kind: Template
apiVersion: v1
metadata:
  annotations:
    iconClass: icon-jboss
    tags: rhdm,decisionserver,jboss,authoring,ha
    version: "7.12"
    openshift.io/display-name: Red Hat Decision Manager 7.12 authoring environment (HA, persistent, with https)
    openshift.io/provider-display-name: Red Hat, Inc.
    description: Application template for a HA persistent authoring environment, for Red Hat Decision Manager 7.12 - Deprecated
    template.openshift.io/long-description: This template defines resources needed to develop and execute Rules on Red Hat Decision Manager 7.12 with High Availability enabled as tech preview, including application deployment configuration, secure and insecure http communication and persistent volumes to store data that needs to survive a restart. Template for Red Hat OpenShift Container Platform version 3.11. Deprecated since Red Hat Decision Manager version 7.5; consider using the Red Hat Business Automation Operator.
    template.openshift.io/documentation-url: https://access.redhat.com/documentation/en-us/red_hat_decision_manager/7.12/html/deploying_a_red_hat_decision_manager_7.12_authoring_environment_on_red_hat_openshift_container_platform/
    template.openshift.io/support-url: https://access.redhat.com
    template.openshift.io/bindable: "false"
  name: rhdm712-authoring-ha
labels:
  template: rhdm712-authoring-ha
  rhdm: "7.12"
message: |-
  A new persistent HA Decision Manager application has been created in your project.
  The username/password needed for accessing the application are stored in "${CREDENTIALS_SECRET}" secret as
  KIE_ADMIN_USER and KIE_ADMIN_PWD

  You must create the secret named "${CREDENTIALS_SECRET}" containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values and the secrets named "${DECISION_CENTRAL_HTTPS_SECRET}" and "${KIE_SERVER_HTTPS_SECRET}"
  containing the ${DECISION_CENTRAL_HTTPS_KEYSTORE} and ${KIE_SERVER_HTTPS_KEYSTORE} files used for serving secure content.
parameters:
  - displayName: Application Name
    description: The name for the application.
    name: APPLICATION_NAME
    value: myapp
    required: true
  - displayName: Credentials secret
    description: Secret containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values.
    name: CREDENTIALS_SECRET
    example: rhpam-credentials
    required: true
  - displayName: KIE Server Controller Token
    description: KIE Server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)
    name: KIE_SERVER_CONTROLLER_TOKEN
    required: false
  - displayName: KIE Server Bypass Auth User
    description: Allows the KIE Server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property)
    name: KIE_SERVER_BYPASS_AUTH_USER
    value: 'false'
    required: false
  - displayName: KIE Server Mode
    description: "The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE Server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property)."
    name: KIE_SERVER_MODE
    value: "DEVELOPMENT"
    required: false
  - displayName: KIE MBeans
    description: KIE Server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)
    name: KIE_MBEANS
    value: enabled
    required: false
  - displayName: Drools Server Filter Classes
    description: KIE Server class filtering. (Sets the org.drools.server.filter.classes system property)
    name: DROOLS_SERVER_FILTER_CLASSES
    value: 'true'
    required: false
  - displayName: Prometheus Server Extension Disabled
    description: If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)
    name: PROMETHEUS_SERVER_EXT_DISABLED
    example: 'false'
    required: false
  - displayName: Decision Central Custom http Route Hostname
    description: 'Custom hostname for http service route for Decision Central.  Leave blank for default hostname, e.g.: insecure-<application-name>-rhdmcentr-<project>.<default-domain-suffix>'
    name: DECISION_CENTRAL_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: Decision Central Custom https Route Hostname
    description: 'Custom hostname for https service route for Decision Central.  Leave blank for default hostname, e.g.: <application-name>-rhdmcentr-<project>.<default-domain-suffix>'
    name: DECISION_CENTRAL_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: KIE Server Custom http Route Hostname
    description: 'Custom hostname for http service route for KIE Server. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: KIE Server Custom https Route Hostname
    description: 'Custom hostname for https service route for KIE Server. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: Decision Central Server Keystore Secret Name
    description: The name of the secret containing the keystore file for Decision Central.
    name: DECISION_CENTRAL_HTTPS_SECRET
    example: decisioncentral-app-secret
    required: true
  - displayName: Decision Central Server Keystore Filename
    description: The name of the keystore file within the secret for Decision Central.
    name: DECISION_CENTRAL_HTTPS_KEYSTORE
    value: keystore.jks
    required: false
  - displayName: Decision Central Server Certificate Name
    description: The name associated with the server certificate for Decision Central.
    name: DECISION_CENTRAL_HTTPS_NAME
    value: jboss
    required: false
  - displayName: Decision Central Server Keystore Password
    description: The password for the keystore and certificate for Decision Central.
    name: DECISION_CENTRAL_HTTPS_PASSWORD
    value: mykeystorepass
    required: false
  - displayName: KIE Server Keystore Secret Name
    description: The name of the secret containing the keystore file for KIE Server.
    name: KIE_SERVER_HTTPS_SECRET
    example: kieserver-app-secret
    required: true
  - displayName: KIE Server Keystore Filename
    description: The name of the keystore file within the secret for KIE Server.
    name: KIE_SERVER_HTTPS_KEYSTORE
    value: keystore.jks
    required: false
  - displayName: KIE Server Certificate Name
    description: The name associated with the server certificate for KIE Server.
    name: KIE_SERVER_HTTPS_NAME
    value: jboss
    required: false
  - displayName: KIE Server Keystore Password
    description: The password for the keystore and certificate for KIE Server.
    name: KIE_SERVER_HTTPS_PASSWORD
    value: mykeystorepass
    required: false
  - displayName: AppFormer JMS Broker user name
    description: The user name to connect to the JMS broker.
    name: APPFORMER_JMS_BROKER_USER
    required: true
    value: jmsBrokerUser
  - displayName: AppFormer JMS Broker password
    description: The password to connect to the JMS broker.
    name: APPFORMER_JMS_BROKER_PASSWORD
    from: "[a-zA-Z]{6}[0-9]{1}!"
    generate: expression
    required: true
  - displayName: DataGrid Image
    description: DataGrid image.
