Chapter 8. Reference

adminUser*

Administrator user name required for connecting to the broker and management console.

If you do not specify a value, the value is automatically generated and stored in a secret. The default secret name has a format of <custom_resource_name>-credentials-secret. For example, my-broker-deployment-credentials-secret.

Type: string

Example: my-user

Default value: Automatically-generated, random value

adminPassword*

Administrator password required for connecting to the broker and management console.

If you do not specify a value, the value is automatically generated and stored in a secret. The default secret name has a format of <custom_resource_name>-credentials-secret. For example, my-broker-deployment-credentials-secret.

Type: string

Example: my-password

Default value: Automatically-generated, random value

deploymentPlan*

Broker deployment configuration

image*

Full path of the broker container image used for each broker in the deployment.

You do not need to explicitly specify a value for image in your CR. The default value of placeholder indicates that the Operator has not yet determined the appropriate image to use.

To learn how the Operator chooses a broker container image to use, see Section 2.4, “How the Operator chooses container images”.

Type: string

Example: registry.redhat.io/amq7/amq-broker-rhel8@sha256:71aef8faa1c661212ef8a7ef450656a250d95b51d33d1ce77f12ece27cdb9442

Default value: placeholder

size*

Number of broker Pods to create in the deployment.

If you specify a value of 2 or greater, your broker deployment is clustered by default. The cluster user name and password are automatically generated and stored in the same secret as adminUser and adminPassword, by default.

Type: int

Example: 1

Default value: 2

requireLogin

Specify whether login credentials are required to connect to the broker.

Type: Boolean

Example: false

Default value: true

persistenceEnabled

Specify whether to use journal storage for each broker Pod in the deployment. If set to true, each broker Pod requires an available Persistent Volume (PV) that the Operator can claim using a Persistent Volume Claim (PVC).

Type: Boolean

Example: false

Default value: true

initImage

Init Container image used to configure the broker.

You do not need to explicitly specify a value for initImage in your CR, unless you want to provide a custom image.

To learn how the Operator chooses a built-in Init Container image to use, see Section 2.4, “How the Operator chooses container images”.

To learn how to specify a custom Init Container image, see Section 4.6, “Specifying a custom Init Container image”.

Type: string

Example: registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:d327d358e6cfccac14becc486bce643e34970ecfc6c4d187a862425867a9ac8a

Default value: Not specified

journalType

Specify whether to use asynchronous I/O (AIO) or non-blocking I/O (NIO).

Type: string

Example: aio

Default value: nio

messageMigration

When a broker Pod shuts down due to a failure or intentional scaledown of the broker deployment, specify whether to migrate messages to another broker Pod that is still running in the broker cluster.

Type: Boolean

Example: false

Default value: true

resources.limits.cpu

Maximum amount of host-node CPU, in millicores, that each broker container running in a Pod in a deployment can consume.

Type: string

Example: "500m"

Default value: Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator.

resources.limits.memory

Maximum amount of host-node memory, in bytes, that each broker container running in a Pod in a deployment can consume. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi).

Type: string

Example: "1024M"

Default value: Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator.

resources.requests.cpu

Amount of host-node CPU, in millicores, that each broker container running in a Pod in a deployment explicitly requests.

Type: string

Example: "250m"

Default value: Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator.

resources.requests.memory

Amount of host-node memory, in bytes, that each broker container running in a Pod in a deployment explicitly requests. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi).

Type: string

Example: "512M"

Default value: Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator.

storage.size

Size, in bytes, of the Persistent Volume Claim (PVC) that each broker in a deployment requires for persistent storage. This property applies only when persistenceEnabled is set to true. The value that you specify must include a unit. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi).

Type: string

Example: 4Gi

Default value: 2Gi

jolokiaAgentEnabled

Specifies whether the Jolokia JVM Agent is enabled for the brokers in the deployment. If the value of this property is set to true, Fuse Console can discover and display runtime data for the brokers.

Type: Boolean

Example: true

Default value: false

managementRBACEnabled

Specifies whether role-based access control (RBAC) is enabled for the brokers in the deployment. To use Fuse Console, you must set the value to false, because Fuse Console uses its own role-based access control.

