Chapter 3. Preparing to deploy Red Hat Process Automation Manager in your OpenShift environment
Before deploying Red Hat Process Automation Manager in your OpenShift environment, you must complete several tasks. You do not need to repeat these tasks if you want to deploy additional images, for example, for new versions of processes or for other processes.
3.1. Ensuring your environment is authenticated to the Red Hat registry
To deploy Red Hat Process Automation Manager components of Red Hat OpenShift Container Platform, you must ensure that OpenShift can download the correct images from the Red Hat registry.
OpenShift must be configured to authenticate with the Red Hat registry using your service account user name and password. This configuration is specific for a namespace, and if operators work, the configuration is already completed for the openshift
namespace.
However, if the image streams for Red Hat Process Automation Manager are not found in the openshift
namespace or if the operator is configured to update Red Hat Process Automation Manager to a new version automatically, the operator needs to download images into the namespace of your project. You must complete the authentication configuration for this namespace.
Procedure
-
Ensure you are logged in to OpenShift with the
oc
command and that your project is active. - Complete the steps documented in Registry Service Accounts for Shared Environments. You must log in to Red Hat Customer Portal to access the document and to complete the steps to create a registry service account.
- Select the OpenShift Secret tab and click the link under Download secret to download the YAML secret file.
-
View the downloaded file and note the name that is listed in the
name:
entry. Run the following commands:
oc create -f <file_name>.yaml oc secrets link default <secret_name> --for=pull oc secrets link builder <secret_name> --for=pull
Replace
<file_name>
with the name of the downloaded file and<secret_name>
with the name that is listed in thename:
entry of the file.
3.2. Creating the secrets for KIE Server
OpenShift uses objects called secrets to hold sensitive information such as passwords or keystores. For more information about OpenShift secrets, see What is a secret in the Red Hat OpenShift Container Platform documentation.
In order to provide HTTPS access, KIE Server uses an SSL certificate. The deployment can create a sample secret automatically. However, in production environments you must create an SSL certificate for KIE Server and provide it to your OpenShift environment as a secret.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for KIE Server. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for KIE Server.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedkieserver-app-secret
from the new keystore file:$ oc create secret generic kieserver-app-secret --from-file=keystore.jks
3.3. Creating the secrets for Business Central
In order to provide HTTPS access, Business Central uses an SSL certificate. The deployment can create a sample secret automatically. However, in production environments you must create an SSL certificate for Business Central and provide it to your OpenShift environment as a secret.
Do not use the same certificate and keystore for Business Central and KIE Server.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Business Central. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Business Central.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedbusinesscentral-app-secret
from the new keystore file:$ oc create secret generic businesscentral-app-secret --from-file=keystore.jks
3.4. Creating the secrets for the AMQ broker connection
If you want to connect any KIE Server to an AMQ broker and to use SSL for the AMQ broker connection, you must create an SSL certificate for the connection and provide it to your OpenShift environment as a secret.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for the AMQ broker connection. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for the AMQ broker connection.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedbroker-app-secret
from the new keystore file:$ oc create secret generic broker-app-secret --from-file=keystore.jks
3.5. Creating the secrets for Smart Router
In order to provide HTTPS access, Smart Router uses an SSL certificate. The deployment can create a sample secret automatically. However, in production environments you must create an SSL certificate for Smart Router and provide it to your OpenShift environment as a secret.
Do not use the same certificate and keystore for Smart Router as the ones used for KIE Server or Business Central.
Procedure
Generate an SSL keystore with a private and public key for SSL encryption for Smart Router. For more information on how to create a keystore with self-signed or purchased SSL certificates, see Generate a SSL Encryption Key and Certificate.
NoteIn a production environment, generate a valid signed certificate that matches the expected URL for Smart Router.
-
Save the keystore in a file named
keystore.jks
. -
Record the name of the certificate. The default value for this name in Red Hat Process Automation Manager configuration is
jboss
. -
Record the password of the keystore file. The default value for this name in Red Hat Process Automation Manager configuration is
mykeystorepass
. Use the
oc
command to generate a secret namedsmartrouter-app-secret
from the new keystore file:$ oc create secret generic smartrouter-app-secret --from-file=keystore.jks
3.6. Building a custom KIE Server extension image for an external database
If you want to use an external database server for a KIE Server and the database server is not a MySQL or PostgreSQL server, you must build a custom KIE Server extension image with drivers for this server before deploying your environment.
Complete the steps in this build procedure to provide drivers for any of the following database servers:
- Microsoft SQL Server
- IBM DB2
- Oracle Database
- Sybase
Optionally, you can use this procedure to build a new version of drivers for any of the following database servers:
- MySQL
- MariaDB
- PostgreSQL
For the supported versions of the database servers, see Red Hat Process Automation Manager 7 Supported Configurations.
The build procedure creates a custom extension image that extends the existing KIE Server image. You must import this custom extension image into your OpenShift environment and then reference it in the EXTENSIONS_IMAGE
parameter.