    name: DATAGRID_IMAGE
    value: registry.redhat.io/datagrid/datagrid-8-rhel8:1.1
    required: true
  - displayName: DataGrid Container CPU Limit
    description: DataGrid Container CPU limit.
    name: DATAGRID_CPU_LIMIT
    value: "1000m"
    required: true
  - displayName: DataGrid Container Memory Limit
    description: DataGrid Container memory limit.
    name: DATAGRID_MEMORY_LIMIT
    value: "2Gi"
    required: true
  - displayName: DataGrid Volume Capacity
    description: Size of the persistent storage for DataGrid's runtime data.
    name: DATAGRID_VOLUME_CAPACITY
    value: "1Gi"
    required: true
  - description: AMQ Broker Image
    displayName: Image
    name: AMQ_BROKER_IMAGE
    required: true
    value: registry.redhat.io/amq7/amq-broker:7.8
  - displayName: AMQ Role
    description: User role for standard broker user.
    name: AMQ_ROLE
    value: admin
    required: true
  - displayName: AMQ Name
    description: The name of the broker.
    name: AMQ_NAME
    value: broker
    required: true
  - displayName: AMQ Global Max Size
    description: Specifies the maximum amount of memory that message data can consume. If no value is specified, half of the system’s memory is allocated.
    name: AMQ_GLOBAL_MAX_SIZE
    example: 10 gb
    required: false
  - displayName: Broker Volume Capacity
    description: Size of persistent storage for AMQ broker volume.
    name: AMQ_VOLUME_CAPACITY
    value: 1Gi
    required: true
  - description: Number of broker replicas for a cluster
    displayName: Number of Replicas
    name: AMQ_REPLICAS
    required: true
    value: "2"
  - displayName: Decision Central Container Replicas
    description: Decision Central Container Replicas, defines how many Decision Central containers will be started.
    name: DECISION_CENTRAL_CONTAINER_REPLICAS
    value: '2'
    required: true
  - displayName: KIE Server Container Replicas
    description: KIE Server Container Replicas, defines how many KIE Server containers will be started.
    name: KIE_SERVER_CONTAINER_REPLICAS
    value: '2'
    required: true
## OpenShift Enhancement BEGIN
  - displayName: Enable KIE Server global discovery
    description: "If set to true, turns on KIE Server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)"
    name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED
    value: "false"
    required: false
  - displayName: Prefer KIE Server OpenShift Service
    description: If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)
    name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE
    value: "true"
    required: false
  - displayName: KIE ServerTemplate Cache TTL
    description: KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property)
    name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL
    value: "60000"
    required: false
## OpenShift Enhancement END
  - displayName: ImageStream Namespace
    description: Namespace in which the ImageStreams for Red Hat Decision Manager images are installed. These ImageStreams are normally installed in the openshift namespace. You need to modify this parameter only if you installed the ImageStreams in a different namespace/project.
    name: IMAGE_STREAM_NAMESPACE
    value: openshift
    required: true
  - displayName: Decision Central ImageStream Name
    description: The name of the image stream to use for Decision Central. Default is "rhdm-decisioncentral-rhel8".
    name: DECISION_CENTRAL_IMAGE_STREAM_NAME
    value: "rhdm-decisioncentral-rhel8"
    required: true
  - displayName: KIE Server ImageStream Name
    description: The name of the image stream to use for KIE Server. Default is "rhdm-kieserver-rhel8".
    name: KIE_SERVER_IMAGE_STREAM_NAME
    value: "rhdm-kieserver-rhel8"
    required: true
  - displayName: ImageStream Tag
    description: A named pointer to an image in an image stream. Default is "7.12.1".
    name: IMAGE_STREAM_TAG
    value: "7.12.1"
    required: true
  - displayName: Maven mirror URL
    description: Maven mirror that Decision Central and KIE Server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.
    name: MAVEN_MIRROR_URL
    required: false
  - displayName: Maven mirror of
    description: Maven mirror configuration for KIE Server.
    name: MAVEN_MIRROR_OF
    value: "external:*,!repo-rhdmcentr"
    required: false
  - displayName: Maven repository ID
    description: "The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhdmcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won't be usable in MAVEN_MIRROR_OF."
    name: MAVEN_REPO_ID
    value: repo-custom
    required: false
  - displayName: Maven repository URL
    description: Fully qualified URL to a Maven repository or service.
    name: MAVEN_REPO_URL
    example: http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/
    required: false
  - displayName: Maven repository user name
    description: User name for accessing the Maven repository, if required.
    name: MAVEN_REPO_USERNAME
    required: false
  - displayName: Maven repository password
    description: Password to access the Maven repository, if required.
    name: MAVEN_REPO_PASSWORD
    required: false
  - displayName: Git hooks directory
    description: The directory to use for git hooks, if required.
    name: GIT_HOOKS_DIR
    example: /opt/kie/data/git/hooks
    required: false
  - displayName: Decision Central Volume Capacity
    description: Size of the persistent storage for Decision Central's runtime data.
    name: DECISION_CENTRAL_VOLUME_CAPACITY
    value: 1Gi
    required: true
  - displayName: Decision Central Container JVM Max Memory Ratio
    description: Decision Central Container JVM max memory ratio. -Xmx is set to a ratio of the memory available on the container. The default is 80, which means the upper boundary is 80% of the available memory. To skip adding the -Xmx option, set this value to 0.
    name: DECISION_CENTRAL_JAVA_MAX_MEM_RATIO
    value: "80"
    required: true
  - displayName: Decision Central Container Memory Limit
    description: Decision Central Container memory limit.
    name: DECISION_CENTRAL_MEMORY_LIMIT
    value: 4Gi
    required: true
  - displayName: Decision Central Container CPU Limit
    description: Decision Central Container CPU limit.
    name: DECISION_CENTRAL_CPU_LIMIT
    value: "2"
    required: true
  - displayName: Decision Central Container Memory Request
    description: Decision Central Container memory request.
    name: DECISION_CENTRAL_MEMORY_REQUEST
    value: 3Gi
    required: true
  - displayName: Decision Central Container CPU Request
    description: Decision Central Container CPU request.