Type: Boolean

Example: false

Default value: true

console

Configuration of broker management console.

expose

Specify whether to expose the management console port for each broker in a deployment.

Type: Boolean

Example: true

Default value: false

sslEnabled

Specify whether to use SSL on the management console port.

Type: Boolean

Example: true

Default value: false

sslSecret

Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored. If you do not specify a value for sslSecret, the console uses a default secret name. The default secret name is in the form of <custom_resource_name>-console-secret.

Type: string

Example: my-broker-deployment-console-secret

Default value: Not specified

useClientAuth

Specify whether the management console requires client authorization.

Type: Boolean

Example: true

Default value: false

acceptors.acceptor

A single acceptor configuration instance.

name*

Name of acceptor.

Type: string

Example: my-acceptor

Default value: Not applicable

port

Port number to use for the acceptor instance.

Type: int

Example: 5672

Default value: 61626 for the first acceptor that you define. The default value then increments by 10 for every subsequent acceptor that you define.

protocols

Messaging protocols to be enabled on the acceptor instance.

Type: string

Example: amqp,core

Default value: all

sslEnabled

Specify whether SSL is enabled on the acceptor port. If set to true, look in the secret name specified in sslSecret for the credentials required by TLS/SSL.

Type: Boolean

Example: true

Default value: false

sslSecret

Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored.

If you do not specify a custom secret name for sslSecret, the acceptor assumes a default secret name. The default secret name has a format of <custom_resource_name>-<acceptor_name>-secret.

You must always create this secret yourself, even when the acceptor assumes a default name.

Type: string

Example: my-broker-deployment-my-acceptor-secret

Default value: <custom_resource_name>-<acceptor_name>-secret

enabledCipherSuites

Comma-separated list of cipher suites to use for TLS/SSL communication.

Specify the most secure cipher suite(s) supported by your client application. If you use a comma-separated list to specify a set of cipher suites that is common to both the broker and the client, or you do not specify any cipher suites, the broker and client mutually negotiate a cipher suite to use. If you do not know which cipher suites to specify, it is recommended that you first establish a broker-client connection with your client running in debug mode, to verify the cipher suites that are common to both the broker and the client. Then, configure enabledCipherSuites on the broker.

Type: string

Default value: Not specified

enabledProtocols

Comma-separated list of protocols to use for TLS/SSL communication.

Type: string

Example: TLSv1,TLSv1.1,TLSv1.2

Default value: Not specified

needClientAuth

Specify whether the broker informs clients that two-way TLS is required on the acceptor. This property overrides wantClientAuth.

Type: Boolean

Example: true

Default value: Not specified

wantClientAuth

Specify whether the broker informs clients that two-way TLS is requested on the acceptor, but not required. This property is overridden by needClientAuth.

Type: Boolean

Example: true

Default value: Not specified

verifyHost

Specify whether to compare the Common Name (CN) of a client’s certificate to its host name, to verify that they match. This option applies only when two-way TLS is used.

Type: Boolean

Example: true

Default value: Not specified

sslProvider

Specify whether the SSL provider is JDK or OPENSSL.

Type: string

Example: OPENSSL

Default value: JDK

sniHost

Regular expression to match against the server_name extension on incoming connections. If the names don’t match, connection to the acceptor is rejected.

Type: string

Example: some_regular_expression

Default value: Not specified

expose

Specify whether to expose the acceptor to clients outside OpenShift Container Platform.

When you expose an acceptor to clients outside OpenShift, the Operator automatically creates a dedicated Service and Route for each broker Pod in the deployment.

Type: Boolean

Example: true

Default value: false

anycastPrefix

Prefix used by a client to specify that the anycast routing type should be used.

Type: string

Example: jms.queue

Default value: Not specified

multicastPrefix

Prefix used by a client to specify that the multicast routing type should be used.

Type: string

Example: /topic/

Default value: Not specified

connectionsAllowed

Number of connections allowed on the acceptor. When this limit is reached, a DEBUG message is issued to the log, and the connection is refused. The type of client in use determines what happens when the connection is refused.

Type: integer

Example: 2

Default value: 0 (unlimited connections)

amqpMinLargeMessageSize

Minimum message size, in bytes, required for the broker to handle an AMQP message as a large message. If the size of an AMQP message is equal or greater to this value, the broker stores the message in a large messages directory (/opt/<custom_resource_name>/data/large-messages, by default) on the persistent volume (PV) used by the broker for message storage. Setting the value to -1 disables large message handling for AMQP messages.

