set in RH-SSO for the client for this KIE Server.
      • RH-SSO Realm Admin Username (SSO_USERNAME) and RH-SSO Realm Admin Password (SSO_PASSWORD): The user name and password for the realm administrator user for the RH-SSO realm for Red Hat Process Automation Manager. You must provide this user name and password in order to create the required clients.