    name: DECISION_CENTRAL_CPU_REQUEST
    value: '1500m'
    required: true
  - displayName: KIE Server Container Memory Limit
    description: KIE Server Container memory limit.
    name: KIE_SERVER_MEMORY_LIMIT
    value: 2Gi
    required: true
  - displayName: KIE Server Container Memory Request
    description: KIE Server Container memory Request.
    name: KIE_SERVER_MEMORY_REQUEST
    value: 1536Mi
    required: true
  - displayName: KIE Server Container CPU Limit
    description: KIE Server Container CPU limit.
    name: KIE_SERVER_CPU_LIMIT
    value: '1'
    required: true
  - displayName: KIE Server Container CPU Request
    description: KIE Server Container CPU Request.
    name: KIE_SERVER_CPU_REQUEST
    value: '750m'
    required: true
  - displayName: RH-SSO URL
    description: RH-SSO URL.
    name: SSO_URL
    example: https://rh-sso.example.com/auth
    required: false
  - displayName: RH-SSO Realm name
    description: RH-SSO Realm name.
    name: SSO_REALM
    required: false
  - displayName: Decision Central RH-SSO Client name
    description: Decision Central RH-SSO Client name.
    name: DECISION_CENTRAL_SSO_CLIENT
    required: false
  - displayName: Decision Central RH-SSO Client Secret
    description: Decision Central RH-SSO Client Secret.
    name: DECISION_CENTRAL_SSO_SECRET
    example: "252793ed-7118-4ca8-8dab-5622fa97d892"
    required: false
  - displayName: KIE Server RH-SSO Client name
    description: KIE Server RH-SSO Client name.
    name: KIE_SERVER_SSO_CLIENT
    required: false
  - displayName: KIE Server RH-SSO Client Secret
    description: KIE Server RH-SSO Client Secret.
    name: KIE_SERVER_SSO_SECRET
    example: "252793ed-7118-4ca8-8dab-5622fa97d892"
    required: false
  - displayName: RH-SSO Realm admin user name
    description: RH-SSO Realm admin user name used to create the Client if it doesn't exist.
    name: SSO_USERNAME
    required: false
  - displayName: RH-SSO Realm Admin Password
    description: RH-SSO Realm Admin Password used to create the Client.
    name: SSO_PASSWORD
    required: false
  - displayName: RH-SSO Disable SSL Certificate Validation
    description: RH-SSO Disable SSL Certificate Validation.
    name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
    value: "false"
    required: false
  - displayName: RH-SSO Principal Attribute
    description: RH-SSO Principal Attribute to use as user name.
    name: SSO_PRINCIPAL_ATTRIBUTE
    value: preferred_username
    required: false
  - displayName: LDAP Endpoint
    description: LDAP endpoint to connect for authentication. For failover, set two or more LDAP endpoints separated by space.
    name: AUTH_LDAP_URL
    example: "ldap://myldap.example.com:389"
    required: false
  - displayName: LDAP Flag Login Module
    name: AUTH_LDAP_LOGIN_MODULE
    description: "LDAP login module flag, adds backward compatibility with the legacy security subsystem on Elytron. 'optional' is the only supported value, if set, it will create a distributed realm on Elytron configuration with LDAP and FileSystem realms with the user added using the KIE_ADMIN_USER."
    example: "optional"
    required: false
  - displayName: LDAP login failover
    name: AUTH_LDAP_LOGIN_FAILOVER
    description: "Enable failover, if LDAP Url is unreachable, it will fail over to the KieFsRealm."
    example: "true"
    required: false
  - displayName: LDAP Bind DN
    description: Bind DN used for authentication.
    name: AUTH_LDAP_BIND_DN
    example: "uid=admin,ou=users,ou=example,ou=com"
    required: false
  - displayName: LDAP Bind Credentials
    description: LDAP Credentials used for authentication.
    name: AUTH_LDAP_BIND_CREDENTIAL
    example: "Password"
    required: false
  - displayName: LDAP Base DN
    description: LDAP Base DN of the top-level context to begin the user search.
    name: AUTH_LDAP_BASE_CTX_DN
    example: "ou=users,ou=example,ou=com"
    required: false
  - displayName: LDAP Base Search filter
    description: LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).
    name: AUTH_LDAP_BASE_FILTER
    example: "(uid={0})"
    required: false
  - displayName: LDAP User resursive search
    description: Indicates if the user queries are recursive.
    name: AUTH_LDAP_RECURSIVE_SEARCH
    example: "true"
    required: false
  - displayName: LDAP Search time limit
    description: The timeout in milliseconds for user or role searches.
    name: AUTH_LDAP_SEARCH_TIME_LIMIT
    example: "10000"
    required: false
  - displayName: LDAP Role attributeID
    description: Name of the attribute containing the user roles.
    name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
    example: memberOf
    required: false
  - displayName: LDAP Roles Search DN
    description: The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.
    name: AUTH_LDAP_ROLES_CTX_DN
    example: "ou=groups,ou=example,ou=com"
    required: false
  - displayName: LDAP Role search filter
    description: A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).
    name: AUTH_LDAP_ROLE_FILTER
    example: "(memberOf={1})"
    required: false
  - displayName: LDAP Role recursion
    description: The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.
    name: AUTH_LDAP_ROLE_RECURSION
    example: "1"
    required: false
  - displayName: LDAP Default role
    description: A role included for all authenticated users
    name: AUTH_LDAP_DEFAULT_ROLE
    example: "user"
    required: false
  - displayName: LDAP new identity attributes
    description: "Provide new identities for LDAP  identity mapping, the pattern to be used with this env is 'attribute_name=attribute_value;another_attribute_name=value'"
    name: AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES
    example: sn=BlankSurname;cn=BlankCommonName
    required: false
  - displayName: LDAP follow referrals
    description: "If LDAP referrals should be followed. Corresponds to REFERRAL ('java.naming.referral') environment property. Allowed values: 'ignore', 'follow', 'throw'"
    name: AUTH_LDAP_REFERRAL_MODE
    required: false
  - displayName: Role Mapping roles properties file path or one lined roles
    description: When present, the RoleMapping will be configured to use the provided properties file or roles. This parameter defines the fully-qualified file path and name of a properties file or a set of roles with the following pattern 'role=role1;another-role=role2'. The format of every entry in the file is original_role=role1,role2,role3
    example: role=role1,role3,role4;role7=role,admin
    name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
    required: false
  - displayName: Role Mapper Keep Mapped
    description: When set to 'true' the mapped roles will retain all roles, that have defined mappings. Defaults to false.