Type: integer

Example: 204800

Default value: 102400 (100 KB)

connectors.connector

A single connector configuration instance.

name*

Name of connector.

Type: string

Example: my-connector

Default value: Not applicable

type

The type of connector to create; tcp or vm.

Type: string

Example: vm

Default value: tcp

host*

Host name or IP address to connect to.

Type: string

Example: 192.168.0.58

Default value: Not specified

port*

Port number to be used for the connector instance.

Type: int

Example: 22222

Default value: Not specified

sslEnabled

Specify whether SSL is enabled on the connector port. If set to true, look in the secret name specified in sslSecret for the credentials required by TLS/SSL.

Type: Boolean

Example: true

Default value: false

sslSecret

Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored.

If you do not specify a custom secret name for sslSecret, the connector assumes a default secret name. The default secret name has a format of <custom_resource_name>-<connector_name>-secret.

You must always create this secret yourself, even when the connector assumes a default name.

Type: string

Example: my-broker-deployment-my-connector-secret

Default value: <custom_resource_name>-<connector_name>-secret

enabledCipherSuites

Comma-separated list of cipher suites to use for TLS/SSL communication.

Type: string

NOTE: For a connector, it is recommended that you do not specify a list of cipher suites.

Default value: Not specified

enabledProtocols

Comma-separated list of protocols to use for TLS/SSL communication.

Type: string

Example: TLSv1,TLSv1.1,TLSv1.2

Default value: Not specified

needClientAuth

Specify whether the broker informs clients that two-way TLS is required on the connector. This property overrides wantClientAuth.

Type: Boolean

Example: true

Default value: Not specified

wantClientAuth

Specify whether the broker informs clients that two-way TLS is requested on the connector, but not required. This property is overridden by needClientAuth.

Type: Boolean

Example: true

Default value: Not specified

verifyHost

Specify whether to compare the Common Name (CN) of client’s certificate to its host name, to verify that they match. This option applies only when two-way TLS is used.

Type: Boolean

Example: true

Default value: Not specified

sslProvider

Specify whether the SSL provider is JDK or OPENSSL.

Type: string

Example: OPENSSL

Default value: JDK

sniHost

Regular expression to match against the server_name extension on outgoing connections. If the names don’t match, the connector connection is rejected.

Type: string

Example: some_regular_expression

Default value: Not specified

expose

Specify whether to expose the connector to clients outside OpenShift Container Platform.

Type: Boolean

Example: true

Default value: false

addressSettings.applyRule

Specifies how the Operator applies the configuration that you add to the CR for each matching address or set of addresses.

The values that you can specify are:

Type: string

Example: replace_all

Default value: merge_all

addressSettings.addressSetting

Address settings for a matching address or set of addresses.

addressFullPolicy

Specify what happens when an address configured with maxSizeBytes becomes full. The available policies are:

Type: string

Example: DROP

Default value: PAGE

autoCreateAddresses

Specify whether the broker automatically creates an address when a client sends a message to, or attempts to consume a message from, a queue that is bound to an address that does not exist.

Type: Boolean

Example: false

Default value: true

autoCreateDeadLetterResources

Specify whether the broker automatically creates a dead letter address and queue to receive undelivered messages.

If the parameter is set to true, the broker automatically creates a dead letter address and an associated dead letter queue. The name of the automatically-created address matches the value that you specify for deadLetterAddress.

Type: Boolean

Example: true

Default value: false

autoCreateExpiryResources

Specify whether the broker automatically creates an address and queue to receive expired messages.

If the parameter is set to true, the broker automatically creates an expiry address and an associated expiry queue. The name of the automatically-created address matches the value that you specify for expiryAddress.

Type: Boolean

Example: true

Default value: false

autoCreateJmsQueues

This property is deprecated. Use autoCreateQueues instead.

autoCreateJmsTopics

This property is deprecated. Use autoCreateQueues instead.

autoCreateQueues

Specify whether the broker automatically creates a queue when a client sends a message to, or attempts to consume a message from, a queue that does not yet exist.

