---
kind: Template
apiVersion: v1
metadata:
  annotations:
    iconClass: icon-jboss
    tags: rhdm,decisionserver,jboss,authoring,ha
    version: "7.7"
    openshift.io/display-name: Red Hat Decision Manager 7.7 authoring environment (HA, persistent, with https)
    openshift.io/provider-display-name: Red Hat, Inc.
    description: Application template for a HA persistent authoring environment, for Red Hat Decision Manager 7.7 - Deprecated
    template.openshift.io/long-description: This template defines resources needed to develop and execute Rules on Red Hat Decision Manager 7.7 with High Availability enabled as tech preview, including application deployment configuration, secure and insecure http communication and persistent volumes to store data that needs to survive a restart. Template for Red Hat OpenShift Container Platform version 3.11. Deprecated since Red Hat Decision Manager version 7.5; consider using the Red Hat Business Automation Operator.
    template.openshift.io/documentation-url: https://access.redhat.com/documentation/en-us/red_hat_decision_manager/7.7/html/deploying_a_red_hat_decision_manager_7.7_authoring_environment_on_red_hat_openshift_container_platform/
    template.openshift.io/support-url: https://access.redhat.com
    template.openshift.io/bindable: "false"
  name: rhdm77-authoring-ha
labels:
  template: rhdm77-authoring-ha
  rhdm: "7.7"
message: |-
          A new persistent HA Decision Manager application has been created in your project.
          The username/password needed for accessing the application are stored in "${CREDENTIALS_SECRET}" secret as
          KIE_ADMIN_USER and KIE_ADMIN_PWD

          You must create the secret named "${CREDENTIALS_SECRET}" containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values and the secrets named "${BUSINESS_CENTRAL_HTTPS_SECRET}" and "${KIE_SERVER_HTTPS_SECRET}"
          containing the ${BUSINESS_CENTRAL_HTTPS_KEYSTORE} and ${KIE_SERVER_HTTPS_KEYSTORE} files used for serving secure content.
parameters:
- displayName: Application Name
  description: The name for the application.
  name: APPLICATION_NAME
  value: myapp
  required: true
- displayName: Credentials secret
  description: Secret containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values.
  name: CREDENTIALS_SECRET
  example: rhpam-credentials
  required: true
- displayName: KIE Server Controller Token
  description: KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)
  name: KIE_SERVER_CONTROLLER_TOKEN
  required: false
- displayName: KIE Server Bypass Auth User
  description: Allows the KIE server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property)
  name: KIE_SERVER_BYPASS_AUTH_USER
  value: 'false'
  required: false
- displayName: KIE Server Mode
  description: "The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property)."
  name: KIE_SERVER_MODE
  value: "DEVELOPMENT"
  required: false
- displayName: KIE MBeans
  description: KIE server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)
  name: KIE_MBEANS
  value: enabled
  required: false
- displayName: Drools Server Filter Classes
  description: KIE server class filtering. (Sets the org.drools.server.filter.classes system property)
  name: DROOLS_SERVER_FILTER_CLASSES
  value: 'true'
  required: false
- displayName: Prometheus Server Extension Disabled
  description: If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)
  name: PROMETHEUS_SERVER_EXT_DISABLED
  example: 'false'
  required: false
- displayName: Decision Central Custom http Route Hostname
  description: 'Custom hostname for http service route for Decision Central.  Leave blank for default hostname, e.g.: insecure-<application-name>-rhdmcentr-<project>.<default-domain-suffix>'
  name: DECISION_CENTRAL_HOSTNAME_HTTP
  value: ''
  required: false
- displayName: Decision Central Custom https Route Hostname
  description: 'Custom hostname for https service route for Decision Central.  Leave blank for default hostname, e.g.: <application-name>-rhdmcentr-<project>.<default-domain-suffix>'
  name: DECISION_CENTRAL_HOSTNAME_HTTPS
  value: ''
  required: false
- displayName: KIE Server Custom http Route Hostname
  description: 'Custom hostname for http service route for KIE Server. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>'
  name: KIE_SERVER_HOSTNAME_HTTP
  value: ''
  required: false
- displayName: KIE Server Custom https Route Hostname
  description: 'Custom hostname for https service route for KIE Server. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>'
  name: KIE_SERVER_HOSTNAME_HTTPS
  value: ''
  required: false
- displayName: Decision Central Server Keystore Secret Name
  description: The name of the secret containing the keystore file for Decision Central.