    name: AUTH_LDAP_MAPPER_KEEP_MAPPED
    required: false
  - displayName: Role Mapper Keep Non Mapped
    description: When set to 'true' the mapped roles will retain all roles, that have no defined mappings. Defaults to false.
    name: AUTH_LDAP_MAPPER_KEEP_NON_MAPPED
    required: false
  - name: APPFORMER_INFINISPAN_USERNAME
    displayName: Appformer infinispan username
    example: "user"
    description: "Username used for the Datagrid."
    required: true
  - name: APPFORMER_INFINISPAN_PASSWORD
    displayName: Appformer infinispan password
    example: "pass"
    description: "Password used for the Datagrid."
    required: true
objects:
  - kind: ServiceAccount
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-rhdmsvc"
      labels:
        application: "${APPLICATION_NAME}"
  - kind: RoleBinding
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-rhdmsvc-edit"
      labels:
        application: "${APPLICATION_NAME}"
    subjects:
      - kind: ServiceAccount
        name: "${APPLICATION_NAME}-rhdmsvc"
    roleRef:
      name: edit
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 8080
          targetPort: 8080
        - name: https
          port: 8443
          targetPort: 8443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
    metadata:
      name: "${APPLICATION_NAME}-rhdmcentr"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhdmcentr"
      annotations:
        description: All the Decision Central web server's ports.
  - apiVersion: v1
    kind: Service
    metadata:
      name: ${APPLICATION_NAME}-datagrid-ping
      labels:
        application: ${APPLICATION_NAME}
      annotations:
        description: Provides a ping service for clustered applications.
        service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
    spec:
      clusterIP: None
      ports:
        - name: ping
          port: 8888
          targetPort: 8888
      selector:
        deploymentConfig: ${APPLICATION_NAME}-datagrid
  - apiVersion: v1
    kind: Service
    metadata:
      name: ${APPLICATION_NAME}-datagrid
      labels:
        application: ${APPLICATION_NAME}
      annotations:
        description: Provides a service for accessing the application over Hot Rod protocol.
        service.alpha.openshift.io/serving-cert-secret-name: datagrid-service-certs
    spec:
      ports:
        - name: hotrod
          port: 11222
          targetPort: 11222
      selector:
        deploymentConfig: ${APPLICATION_NAME}-datagrid
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 8080
          targetPort: 8080
        - name: https
          port: 8443
          targetPort: 8443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver"
      sessionAffinity: ClientIP
      sessionAffinityConfig:
        clientIP:
          timeoutSeconds: 3600
    metadata:
      name: "${APPLICATION_NAME}-kieserver"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver"
      annotations:
        description: All the KIE Server web server's ports.
  - apiVersion: v1
    kind: Service
    spec:
      clusterIP: None
      ports:
        - port: 61616
          targetPort: 61616
      selector:
        deploymentConfig: "${APPLICATION_NAME}-amq"
    metadata:
      name: "${APPLICATION_NAME}-amq-tcp"
      annotations:
        description: The broker's OpenWire port.
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-amq-tcp"
  - apiVersion: v1
    kind: Service
    spec:
      clusterIP: None
      ports:
        - port: 8888
          protocol: TCP
          targetPort: 8888
      selector:
        deploymentConfig: ${APPLICATION_NAME}-amq
    metadata:
      name: ping
      annotations:
        description: The JGroups ping port for amq clustering.
        service.alpha.kubernetes.io/tolerate-unready-endpoints: 'true'
      labels:
        application: ${APPLICATION_NAME}
        service: ping
  - kind: Route
    apiVersion: v1
    id: "insecure-${APPLICATION_NAME}-rhdmcentr-http"
    metadata:
      name: "insecure-${APPLICATION_NAME}-rhdmcentr"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhdmcentr"
      annotations:
        description: Route for Decision Central's http service.
        haproxy.router.openshift.io/balance: source
        haproxy.router.openshift.io/timeout: 1h
    spec:
      host: "${DECISION_CENTRAL_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-rhdmcentr"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-rhdmcentr-https"
    metadata:
      name: "${APPLICATION_NAME}-rhdmcentr"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhdmcentr"
      annotations:
        description: Route for Decision Central's https service.
        haproxy.router.openshift.io/timeout: 1h
    spec:
      host: "${DECISION_CENTRAL_HOSTNAME_HTTPS}"
      to:
        name: ${APPLICATION_NAME}-rhdmcentr
      port:
        targetPort: https
      tls:
        termination: passthrough
  - kind: Route
    apiVersion: v1
    id: "insecure-${APPLICATION_NAME}-kieserver-http"
    metadata:
      name: "insecure-${APPLICATION_NAME}-kieserver"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver"
      annotations:
        description: Route for KIE Server's http service.
        haproxy.router.openshift.io/balance: source
    spec:
      host: "${KIE_SERVER_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-kieserver"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-kieserver-https"
    metadata:
      name: "${APPLICATION_NAME}-kieserver"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver"
      annotations:
        description: Route for KIE Server's https service.