Prerequisites
-
You are logged in to your OpenShift environment using the
oc
command. Your OpenShift user must have theregistry-editor
role. - For Oracle Database, IBM DB2, or Sybase, you downloaded the JDBC driver from the database server vendor.
You have installed the following required software:
- Docker: For installation instructions, see Get Docker.
- Cekit version 3.2: For installation instructions, see Installation.
The following libraries and extensions for Cekit. For more information, see Dependencies.
-
docker
, provided by thepython3-docker
package or similar package -
docker-squash
, provided by thepython3-docker-squash
package or similar package -
behave
, provided by thepython3-behave
package or similar package
-
Procedure
- For IBM DB2, Oracle Database, or Sybase, provide the JDBC driver JAR file in a local directory.
-
Download the
rhpam-7.8.0-openshift-templates.zip
product deliverable file from the Software Downloads page of the Red Hat Customer Portal. -
Unzip the file and, using the command line, change to the
templates/contrib/jdbc/cekit
directory of the unzipped file. This directory contains the source code for the custom build. Enter one of the following commands, depending on the database server type:
For Microsoft SQL Server:
make mssql
For MySQL:
make mysql
For PostgreSQL:
make postgresql
For MariaDB:
make mariadb
For IBM DB2:
make db2 artifact=/tmp/db2jcc4.jar version=10.2
In this command, replace
/tmp/db2jcc4.jar
with the path name of the IBM DB2 driver and10.2
with the version of the driver.For Oracle Database:
make oracle artifact=/tmp/ojdbc7.jar version=7.0
In this command, replace
/tmp/ojdbc7.jar
with the path name of the Oracle Database driver and7.0
with the version of the driver.For Sybase:
make build sybase artifact=/tmp/jconn4-16.0_PL05.jar version=16.0_PL05
In this command, replace
/tmp/jconn4-16.0_PL05.jar
with the path name of the downloaded Sybase driver and16.0_PL05
with the version of the driver.Alternatively, if you need to update the driver class or driver XA class for the Sybase driver, you can set the
DRIVER_CLASS
orDRIVER_XA_CLASS
variable for this command, for example:export DRIVER_CLASS=another.class.Sybase && make sybase artifact=/tmp/jconn4-16.0_PL05.jar version=16.0_PL05
Enter the following command to list the Docker images that are available locally:
docker images
Note the name of the image that was built, for example,
jboss-kie-db2-extension-openshift-image
, and the version tag of the image, for example,11.1.4.4
(not thelatest
tag).-
Access the registry of your OpenShift environment directly and push the image to the registry. Depending on your user permissions, you can push the image into the
openshift
namespace or into a project namespace. For instructions about accessing the registry and pushing the images, see Accessing registry directly from the cluster in the Red Hat OpenShift Container Platform product documentation.
3.7. Preparing Git hooks
In an authoring environment you can use Git hooks to execute custom operations when the source code of a project in Business Central is changed. The typical use of Git hooks is for interaction with an upstream repository.
To enable Git hooks to interact with an upstream repository using SSH authentication, you must also provide a secret key and a known hosts file for authentication with the repository.
Skip this procedure if you do not want to configure Git hooks.
Procedure
Create the Git hooks files. For instructions, see the Git hooks reference documentation.
NoteA
pre-commit
script is not supported in Business Central. Use apost-commit
script.Create a configuration map (ConfigMap) or persistent volume with the files.
If the Git hooks consist of one or several fixed script files, use the
oc
command to create a configuration map. For example:oc create configmap git-hooks --from-file=post-commit=post-commit
If the Git hooks consist of long files or depend on binaries, such as executable or JAR files, use a persistent volume. You must create a persistent volume, create a persistent volume claim and associate the volume with the claim, and transfer files to the volume.
For instructions about persistent volumes and persistent volume claims, see Storage in the Red Hat OpenShift Container Platform documentation. For instructions about copying files onto a persistent volume, see Transferring files in and out of containers.
If the Git hooks scripts must interact with an upstream repository using SSH authentication, prepare a secret with the necessary files:
-
Prepare the
id_rsa
file with a private key that matches a public key stored in the repository. -
Prepare the
known_hosts
file with the correct name, address, and public key for the repository. Create a secret with the two files using the
oc
command, for example:oc create secret git-hooks-secret --from-file=id_rsa=id_rsa --from-file=known_hosts=known_hosts
NoteWhen the deployment uses this secret, it mounts the
id_rsa
andknown_hosts
files into the/home/jboss/.ssh
directory on Business Central pods.
-
Prepare the
3.8. Provisioning persistent volumes with ReadWriteMany
access mode using NFS
If you want to deploy Business Central Monitoring or high-availability Business Central, your environment must provision persistent volumes with ReadWriteMany
access mode.
If your configuration requires provisioning persistent volumes with ReadWriteMany
access mode but your environment does not support such provisioning, use NFS to provision the volumes. Otherwise, skip this procedure.