Type: Boolean

Example: false

Default value: true

autoDeleteAddresses

Specify whether the broker automatically deletes automatically-created addresses when the broker no longer has any queues.

Type: Boolean

Example: false

Default value: true

autoDeleteAddressDelay

Time, in milliseconds, that the broker waits before automatically deleting an automatically-created address when the address has no queues.

Type: integer

Example: 100

Default value: 0

autoDeleteJmsQueues

This property is deprecated. Use autoDeleteQueues instead.

autoDeleteJmsTopics

This property is deprecated. Use autoDeleteQueues instead.

autoDeleteQueues

Specify whether the broker automatically deletes an automatically-created queue when the queue has no consumers and no messages.

Type: Boolean

Example: false

Default value: true

autoDeleteCreatedQueues

Specify whether the broker automatically deletes a manually-created queue when the queue has no consumers and no messages.

Type: Boolean

Example: true

Default value: false

autoDeleteQueuesDelay

Time, in milliseconds, that the broker waits before automatically deleting an automatically-created queue when the queue has no consumers.

Type: integer

Example: 10

Default value: 0

autoDeleteQueuesMessageCount

Maximum number of messages that can be in a queue before the broker evaluates whether the queue can be automatically deleted.

Type: integer

Example: 5

Default value: 0

configDeleteAddresses

When the configuration file is reloaded, this parameter specifies how to handle an address (and its queues) that has been deleted from the configuration file. You can specify the following values:

Type: string

Example: FORCE

Default value: OFF

configDeleteQueues

When the configuration file is reloaded, this setting specifies how the broker handles queues that have been deleted from the configuration file. You can specify the following values:

Type: string

Example: FORCE

Default value: OFF

deadLetterAddress

The address to which the broker sends dead (that is, undelivered) messages.

Type: string

Example: DLA

Default value: None

deadLetterQueuePrefix

Prefix that the broker applies to the name of an automatically-created dead letter queue.

Type: string

Example: myDLQ.

Default value: DLQ.

deadLetterQueueSuffix

Suffix that the broker applies to an automatically-created dead letter queue.

Type: string

Example: .DLQ

Default value: None

defaultAddressRoutingType

Routing type used on automatically-created addresses.

Type: string

Example: ANYCAST

Default value: MULTICAST

defaultConsumersBeforeDispatch

Number of consumers needed before message dispatch can begin for queues on an address.

Type: integer

Example: 5

Default value: 0

defaultConsumerWindowSize

Default window size, in bytes, for a consumer.

Type: integer

Example: 300000

Default value: 1048576 (1024*1024)

defaultDelayBeforeDispatch

Default time, in milliseconds, that the broker waits before dispatching messages if the value specified for defaultConsumersBeforeDispatch has not been reached.

Type: integer

Example: 5

Default value: -1 (no delay)

defaultExclusiveQueue

Specifies whether all queues on an address are exclusive queues by default.

Type: Boolean

Example: true

Default value: false

defaultGroupBuckets

Number of buckets to use for message grouping.

Type: integer

Example: 0 (message grouping disabled)

Default value: -1 (no limit)

defaultGroupFirstKey

Key used to indicate to a consumer which message in a group is first.

Type: string

Example: firstMessageKey

Default value: None

defaultGroupRebalance

Specifies whether to rebalance groups when a new consumer connects to the broker.

Type: Boolean

Example: true

Default value: false

defaultGroupRebalancePauseDispatch

Specifies whether to pause message dispatch while the broker is rebalancing groups.

Type: Boolean

Example: true

Default value: false

defaultLastValueQueue

Specifies whether all queues on an address are last value queues by default.

Type: Boolean

Example: true

Default value: false

defaultLastValueKey

Default key to use for a last value queue.

Type: string

Example: stock_ticker

Default value: None

defaultMaxConsumers

Maximum number of consumers allowed on a queue at any time.

Type: integer

Example: 100

Default value: -1 (no limit)

defaultNonDestructive

Specifies whether all queues on an address are non-destructive by default.

Type: Boolean

Example: true

Default value: false

defaultPurgeOnNoConsumers

Specifies whether the broker purges the contents of a queue once there are no consumers.