    spec:
      host: "${KIE_SERVER_HOSTNAME_HTTPS}"
      to:
        name: ${APPLICATION_NAME}-kieserver
      port:
        targetPort: https
      tls:
        termination: passthrough
  - kind: StatefulSet
    apiVersion: apps/v1
    metadata:
      name: ${APPLICATION_NAME}-datagrid
      labels:
        application: ${APPLICATION_NAME}
    spec:
      podManagementPolicy: OrderedReady
      updateStrategy:
        rollingUpdate:
          partition: 0
        type: RollingUpdate
      replicas: 2
      selector:
        matchLabels:
          deploymentConfig: ${APPLICATION_NAME}-datagrid
      serviceName: ${APPLICATION_NAME}-datagrid
      template:
        metadata:
          name: ${APPLICATION_NAME}-datagrid
          labels:
            application: ${APPLICATION_NAME}
            deploymentConfig: ${APPLICATION_NAME}-datagrid
        spec:
          containers:
            - env:
                - name: USER
                  value: ${APPFORMER_INFINISPAN_USERNAME}
                - name: PASS
                  value: ${APPFORMER_INFINISPAN_PASSWORD}
                - name: SERVICE_NAME
                  value: ${APPLICATION_NAME}-datagrid
                - name: SERVICE_PROFILE
                  value: ${APPLICATION_NAME}-datagrid
                - name: JGROUPS_PING_PROTOCOL
                  value: openshift.DNS_PING
                - name: OPENSHIFT_DNS_PING_SERVICE_NAME
                  value: ${APPLICATION_NAME}-datagrid-ping
                - name: INFINISPAN_CONNECTORS
                  value: "hotrod"
              image: ${DATAGRID_IMAGE}
              imagePullPolicy: IfNotPresent
              name: ${APPLICATION_NAME}-datagrid
              ports:
                - containerPort: 8888
                  name: ping
                  protocol: TCP
                - containerPort: 11222
                  name: hotrod
                  protocol: TCP
              livenessProbe:
                httpGet:
                  path: /rest/v2/cache-managers/default/health/status
                  port: 11222
                  scheme: HTTP
                failureThreshold: 5
                initialDelaySeconds: 10
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 40
              readinessProbe:
                httpGet:
                  path: /rest/v2/cache-managers/default/health/status
                  port: 11222
                  scheme: HTTP
                failureThreshold: 5
                initialDelaySeconds: 10
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 40
              resources:
                limits:
                  cpu: ${DATAGRID_CPU_LIMIT}
                  memory: ${DATAGRID_MEMORY_LIMIT}
                requests:
                  cpu: ${DATAGRID_CPU_LIMIT}
                  memory: ${DATAGRID_MEMORY_LIMIT}
              volumeMounts:
                - mountPath: /opt/datagrid/standalone/data
                  name: srv-data
                - mountPath: /var/run/secrets/java.io/keystores
                  name: datagrid-keystore-volume
                - mountPath: /var/run/secrets/openshift.io/serviceaccount
                  name: datagrid-service-certs
          dnsPolicy: ClusterFirst
          restartPolicy: Always
          schedulerName: default-scheduler
          securityContext: {}
          terminationGracePeriodSeconds: 60
          volumes:
            - empty-dir: {}
              name: datagrid-keystore-volume
            - name: datagrid-service-certs
              secret:
                secretName: datagrid-service-certs
      triggers:
        - type: ConfigChange
      volumeClaimTemplates:
        - metadata:
            name: srv-data
          spec:
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: ${DATAGRID_VOLUME_CAPACITY}
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-rhdmcentr"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhdmcentr"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      strategy:
        type: Recreate
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-rhdmcentr"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "${DECISION_CENTRAL_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{DECISION_CENTRAL_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
      template:
        metadata:
          name: "${APPLICATION_NAME}-rhdmcentr"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
            application: "${APPLICATION_NAME}"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.rhdmcentr"
        spec:
          serviceAccountName: "${APPLICATION_NAME}-rhdmsvc"
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-rhdmcentr"
              image: "${DECISION_CENTRAL_IMAGE_STREAM_NAME}"
              imagePullPolicy: Always
              resources:
                limits:
                  cpu: ${DECISION_CENTRAL_CPU_LIMIT}
                  memory: ${DECISION_CENTRAL_MEMORY_LIMIT}
                requests:
                  cpu: ${DECISION_CENTRAL_CPU_REQUEST}
                  memory: ${DECISION_CENTRAL_MEMORY_REQUEST}
              volumeMounts:
                - name: decisioncentral-keystore-volume
                  mountPath: "/etc/decisioncentral-secret-volume"
                  readOnly: true
                - name: "${APPLICATION_NAME}-rhdmcentr-pvol"
                  mountPath: "/opt/kie/data"
              livenessProbe:
                httpGet:
                  path: /rest/healthy
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 180
                timeoutSeconds: 2
                periodSeconds: 15
                failureThreshold: 36
              readinessProbe:
                httpGet:
                  path: /rest/ready
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 60
                timeoutSeconds: 2
                periodSeconds: 5
                failureThreshold: 36
              ports:
                - name: jolokia
                  containerPort: 8778
                  protocol: TCP
                - name: http
                  containerPort: 8080
                  protocol: TCP
                - name: https
                  containerPort: 8443
                  protocol: TCP
              env:
                - name: APPLICATION_USERS_PROPERTIES
                  value: "/opt/kie/data/configuration/application-users.properties"
                - name: APPLICATION_ROLES_PROPERTIES
                  value: "/opt/kie/data/configuration/application-roles.properties"