  name: DECISION_CENTRAL_HTTPS_SECRET
  example: decisioncentral-app-secret
  required: true
- displayName: Decision Central Server Keystore Filename
  description: The name of the keystore file within the secret for Decision Central.
  name: DECISION_CENTRAL_HTTPS_KEYSTORE
  value: keystore.jks
  required: false
- displayName: Decision Central Server Certificate Name
  description: The name associated with the server certificate for Decision Central.
  name: DECISION_CENTRAL_HTTPS_NAME
  value: jboss
  required: false
- displayName: Decision Central Server Keystore Password
  description: The password for the keystore and certificate for Decision Central.
  name: DECISION_CENTRAL_HTTPS_PASSWORD
  value: mykeystorepass
  required: false
- displayName: KIE Server Keystore Secret Name
  description: The name of the secret containing the keystore file for KIE Server.
  name: KIE_SERVER_HTTPS_SECRET
  example: kieserver-app-secret
  required: true
- displayName: KIE Server Keystore Filename
  description: The name of the keystore file within the secret for KIE Server.
  name: KIE_SERVER_HTTPS_KEYSTORE
  value: keystore.jks
  required: false
- displayName: KIE Server Certificate Name
  description: The name associated with the server certificate for KIE Server.
  name: KIE_SERVER_HTTPS_NAME
  value: jboss
  required: false
- displayName: KIE Server Keystore Password
  description: The password for the keystore and certificate for KIE Server.
  name: KIE_SERVER_HTTPS_PASSWORD
  value: mykeystorepass
  required: false
- displayName: AppFormer JMS Broker user name
  description: The user name to connect to the JMS broker.
  name: APPFORMER_JMS_BROKER_USER
  required: true
  value: jmsBrokerUser
- displayName: AppFormer JMS Broker password
  description: The password to connect to the JMS broker.
  name: APPFORMER_JMS_BROKER_PASSWORD
  from: "[a-zA-Z]{6}[0-9]{1}!"
  generate: expression
  required: true
- displayName: DataGrid Image
  description: DataGrid image.
  name: DATAGRID_IMAGE
  value: registry.redhat.io/jboss-datagrid-7/datagrid73-openshift:1.5
  required: true
- displayName: DataGrid Container CPU Limit
  description: DataGrid Container CPU limit.
  name: DATAGRID_CPU_LIMIT
  value: "1000m"
  required: true
- displayName: DataGrid Container Memory Limit
  description: DataGrid Container memory limit.
  name: DATAGRID_MEMORY_LIMIT
  value: "2Gi"
  required: true
- displayName: DataGrid Volume Capacity
  description: Size of the persistent storage for DataGrid's runtime data.
  name: DATAGRID_VOLUME_CAPACITY
  value: "1Gi"
  required: true
- description: AMQ Broker Image
  displayName: Image
  name: AMQ_BROKER_IMAGE
  required: true
  value: registry.redhat.io/amq7/amq-broker:7.5
- displayName: AMQ Role
  description: User role for standard broker user.
  name: AMQ_ROLE
  value: admin
  required: true
- displayName: AMQ Name
  description: The name of the broker.
  name: AMQ_NAME
  value: broker
  required: true
- displayName: AMQ Global Max Size
  description: Specifies the maximum amount of memory that message data can consume. If no value is specified, half of the system’s memory is allocated.
  name: AMQ_GLOBAL_MAX_SIZE
  example: 10 gb
  required: false
- displayName: Broker Volume Capacity
  description: Size of persistent storage for AMQ broker volume.
  name: AMQ_VOLUME_CAPACITY
  value: 1Gi
  required: true
- description: Number of broker replicas for a cluster
  displayName: Number of Replicas
  name: AMQ_REPLICAS
  required: true
  value: "2"
## OpenShift Enhancement BEGIN
- displayName: Enable KIE server global discovery
  description: "If set to true, turns on KIE server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)"
  name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED
  value: "false"
  required: false
- displayName: Prefer KIE Server OpenShift Service
  description: If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)
  name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE
  value: "true"
  required: false
- displayName: KIE ServerTemplate Cache TTL
  description: KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property)
  name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL
  value: "60000"
  required: false
## OpenShift Enhancement END
- displayName: ImageStream Namespace
  description: Namespace in which the ImageStreams for Red Hat Decision Manager images are
    installed. These ImageStreams are normally installed in the openshift namespace.