Type: Boolean

Example: true

Default value: false

defaultQueueRoutingType

Routing type used on automatically-created queues. The default value is MULTICAST.

Type: string

Example: ANYCAST

Default value: MULTICAST

defaultRingSize

Default ring size for a matching queue that does not have a ring size explicitly set.

Type: integer

Example: 3

Default value: -1 (no size limit)

enableMetrics

Specifies whether a configured metrics plugin such as the Prometheus plugin collects metrics for a matching address or set of addresses.

Type: Boolean

Example: false

Default value: true

expiryAddress

Address that receives expired messages.

Type: string

Example: myExpiryAddress

Default value: None

expiryDelay

Expiration time, in milliseconds, applied to messages that are using the default expiration time.

Type: integer

Example: 100

Default value: -1 (no expiration time applied)

expiryQueuePrefix

Prefix that the broker applies to the name of an automatically-created expiry queue.

Type: string

Example: myExp.

Default value: EXP.

expiryQueueSuffix

Suffix that the broker applies to the name of an automatically-created expiry queue.

Type: string

Example: .EXP

Default value: None

lastValueQueue

Specify whether a queue uses only last values or not.

Type: Boolean

Example: true

Default value: false

managementBrowsePageSize

Specify how many messages a management resource can browse.

Type: integer

Example: 100

Default value: 200

match*

String that matches address settings to addresses configured on the broker. You can specify an exact address name or use a wildcard expression to match the address settings to a set of addresses.

If you use a wildcard expression as a value for the match property, you must enclose the value in single quotation marks, for example, 'myAddresses*'.

Type: string

Example: 'myAddresses*'

Default value: None

maxDeliveryAttempts

Specifies how many times the broker attempts to deliver a message before sending the message to the configured dead letter address.

Type: integer

Example: 20

Default value: 10

maxExpiryDelay

Expiration time, in milliseconds, applied to messages that are using an expiration time greater than this value.

Type: integer

Example: 20

Default value: -1 (no maximum expiration time applied)

maxRedeliveryDelay

Maximum value, in milliseconds, between message redelivery attempts made by the broker.

Type: integer

Example: 100

Default value: The default value is ten times the value of redeliveryDelay, which has a default value of 0.

maxSizeBytes

Maximum memory size, in bytes, for an address. Used when addressFullPolicy is set to PAGING, BLOCK, or FAIL. Also supports byte notation such as "K", "Mb", and "GB".

Type: string

Example: 10Mb

Default value: -1 (no limit)

maxSizeBytesRejectThreshold

Maximum size, in bytes, that an address can reach before the broker begins to reject messages. Used when the address-full-policy is set to BLOCK. Works in combination with maxSizeBytes for the AMQP protocol only.

Type: integer

Example: 500

Default value: -1 (no maximum size)

messageCounterHistoryDayLimit

Number of days for which a broker keeps a message counter history for an address.

Type: integer

Example: 5

Default value: 0

minExpiryDelay

Expiration time, in milliseconds, applied to messages that are using an expiration time lower than this value.

Type: integer

Example: 20

Default value: -1 (no minimum expiration time applied)

pageMaxCacheSize

Number of page files to keep in memory to optimize I/O during paging navigation.

Type: integer

Example: 10

Default value: 5

pageSizeBytes

Paging size in bytes. Also supports byte notation such as K, Mb, and GB.

Type: string

Example: 20971520

Default value: 10485760 (approximately 10.5 MB)

redeliveryDelay

Time, in milliseconds, that the broker waits before redelivering a cancelled message.

Type: integer

Example: 100

Default value: 0

redeliveryDelayMultiplier

Multiplying factor to apply to the value of redeliveryDelay.

Type: number

Example: 5

Default value: 1

redeliveryCollisionAvoidanceFactor

Multiplying factor to apply to the value of redeliveryDelay to avoid collisions.

Type: number

Example: 1.1

Default value: 0

redistributionDelay

Time, in milliseconds, that the broker waits after the last consumer is closed on a queue before redistributing any remaining messages.

Type: integer

Example: 100

Default value: -1 (not set)

retroactiveMessageCount

Number of messages to keep for future queues created on an address.

Type: integer

Example: 100

Default value: 0

sendToDlaOnNoRoute

Specify whether a message will be sent to the configured dead letter address if it cannot be routed to any queues.