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: KIE_MBEANS
                  value: "${KIE_MBEANS}"
## OpenShift Enhancement BEGIN
                - name: KIE_SERVER_CONTROLLER_OPENSHIFT_ENABLED
                  value: "true"
                - name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED
                  value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED}"
                - name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE
                  value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}"
                - name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL
                  value: "${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}"
## OpenShift Enhancement END
                - name: KIE_SERVER_CONTROLLER_TOKEN
                  value: "${KIE_SERVER_CONTROLLER_TOKEN}"
                - name: WORKBENCH_ROUTE_NAME
                  value: "${APPLICATION_NAME}-rhdmcentr"
                - name: MAVEN_MIRROR_URL
                  value: "${MAVEN_MIRROR_URL}"
                - name: MAVEN_REPO_ID
                  value: "${MAVEN_REPO_ID}"
                - name: MAVEN_REPO_URL
                  value: "${MAVEN_REPO_URL}"
                - name: MAVEN_REPO_USERNAME
                  value: "${MAVEN_REPO_USERNAME}"
                - name: MAVEN_REPO_PASSWORD
                  value: "${MAVEN_REPO_PASSWORD}"
                - name: GIT_HOOKS_DIR
                  value: "${GIT_HOOKS_DIR}"
                - name: HTTPS_KEYSTORE_DIR
                  value: "/etc/decisioncentral-secret-volume"
                - name: HTTPS_KEYSTORE
                  value: "${DECISION_CENTRAL_HTTPS_KEYSTORE}"
                - name: HTTPS_NAME
                  value: "${DECISION_CENTRAL_HTTPS_NAME}"
                - name: HTTPS_PASSWORD
                  value: "${DECISION_CENTRAL_HTTPS_PASSWORD}"
                - name: JGROUPS_PING_PROTOCOL
                  value: "kubernetes.KUBE_PING"
                - name: KUBERNETES_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: KUBERNETES_LABELS
                  value: "cluster=jgrp.k8s.${APPLICATION_NAME}.rhdmcentr"
                - name: APPFORMER_INFINISPAN_SERVICE_NAME
                  value: "${APPLICATION_NAME}-datagrid"
                - name: APPFORMER_INFINISPAN_PORT
                  value: "11222"
                - name: APPFORMER_INFINISPAN_USERNAME
                  value: "${APPFORMER_INFINISPAN_USERNAME}"
                - name: APPFORMER_INFINISPAN_PASSWORD
                  value: "${APPFORMER_INFINISPAN_PASSWORD}"
                - name: APPFORMER_INFINISPAN_SASL_QOP
                  value: "auth"
                - name: APPFORMER_INFINISPAN_SERVER_NAME
                  value: "infinispan"
                - name: APPFORMER_INFINISPAN_REALM
                  value: "default"
                - name: APPFORMER_JMS_BROKER_ADDRESS
                  value: "${APPLICATION_NAME}-amq-tcp"
                - name: APPFORMER_JMS_BROKER_PORT
                  value: "61616"
                - name: APPFORMER_JMS_BROKER_USER
                  value: "${APPFORMER_JMS_BROKER_USER}"
                - name: APPFORMER_JMS_BROKER_PASSWORD
                  value: "${APPFORMER_JMS_BROKER_PASSWORD}"
                - name: JAVA_MAX_MEM_RATIO
                  value: "${DECISION_CENTRAL_JAVA_MAX_MEM_RATIO}"
                - name: SSO_URL
                  value: "${SSO_URL}"
                - name: SSO_OPENIDCONNECT_DEPLOYMENTS
                  value: "ROOT.war"
                - name: SSO_REALM
                  value: "${SSO_REALM}"
                - name: SSO_SECRET
                  value: "${DECISION_CENTRAL_SSO_SECRET}"
                - name: SSO_CLIENT
                  value: "${DECISION_CENTRAL_SSO_CLIENT}"
                - name: SSO_USERNAME
                  value: "${SSO_USERNAME}"
                - name: SSO_PASSWORD
                  value: "${SSO_PASSWORD}"
                - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
                  value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                - name: SSO_PRINCIPAL_ATTRIBUTE
                  value: "${SSO_PRINCIPAL_ATTRIBUTE}"
                - name: HOSTNAME_HTTP
                  value: "${DECISION_CENTRAL_HOSTNAME_HTTP}"
                - name: HOSTNAME_HTTPS
                  value: "${DECISION_CENTRAL_HOSTNAME_HTTPS}"
                - name: AUTH_LDAP_URL
                  value: "${AUTH_LDAP_URL}"
                - name: AUTH_LDAP_LOGIN_MODULE
                  value: "${AUTH_LDAP_LOGIN_MODULE}"
                - name: AUTH_LDAP_LOGIN_FAILOVER
                  value: "${AUTH_LDAP_LOGIN_FAILOVER}"
                - name: AUTH_LDAP_BIND_DN
                  value: "${AUTH_LDAP_BIND_DN}"
                - name: AUTH_LDAP_BIND_CREDENTIAL
                  value: "${AUTH_LDAP_BIND_CREDENTIAL}"
                - name: AUTH_LDAP_BASE_CTX_DN
                  value: "${AUTH_LDAP_BASE_CTX_DN}"
                - name: AUTH_LDAP_BASE_FILTER
                  value: "${AUTH_LDAP_BASE_FILTER}"
                - name: AUTH_LDAP_RECURSIVE_SEARCH
                  value: "${AUTH_LDAP_RECURSIVE_SEARCH}"
                - name: AUTH_LDAP_SEARCH_TIME_LIMIT
                  value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_ROLES_CTX_DN
                  value: "${AUTH_LDAP_ROLES_CTX_DN}"
                - name: AUTH_LDAP_ROLE_FILTER
                  value: "${AUTH_LDAP_ROLE_FILTER}"
                - name: AUTH_LDAP_ROLE_RECURSION
                  value: "${AUTH_LDAP_ROLE_RECURSION}"
                - name: AUTH_LDAP_DEFAULT_ROLE
                  value: "${AUTH_LDAP_DEFAULT_ROLE}"
                - name: AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES
                  value: "${AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES}"
                - name: AUTH_LDAP_REFERRAL_MODE
                  value: "${AUTH_LDAP_REFERRAL_MODE}"
                - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
                  value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
                - name: AUTH_LDAP_MAPPER_KEEP_MAPPED
                  value: "${AUTH_LDAP_MAPPER_KEEP_MAPPED}"
                - name: AUTH_LDAP_MAPPER_KEEP_NON_MAPPED
                  value: "${AUTH_LDAP_MAPPER_KEEP_NON_MAPPED}"
          volumes:
            - name: decisioncentral-keystore-volume
              secret:
                secretName: "${DECISION_CENTRAL_HTTPS_SECRET}"