Procedure
Deploy an NFS server and provision the persistent volumes using NFS. For information about provisioning persistent volumes using NFS, see the "Persistent storage using NFS" section of the OpenShift Container Platform 4.3 Storage guide.
3.9. Extracting the source code from Business Central for use in an S2I build
If you are planning to create immutable KIE servers using the source-to-image (S2I) process, you must provide the source code for your services in a Git repository. If you are using Business Central for authoring services, you can extract the source code for your service and place it into a separate Git repository, such as GitHub or an on-premise installation of GitLab, for use in the S2I build.
Skip this procedure if you are not planning to use the S2I process or if you are not using Business Central for authoring services.
Procedure
Use the following command to extract the source code:
git clone https://<business-central-host>:443/git/<MySpace>/<MyProject>
In this command, replace the following variables:
-
<business-central-host>
with the host on which Business Central is running -
<MySpace>
with the name of the Business Central space in which the project is located -
<MyProject>
with the name of the project
NoteTo view the full Git URL for a project in Business Central, click Menu
Design <MyProject> Settings. NoteIf you are using self-signed certificates for HTTPS communication, the command might fail with an
SSL certificate problem
error message. In this case, disable SSL certificate verification ingit
, for example, using theGIT_SSL_NO_VERIFY
environment variable:env GIT_SSL_NO_VERIFY=true git clone https://<business-central-host>:443/git/<MySpace>/<MyProject>
-
- Upload the source code to another Git repository, such as GitHub or GitLab, for the S2I build.
3.10. Preparing for deployment in a restricted network
You can deploy Red Hat Process Automation Manager in a restricted network that is not connected to the public Internet. For instructions about operator deployment in a restricted network, see Using Operator Lifecycle Manager on restricted networks in Red Hat OpenShift Container Platform documentation.
In Red Hat Process Automation Manager 7.8, deployment on restricted networks is for Technology Preview only. For more information on Red Hat Technology Preview features, see Technology Preview Features Scope.
In order to use a deployment that does not have outgoing access to the public Internet, you must also prepare a Maven repository with a mirror of all the necessary artifacts. For instructions about creating this repository, see Section 3.11, “Preparing a Maven mirror repository for offline use”.
3.11. Preparing a Maven mirror repository for offline use
If your Red Hat OpenShift Container Platform environment does not have outgoing access to the public Internet, you must prepare a Maven repository with a mirror of all the necessary artifacts and make this repository available to your environment.
You do not need to complete this procedure if your Red Hat OpenShift Container Platform environment is connected to the Internet.
Prerequisites
- A computer that has outgoing access to the public Internet is available.
Procedure
Configure a Maven release repository to which you have write access. The repository must allow read access without authentication and your OpenShift environment must have network access to this repository.
You can deploy a Nexus repository manager in the OpenShift environment. For instructions about setting up Nexus on OpenShift, see Setting up Nexus in the Red Hat OpenShift Container Platform 3.11 documentation. The documented procedure is applicable to Red Hat OpenShift Container Platform version 4. Use this repository as a separate mirror repository.
Alternatively, if you use a custom external repository (for example, Nexus) for your services, you can use the same repository as a mirror repository.
On the computer that has an outgoing connection to the public Internet, complete the following steps:
-
Click Red Hat Process Automation Manager 7.8.0 Offliner Content List to download the
rhpam-7.8.0-offliner.zip
product deliverable file from the Software Downloads page of the Red Hat Customer Portal. -
Extract the contents of the
rhpam-7.8.0-offliner.zip
file into any directory. Change to the directory and enter the following command:
./offline-repo-builder.sh offliner.txt
This command creates a
repository
subdirectory and downloads the necessary artifacts into this subdirectory.If a message reports that some downloads have failed, run the same command again. If downloads fail again, contact Red Hat support.
-
Upload all artifacts from the
repository
subdirectory to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility, available from the Maven repository tools Git repository, to upload the artifacts.
-
Click Red Hat Process Automation Manager 7.8.0 Offliner Content List to download the
If you developed services outside Business Central and they have additional dependencies, add the dependencies to the mirror repository. If you developed the services as Maven projects, you can use the following steps to prepare these dependencies automatically. Complete the steps on the computer that has an outgoing connection to the public Internet.
-
Create a backup of the local Maven cache directory (
~/.m2/repository
) and then clear the directory. -
Build the source of your projects using the
mvn clean install
command. For every project, enter the following command to ensure that Maven downloads all runtime dependencies for all the artifacts generated by the project:
mvn -e -DskipTests dependency:go-offline -f /path/to/project/pom.xml --batch-mode -Djava.net.preferIPv4Stack=true
Replace
/path/to/project/pom.xml
with the correct path to thepom.xml
file of the project.-
Upload all artifacts from the local Maven cache directory (
~/.m2/repository
) to the Maven mirror repository that you prepared. You can use the Maven Repository Provisioner utility, available from the Maven repository tools Git repository, to upload the artifacts.
-
Create a backup of the local Maven cache directory (