Type: Boolean

Example: true

Default value: false

slowConsumerCheckPeriod

How often, in seconds, that the broker checks for slow consumers.

Type: integer

Example: 15

Default value: 5

slowConsumerPolicy

Specifies what happens when a slow consumer is identified. Valid options are KILL or NOTIFY. KILL kills the consumer’s connection, which impacts any client threads using that same connection. NOTIFY sends a CONSUMER_SLOW management notification to the client.

Type: string

Example: KILL

Default value: NOTIFY

slowConsumerThreshold

Minimum rate of message consumption, in messages per second, before a consumer is considered slow.

Type: integer

Example: 100

Default value: -1 (not set)

upgrades

enabled

When you update the value of version to specify a new target version of AMQ Broker, specify whether to allow the Operator to automatically update the deploymentPlan.image value to a broker container image that corresponds to that version of AMQ Broker.

Type: Boolean

Example: true

Default value: false

minor

Specify whether to allow the Operator to automatically update the deploymentPlan.image value when you update the value of version from one minor version of AMQ Broker to another, for example, from 7.8.0 to 7.9.4.

Type: Boolean

Example: true

Default value: false

version

Specify a target minor version of AMQ Broker for which you want the Operator to automatically update the CR to use a corresponding broker container image. For example, if you change the value of version from 7.6.0 to 7.7.0 (and upgrades.enabled and upgrades.minor are both set to true), then the Operator updates deploymentPlan.image to a broker image of the form registry.redhat.io/amq7/amq-broker-rhel8:7.8-x.

Type: string

Example: 7.7.0

Default value: Current version of AMQ Broker

addressName*

Address name to be created on broker.

Type: string

Example: address0

Default value: Not specified

queueName

Queue name to be created on broker. If queueName is not specified, the CR creates only the address.

Type: string

Example: queue0

Default value: Not specified

removeFromBrokerOnDelete*

Specify whether the Operator removes existing addresses for all brokers in a deployment when you remove the address CR instance for that deployment. The default value is false, which means the Operator does not delete existing addresses when you remove the CR.

Type: Boolean

Example: true

Default value: false

routingType*

Routing type to be used; anycast or multicast.

Type: string

Example: anycast

Default value: multicast

loginModules

One or more login module configurations.

A login module can be one of the following types:

propertiesLoginModule

name*

Name of login module.

Type: string

Example: my-login

Default value: Not applicable

users.name*

Name of user.

Type: string

Example: jdoe

Default value: Not applicable

users.password*

password of user.

Type: string

Example: password

Default value: Not applicable

users.roles

Names of roles.

Type: string

Example: viewer

Default value: Not applicable

guestLoginModule

name*

Name of guest login module.

Type: string

Example: guest-login

Default value: Not applicable

guestUser

Name of guest user.

Type: string

Example: myguest

Default value: Not applicable

guestRole

Name of role for guest user.

Type: string

Example: guest

Default value: Not applicable

keycloakLoginModule

name

Name for KeycloakLoginModule

Type: string

Example: sso

Default value: Not applicable

moduleType

Type of KeycloakLoginModule (directAccess or bearerToken)

Type: string

Example: bearerToken

Default value: Not applicable

configuration

The following configuration items are related to Red Hat Single Sign-On and detailed information is available from the OpenID Connect documentation.

configuration.realm*

Realm for KeycloakLoginModule

Type: string

Example: myrealm

Default value: Not applicable

configuration.realmPublicKey

Public key for the realm

Type: string

Default value: Not applicable

configuration.authServerUrl*

URL of the keycloak authentication server

Type: string

Default value: Not applicable

configuration.sslRequired

Specify whether SSL is required

Type: string

Valid values are 'all', 'external' and 'none'.

configuration.resource*

Resource Name

The client-id of the application. Each application has a client-id that is used to identify the application.

configuration.publicClient

Specify whether it is public client.

Type: Boolean

Default value: false

Example: false

configuration.credentials.key

Specify the credentials key.