    You need to modify this parameter only if you installed the ImageStreams in a
    different namespace/project.
  name: IMAGE_STREAM_NAMESPACE
  value: openshift
  required: true
- displayName: Decision Central ImageStream Name
  description: The name of the image stream to use for Decision Central. Default is "rhdm-decisioncentral-rhel8".
  name: DECISION_CENTRAL_IMAGE_STREAM_NAME
  value: "rhdm-decisioncentral-rhel8"
  required: true
- displayName: KIE Server ImageStream Name
  description: The name of the image stream to use for KIE server. Default is "rhdm-kieserver-rhel8".
  name: KIE_SERVER_IMAGE_STREAM_NAME
  value: "rhdm-kieserver-rhel8"
  required: true
- displayName: ImageStream Tag
  description: A named pointer to an image in an image stream. Default is "7.7.1".
  name: IMAGE_STREAM_TAG
  value: "7.7.1"
  required: true
- displayName: Maven mirror URL
  description: Maven mirror that Decision Central and KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.
  name: MAVEN_MIRROR_URL
  required: false
- displayName: Maven mirror of
  description: Maven mirror configuration for KIE server.
  name: MAVEN_MIRROR_OF
  value: "external:*,!repo-rhdmcentr"
  required: false
- displayName: Maven repository ID
  description: "The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhdmcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won't be usable in MAVEN_MIRROR_OF."
  name: MAVEN_REPO_ID
  value: repo-custom
  required: false
- displayName: Maven repository URL
  description: Fully qualified URL to a Maven repository or service.
  name: MAVEN_REPO_URL
  example: http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/
  required: false
- displayName: Maven repository user name
  description: User name for accessing the Maven repository, if required.
  name: MAVEN_REPO_USERNAME
  required: false
- displayName: Maven repository password
  description: Password to access the Maven repository, if required.
  name: MAVEN_REPO_PASSWORD
  required: false
- displayName: Git hooks directory
  description: The directory to use for git hooks, if required.
  name: GIT_HOOKS_DIR
  example: /opt/kie/data/git/hooks
  required: false
- displayName: Decision Central Volume Capacity
  description: Size of the persistent storage for Decision Central's runtime data.
  name: DECISION_CENTRAL_VOLUME_CAPACITY
  value: 1Gi
  required: true
- displayName: Decision Central Container Memory Limit
  description: Decision Central Container memory limit.
  name: DECISION_CENTRAL_MEMORY_LIMIT
  value: "8Gi"
  required: true
- displayName: Decision Central Container JVM Max Memory Ratio
  description: Decision Central Container JVM max memory ratio. -Xmx is set to a ratio of the memory available on the container. The default is 80, which means the upper boundary is 80% of the available memory. To skip adding the -Xmx option, set this value to 0.
  name: DECISION_CENTRAL_JAVA_MAX_MEM_RATIO
  value: "80"
  required: true
- displayName: Decision Central Container CPU Limit
  description: Decision Central Container CPU limit.
  name: DECISION_CENTRAL_CPU_LIMIT
  value: "2000m"
  required: true
- displayName: KIE Server Container Memory Limit
  description: KIE server Container memory limit.
  name: KIE_SERVER_MEMORY_LIMIT
  value: "1Gi"
  required: true
- displayName: KIE Server Container CPU Limit
  description: KIE server Container CPU limit.
  name: KIE_SERVER_CPU_LIMIT
  value: "1000m"
  required: true
- displayName: RH-SSO URL
  description: RH-SSO URL.
  name: SSO_URL
  example: https://rh-sso.example.com/auth
  required: false
- displayName: RH-SSO Realm name
  description: RH-SSO Realm name.
  name: SSO_REALM
  required: false
- displayName: Decision Central RH-SSO Client name
  description: Decision Central RH-SSO Client name.
  name: DECISION_CENTRAL_SSO_CLIENT
  required: false
- displayName: Decision Central RH-SSO Client Secret
  description: Decision Central RH-SSO Client Secret.