            - name: "${APPLICATION_NAME}-rhdmcentr-pvol"
              persistentVolumeClaim:
                claimName: "${APPLICATION_NAME}-rhdmcentr-claim"
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-kieserver"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver"
        services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      revisionHistoryLimit: 10
      strategy:
        rollingParams:
          maxSurge: 100%
          maxUnavailable: 0
        type: Rolling
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-kieserver"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{KIE_SERVER_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver"
      template:
        metadata:
          name: "${APPLICATION_NAME}-kieserver"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-kieserver"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-kieserver"
            services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.kieserver"
        spec:
          serviceAccountName: "${APPLICATION_NAME}-rhdmsvc"
          terminationGracePeriodSeconds: 90
          containers:
            - name: "${APPLICATION_NAME}-kieserver"
              image: "${KIE_SERVER_IMAGE_STREAM_NAME}"
              imagePullPolicy: Always
              lifecycle:
                postStart:
                  exec:
                    command:
                      - /bin/sh
                      - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh
                preStop:
                  exec:
                    command:
                      - /bin/sh
                      - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh
              resources:
                limits:
                  cpu: ${KIE_SERVER_CPU_LIMIT}
                  memory: ${KIE_SERVER_MEMORY_LIMIT}
                requests:
                  cpu: ${KIE_SERVER_CPU_REQUEST}
                  memory: ${KIE_SERVER_MEMORY_REQUEST}
              volumeMounts:
                - name: kieserver-keystore-volume
                  mountPath: "/etc/kieserver-secret-volume"
                  readOnly: true
              livenessProbe:
                httpGet:
                  path: /services/rest/server/healthcheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 180
                timeoutSeconds: 2
                periodSeconds: 15
                failureThreshold: 3
              readinessProbe:
                httpGet:
                  path: /services/rest/server/readycheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 30
                timeoutSeconds: 2
                periodSeconds: 5
                failureThreshold: 36
              ports:
                - name: jolokia
                  containerPort: 8778
                  protocol: TCP
                - name: http
                  containerPort: 8080
                  protocol: TCP
                - name: https
                  containerPort: 8443
                  protocol: TCP
              env:
                - name: WORKBENCH_SERVICE_NAME
                  value: "${APPLICATION_NAME}-rhdmcentr"
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: KIE_SERVER_MODE
                  value: "${KIE_SERVER_MODE}"
                - name: KIE_MBEANS
                  value: "${KIE_MBEANS}"
                - name: DROOLS_SERVER_FILTER_CLASSES
                  value: "${DROOLS_SERVER_FILTER_CLASSES}"
                - name: PROMETHEUS_SERVER_EXT_DISABLED
                  value: "${PROMETHEUS_SERVER_EXT_DISABLED}"
                - name: KIE_SERVER_BYPASS_AUTH_USER
                  value: "${KIE_SERVER_BYPASS_AUTH_USER}"
                - name: KIE_SERVER_CONTROLLER_SERVICE
                  value: "${APPLICATION_NAME}-rhdmcentr"
                - name: KIE_SERVER_CONTROLLER_PROTOCOL
                  value: "ws"
                - name: KIE_SERVER_ID
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.labels['services.server.kie.org/kie-server-id']
                - name: KIE_SERVER_ROUTE_NAME
                  value: "insecure-${APPLICATION_NAME}-kieserver"
                - name: KIE_SERVER_STARTUP_STRATEGY
                  value: "OpenShiftStartupStrategy"
                - name: MAVEN_MIRROR_URL
                  value: "${MAVEN_MIRROR_URL}"
                - name: MAVEN_MIRROR_OF
                  value: "${MAVEN_MIRROR_OF}"
                - name: MAVEN_REPOS
                  value: "RHDMCENTR,EXTERNAL"
                - name: RHDMCENTR_MAVEN_REPO_ID
                  value: "repo-rhdmcentr"
                - name: RHDMCENTR_MAVEN_REPO_SERVICE
                  value: "${APPLICATION_NAME}-rhdmcentr"
                - name: RHDMCENTR_MAVEN_REPO_PATH
                  value: "/maven2/"
                - name: RHDMCENTR_MAVEN_REPO_USERNAME
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: RHDMCENTR_MAVEN_REPO_PASSWORD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: EXTERNAL_MAVEN_REPO_ID
                  value: "${MAVEN_REPO_ID}"
                - name: EXTERNAL_MAVEN_REPO_URL
                  value: "${MAVEN_REPO_URL}"
                - name: EXTERNAL_MAVEN_REPO_USERNAME
                  value: "${MAVEN_REPO_USERNAME}"
                - name: EXTERNAL_MAVEN_REPO_PASSWORD
                  value: "${MAVEN_REPO_PASSWORD}"
                - name: HTTPS_KEYSTORE_DIR
                  value: "/etc/kieserver-secret-volume"
                - name: HTTPS_KEYSTORE
                  value: "${KIE_SERVER_HTTPS_KEYSTORE}"
                - name: HTTPS_NAME
                  value: "${KIE_SERVER_HTTPS_NAME}"
                - name: HTTPS_PASSWORD
                  value: "${KIE_SERVER_HTTPS_PASSWORD}"
                - name: KUBERNETES_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: KUBERNETES_LABELS
                  value: "cluster=jgrp.k8s.${APPLICATION_NAME}.kieserver"
                - name: SSO_URL
                  value: "${SSO_URL}"
                - name: SSO_OPENIDCONNECT_DEPLOYMENTS
                  value: "ROOT.war"
                - name: SSO_REALM
                  value: "${SSO_REALM}"
                - name: SSO_SECRET
                  value: "${KIE_SERVER_SSO_SECRET}"
                - name: SSO_CLIENT
                  value: "${KIE_SERVER_SSO_CLIENT}"
                - name: SSO_USERNAME
                  value: "${SSO_USERNAME}"
                - name: SSO_PASSWORD
                  value: "${SSO_PASSWORD}"
                - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