Type: string

Default value: Not applicable

Type: string

Default value: Not applicable

configuration.credentials.value

Specify the credentials value

Type: string

Default value: Not applicable

configuration.useResourceRoleMappings

Specify whether to use resource role mappings

Type: Boolean

Example: false

configuration.enableCors

Specify whether to enable Cross-Origin Resource Sharing (CORS)

It will handle CORS preflight requests. It will also look into the access token to determine valid origins.

Type: Boolean

Default value: false

configuration.corsMaxAge

CORS max age

If CORS is enabled, this sets the value of the Access-Control-Max-Age header.

configuration.corsAllowedMethods

CORS allowed methods

If CORS is enabled, this sets the value of the Access-Control-Allow-Methods header. This should be a comma-separated string.

configuration.corsAllowedHeaders

CORS allowed headers

If CORS is enabled, this sets the value of the Access-Control-Allow-Headers header. This should be a comma-separated string.

configuration.corsExposedHeaders

CORS exposed headers

If CORS is enabled, this sets the value of the Access-Control-Expose-Headers header. This should be a comma-separated string.

configuration.exposeToken

Specify whether to expose access token

Type: Boolean

Default value: false

configuration.bearerOnly

Specify whether to verify bearer token

Type: Boolean

Default value: false

configuration.autoDetectBearerOnly

Specify whether to only auto-detect bearer token

Type: Boolean

Default value: false

configuration.connectionPoolSize

Size of the connection pool

Type: Integer

Default value: 20

configuration.allowAnyHostName

Specify whether to allow any host name

Type: Boolean

Default value: false

configuration.disableTrustManager

Specify whether to disable trust manager

Type: Boolean

Default value: false

configuration.trustStore*

Path of a trust store

This is REQUIRED unless ssl-required is none or disable-trust-manager is true.

configuration.trustStorePassword*

Truststore password

This is REQUIRED if truststore is set and the truststore requires a password.

configuration.clientKeyStore

Path of a client keystore

Type: string

Default value: Not applicable

configuration.clientKeyStorePassword

Client keystore password

Type: string

Default value: Not applicable

configuration.clientKeyPassword

Client key password

Type: string

Default value: Not applicable

configuration.alwaysRefreshToken

Specify whether to always refresh token

Type: Boolean

Example: false

configuration.registerNodeAtStartup

Specify whether to register node at startup

Type: Boolean

Example: false

configuration.registerNodePeriod

Period for re-registering node

Type: string

Default value: Not applicable

configuration.tokenStore

Type of token store (session or cookie)

Type: string

Default value: Not applicable

configuration.tokenCookiePath

Cookie path for a cookie store

Type: string

Default value: Not applicable

configuration.principalAttribute

OpenID Connect ID Token attribute to populate the UserPrincipal name with

OpenID Connect ID Token attribute to populate the UserPrincipal name with. If token attribute is null, defaults to sub. Possible values are sub, preferred_username, email, name, nickname, given_name, family_name.

configuration.proxyUrl

The proxy URL

configuration.turnOffChangeSessionIdOnLogin

Specify whether to change session id on a successful login

Type: Boolean

Example: false

configuration.tokenMinimumTimeToLive

Minimum time to refresh an active access token

Type: Integer

Default value: 0

configuration.minTimeBetweenJwksRequests

Minimum interval between two requests to Keycloak to retrieve new public keys

Type: Integer

Default value: 10

configuration.publicKeyCacheTtl

Maximum interval between two requests to Keycloak to retrieve new public keys

Type: Integer

Default value: 86400

configuration.ignoreOauthQueryParameter

Whether to turn off processing of the access_token query parameter for bearer token processing

Type: Boolean

Example: false

configuration.verifyTokenAudience

Verify whether the token contains this client name (resource) as an audience

Type: Boolean

Example: false

configuration.enableBasicAuth

Whether to support basic authentication

Type: Boolean

Default value: false

configuration.confidentialPort

The confidential port used by the Keycloak server for secure connections over SSL/TLS

Type: Integer

Example: 8443

configuration.redirectRewriteRules.key

The regular expression used to match the Redirect URI.

