Chapter 8. Configuring and managing Service Registry deployment

Procedure

1. In the OpenShift Container Platform web console, log in using an account with cluster administrator privileges.
2. Click Installed Operators > Red Hat Integration - Service Registry.
3. On the ApicurioRegistry tab, click the Operator custom resource for your deployment, for example, example-apicurioregistry.
4. In the main overview page, find the Deployment Name section and the corresponding DeploymentConfig name for your Service Registry deployment, for example, example-apicurioregistry.
5. In the left navigation menu, click Workloads > Deployment Configs, and select your DeploymentConfig name.

6. Click the Environment tab, and enter your environment variables in the Single values env section, for example:

   • NAME: LIVENESS_STATUS_RESET
   • VALUE: 350

7. Click Save at the bottom.

   Alternatively, you can perform these steps using the OpenShift oc command. For more details, see the OpenShift CLI documentation.

Procedure

1. Generate a keystore with a self-signed certificate. You can skip this step if you are using your own certificates.

   keytool -genkey -trustcacerts -keyalg RSA -keystore registry-keystore.jks -storepass password

2. Create a new secret to hold the keystore and keystore password.

   1. In the left navigation menu of the OpenShift web console, click Workloads > Secrets > Create Key/Value Secret.

   2. Use the following values:
      

      • Name: registry-keystore
        
      • Key 1: keystore.jks
        
      • Value 1: registry-keystore.jks (uploaded file)
        
      • Key 2: password
        

      • Value 2: password

        Note

        If you encounter a java.io.IOException: Invalid keystore format, the upload of the binary file did not work properly. As an alternative, encode the file as a base64 string using cat registry-keystore.jks | base64 -w0 > data.txt and edit the Secret resource as yaml to manually add the encoded file.

3. Edit the DeploymentConfig resource of the Service Registry instance. You can find the correct name in a status field of the Service Registry Operator.

   1. Add the keystore secret as a volume:

      template:
        spec:
          volumes:
          - name: registry-keystore-secret-volume
            secret:
            secretName: registry-keystore

   2. Add a volume mount:

      volumeMounts:
        - name: registry-keystore-secret-volume
          mountPath: /etc/registry-keystore
          readOnly: true

   3. Add JAVA_OPTIONS and KEYSTORE_PASSWORD environment variables:

      - name: KEYSTORE_PASSWORD
        valueFrom:
          secretKeyRef:
            name: registry-keystore
            key: password
      - name: JAVA_OPTIONS
          value: >-
           -Dquarkus.http.ssl.certificate.key-store-file=/etc/registry-keystore/keystore.jks
           -Dquarkus.http.ssl.certificate.key-store-file-type=jks
           -Dquarkus.http.ssl.certificate.key-store-password=$(KEYSTORE_PASSWORD)

      Note

      Order is important when using string interpolation.

   4. Enable the HTTPS port:

      ports:
        - containerPort: 8080
          protocol: TCP
        - containerPort: 8443
          protocol: TCP

4. Edit the Service resource of the Service Registry instance. You can find the correct name in a status field of the Service Registry Operator.

   ports:
     - name: http
       protocol: TCP
       port: 8080
       targetPort: 8080
     - name: https
       protocol: TCP
       port: 8443
       targetPort: 8443

5. Verify that the connection is working:

   1. Connect into a pod on the cluster using SSH (you can use the Service Registry pod):

      oc rsh -n default example-apicurioregistry-deployment-vx28s-4-lmtqb

   2. Find the cluster IP of the Service Registry pod from the Service resource (see the Location column in the web console).

   3. Afterwards, execute a test request (we are using self-signed certificate, so an insecure flag is required):

      curl -k https://172.30.209.198:8443/health
      [...]