                  value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                - name: SSO_PRINCIPAL_ATTRIBUTE
                  value: "${SSO_PRINCIPAL_ATTRIBUTE}"
                - name: HOSTNAME_HTTP
                  value: "${KIE_SERVER_HOSTNAME_HTTP}"
                - name: HOSTNAME_HTTPS
                  value: "${KIE_SERVER_HOSTNAME_HTTPS}"
                - name: AUTH_LDAP_URL
                  value: "${AUTH_LDAP_URL}"
                - name: AUTH_LDAP_LOGIN_MODULE
                  value: "${AUTH_LDAP_LOGIN_MODULE}"
                - name: AUTH_LDAP_LOGIN_FAILOVER
                  value: "${AUTH_LDAP_LOGIN_FAILOVER}"
                - name: AUTH_LDAP_BIND_DN
                  value: "${AUTH_LDAP_BIND_DN}"
                - name: AUTH_LDAP_BIND_CREDENTIAL
                  value: "${AUTH_LDAP_BIND_CREDENTIAL}"
                - name: AUTH_LDAP_BASE_CTX_DN
                  value: "${AUTH_LDAP_BASE_CTX_DN}"
                - name: AUTH_LDAP_BASE_FILTER
                  value: "${AUTH_LDAP_BASE_FILTER}"
                - name: AUTH_LDAP_RECURSIVE_SEARCH
                  value: "${AUTH_LDAP_RECURSIVE_SEARCH}"
                - name: AUTH_LDAP_SEARCH_TIME_LIMIT
                  value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_ROLES_CTX_DN
                  value: "${AUTH_LDAP_ROLES_CTX_DN}"
                - name: AUTH_LDAP_ROLE_FILTER
                  value: "${AUTH_LDAP_ROLE_FILTER}"
                - name: AUTH_LDAP_ROLE_RECURSION
                  value: "${AUTH_LDAP_ROLE_RECURSION}"
                - name: AUTH_LDAP_DEFAULT_ROLE
                  value: "${AUTH_LDAP_DEFAULT_ROLE}"
                - name: AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES
                  value: "${AUTH_LDAP_NEW_IDENTITY_ATTRIBUTES}"
                - name: AUTH_LDAP_REFERRAL_MODE
                  value: "${AUTH_LDAP_REFERRAL_MODE}"
                - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
                  value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
                - name: AUTH_LDAP_MAPPER_KEEP_MAPPED
                  value: "${AUTH_LDAP_MAPPER_KEEP_MAPPED}"
                - name: AUTH_LDAP_MAPPER_KEEP_NON_MAPPED
                  value: "${AUTH_LDAP_MAPPER_KEEP_NON_MAPPED}"
          volumes:
            - name: kieserver-keystore-volume
              secret:
                secretName: "${KIE_SERVER_HTTPS_SECRET}"
  - kind: StatefulSet
    apiVersion: apps/v1
    metadata:
      name: ${APPLICATION_NAME}-amq
      annotations:
        alpha.image.policy.openshift.io/resolve-names: '*'
      labels:
        application: ${APPLICATION_NAME}
    spec:
      podManagementPolicy: OrderedReady
      updateStrategy:
        rollingUpdate:
          partition: 0
        type: RollingUpdate
      replicas: ${{AMQ_REPLICAS}}
      revisionHistoryLimit: 10
      selector:
        matchLabels:
          deploymentConfig: ${APPLICATION_NAME}-amq
      serviceName: ${APPLICATION_NAME}-amq-tcp
      template:
        metadata:
          name: ${APPLICATION_NAME}-amq
          labels:
            application: ${APPLICATION_NAME}
            deploymentConfig: ${APPLICATION_NAME}-amq
        spec:
          containers:
            - env:
                - name: AMQ_USER
                  value: "${APPFORMER_JMS_BROKER_USER}"
                - name: AMQ_PASSWORD
                  value: "${APPFORMER_JMS_BROKER_PASSWORD}"
                - name: AMQ_ROLE
                  value: ${AMQ_ROLE}
                - name: AMQ_NAME
                  value: ${AMQ_NAME}
                - name: AMQ_TRANSPORTS
                  value: "openwire"
                - name: AMQ_GLOBAL_MAX_SIZE
                  value: ${AMQ_GLOBAL_MAX_SIZE}
                - name: AMQ_REQUIRE_LOGIN
                - name: AMQ_DATA_DIR
                  value: /opt/amq/data
                - name: AMQ_DATA_DIR_LOGGING
                  value: "true"
                - name: AMQ_CLUSTERED
                  value: "true"
                - name: AMQ_REPLICAS
                  value: "${AMQ_REPLICAS}"
                - name: AMQ_CLUSTER_USER
                  value: ${APPFORMER_JMS_BROKER_USER}
                - name: AMQ_CLUSTER_PASSWORD
                  value: ${APPFORMER_JMS_BROKER_PASSWORD}
                - name: AMQ_EXTRA_ARGS
                - name: AMQ_ANYCAST_PREFIX
                - name: AMQ_MULTICAST_PREFIX
                - name: POD_NAMESPACE
                  valueFrom:
                    fieldRef:
                      apiVersion: v1
                      fieldPath: metadata.namespace
              image: ${AMQ_BROKER_IMAGE}
              imagePullPolicy: IfNotPresent
              name: broker-amq
              ports:
                - containerPort: 8161
                  name: jolokia
                  protocol: TCP
                - containerPort: 5672
                  name: amqp
                  protocol: TCP
                - containerPort: 1883
                  name: mqtt
                  protocol: TCP
                - containerPort: 61613
                  name: stomp
                  protocol: TCP
                - containerPort: 61616
                  name: artemis
                  protocol: TCP
              readinessProbe:
                exec:
                  command:
                    - /bin/bash
                    - -c
                    - /opt/amq/bin/readinessProbe.sh
                failureThreshold: 3
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 1
              resources: {}
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
              volumeMounts:
                - mountPath: /opt/amq/data
                  name: "${APPLICATION_NAME}-amq-pvol"
          dnsPolicy: ClusterFirst
          restartPolicy: Always
          schedulerName: default-scheduler
          securityContext: {}
          terminationGracePeriodSeconds: 60
      volumeClaimTemplates:
        - metadata:
            name: ${APPLICATION_NAME}-amq-pvol
          spec:
            accessModes:
              - ReadWriteOnce
            resources:
              requests:
                storage: ${AMQ_VOLUME_CAPACITY}
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: "${APPLICATION_NAME}-rhdmcentr-claim"
      labels:
        application: "${APPLICATION_NAME}"
    spec:
      accessModes:
        - ReadWriteMany
      resources:
        requests:
          storage: "${DECISION_CENTRAL_VOLUME_CAPACITY}"