Type: string

Default value: Not applicable

configuration.redirectRewriteRules.value

The replacement String

Type: string

Default value: Not applicable

configuration.scope

The OAuth2 scope parameter for DirectAccessGrantsLoginModule

Type: string

Default value: Not applicable

securityDomains

Broker security domains

brokerDomain.name

Broker domain name

Type: string

Example: activemq

Default value: Not applicable

brokerDomain.loginModules

One or more login modules. Each entry must be previously defined in the loginModules section above.

brokerDomain.loginModules.name

Name of login module

Type: string

Example: prop-module

Default value: Not applicable

brokerDomain.loginModules.flag

Same as propertiesLoginModule, required, requisite, sufficient and optional are valid values.

Type: string

Example: sufficient

Default value: Not applicable

brokerDomain.loginModules.debug

Debug

brokerDomain.loginModules.reload

Reload

consoleDomain.name

Broker domain name

Type: string

Example: activemq

Default value: Not applicable

consoleDomain.loginModules

A single login module configuration.

consoleDomain.loginModules.name

Name of login module

Type: string

Example: prop-module

Default value: Not applicable

consoleDomain.loginModules.flag

Same as propertiesLoginModule, required, requisite, sufficient and optional are valid values.

Type: string

Example: sufficient

Default value: Not applicable

consoleDomain.loginModules.debug

Debug

Type: Boolean

Example: false

consoleDomain.loginModules.reload

Reload

Type: Boolean

Example: true

Default: false

securitySettings

Additional security settings to add to broker.xml or management.xml

broker.match

The address match pattern for a security setting section. See AMQ Broker wildcard syntax for details about the match pattern syntax.

broker.permissions.operationType

The operation type of a security setting, as described in Setting permissions.

Type: string

Example: createAddress

Default value: Not applicable

broker.permissions.roles

The security settings are applied to these roles, as described in Setting permissions.

Type: string

Example: root

Default value: Not applicable

securitySettings.management

Options to configure management.xml.

hawtioRoles

The roles allowed to log into the Broker console.

Type: string

Example: root

Default value: Not applicable

connector.host

The connector host for connecting to the management API.

Type: string

Example: myhost

Default value: localhost

connector.port

The connector port for connecting to the management API.

Type: integer

Example: 1099

Default value: 1099

connector.jmxRealm

The JMX realm of the management API.

Type: string

Example: activemq

Default value: activemq

connector.objectName

The JMX object name of the management API.

Type: String

Example: connector:name=rmi

Default: connector:name=rmi

connector.authenticatorType

The management API authentication type.

Type: String

Example: password

Default: password

connector.secured

Whether the management API connection is secured.

Type: Boolean

Example: true

Default value: false

connector.keyStoreProvider

The keystore provider for the management connector. Required if you have set connector.secured="true". The default value is JKS.

connector.keyStorePath

Location of the keystore. Required if you have set connector.secured="true".

connector.keyStorePassword

The keystore password for the management connector. Required if you have set connector.secured="true".

connector.trustStoreProvider

The truststore provider for the management connector Required if you have set connector.secured="true".

Type: String

Example: JKS

Default: JKS

connector.trustStorePath

Location of the truststore for the management connector. Required if you have set connector.secured="true".

Type: string

Default value: Not applicable

connector.trustStorePassword

The truststore password for the management connector. Required if you have set connector.secured="true".

Type: string

Default value: Not applicable

connector.passwordCodec

The password codec for management connector The fully qualified class name of the password codec to use as described in Encrypting a password in a configuration file.

authorisation.allowedList.domain

The domain of allowedList

Type: string

Default value: Not applicable

authorisation.allowedList.key

The key of allowedList

Type: string

Default value: Not applicable

authorisation.defaultAccess.method

The method of defaultAccess List

Type: string

Default value: Not applicable

authorisation.defaultAccess.roles

The roles of defaultAccess List

Type: string

Default value: Not applicable

authorisation.roleAccess.domain

The domain of roleAccess List

Type: string

Default value: Not applicable

authorisation.roleAccess.key

The key of roleAccess List

Type: string

Default value: Not applicable

authorisation.roleAccess.accessList.method

The method of roleAccess List

Type: string

Default value: Not applicable

authorisation.roleAccess.accessList.roles

The roles of roleAccess List

Type: string

Default value: Not applicable

applyToCrNames

Apply this security config to the brokers defined by the named CRs in the current namespace. A value of * or empty string means applying to all brokers.

Type: string

Example: my-broker

Default value: All brokers defined by CRs in the current namespace.