  name: DECISION_CENTRAL_SSO_SECRET
  example: "252793ed-7118-4ca8-8dab-5622fa97d892"
  required: false
- displayName: KIE Server RH-SSO Client name
  description: KIE Server RH-SSO Client name.
  name: KIE_SERVER_SSO_CLIENT
  required: false
- displayName: KIE Server RH-SSO Client Secret
  description: KIE Server RH-SSO Client Secret.
  name: KIE_SERVER_SSO_SECRET
  example: "252793ed-7118-4ca8-8dab-5622fa97d892"
  required: false
- displayName: RH-SSO Realm admin user name
  description: RH-SSO Realm admin user name used to create the Client if it doesn't exist.
  name: SSO_USERNAME
  required: false
- displayName: RH-SSO Realm Admin Password
  description: RH-SSO Realm Admin Password used to create the Client.
  name: SSO_PASSWORD
  required: false
- displayName: RH-SSO Disable SSL Certificate Validation
  description: RH-SSO Disable SSL Certificate Validation.
  name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
  value: "false"
  required: false
- displayName: RH-SSO Principal Attribute
  description: RH-SSO Principal Attribute to use as user name.
  name: SSO_PRINCIPAL_ATTRIBUTE
  value: preferred_username
  required: false
- displayName: LDAP Endpoint
  description: LDAP Endpoint to connect for authentication.
  name: AUTH_LDAP_URL
  example: "ldap://myldap.example.com"
  required: false
- displayName: LDAP Bind DN
  description: Bind DN used for authentication.
  name: AUTH_LDAP_BIND_DN
  example: "uid=admin,ou=users,ou=example,ou=com"
  required: false
- displayName: LDAP Bind Credentials
  description: LDAP Credentials used for authentication.
  name: AUTH_LDAP_BIND_CREDENTIAL
  example: "Password"
  required: false
- displayName: LDAP JAAS Security Domain
  description: The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.
  name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
  required: false
- displayName: LDAP Base DN
  description: LDAP Base DN of the top-level context to begin the user search.
  name: AUTH_LDAP_BASE_CTX_DN
  example: "ou=users,ou=example,ou=com"
  required: false
- displayName: LDAP Base Search filter
  description: LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).
  name: AUTH_LDAP_BASE_FILTER
  example: "(uid={0})"
  required: false
- displayName: LDAP Search scope
  description: The search scope to use.
  name: AUTH_LDAP_SEARCH_SCOPE
  example: "SUBTREE_SCOPE"
  required: false
- displayName: LDAP Search time limit
  description: The timeout in milliseconds for user or role searches.
  name: AUTH_LDAP_SEARCH_TIME_LIMIT
  example: "10000"
  required: false
- displayName: LDAP DN attribute
  description: The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.
  name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
  example: "distinguishedName"
  required: false
- displayName: LDAP Parse username
  description: A flag indicating if the DN is to be parsed for the user name. If set to true, the DN is parsed for the user name. If set to false the DN is not parsed for the user name. This option is used together with usernameBeginString and usernameEndString.
  name: AUTH_LDAP_PARSE_USERNAME
  example: "true"
  required: false
- displayName: LDAP Username begin string
  description: Defines the String which is to be removed from the start of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.
  name: AUTH_LDAP_USERNAME_BEGIN_STRING
  required: false
- displayName: LDAP Username end string
  description: Defines the String which is to be removed from the end of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.
  name: AUTH_LDAP_USERNAME_END_STRING
  required: false
- displayName: LDAP Role attributeID
  description: Name of the attribute containing the user roles.
  name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
  example: memberOf
  required: false
- displayName: LDAP Roles Search DN
  description: The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.
  name: AUTH_LDAP_ROLES_CTX_DN
  example: "ou=groups,ou=example,ou=com"
  required: false
- displayName: LDAP Role search filter
  description: A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).
  name: AUTH_LDAP_ROLE_FILTER
  example: "(memberOf={1})"
  required: false
- displayName: LDAP Role recursion
  description: The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.
  name: AUTH_LDAP_ROLE_RECURSION
  example: "1"
  required: false
- displayName: LDAP Default role
  description: A role included for all authenticated users
  name: AUTH_LDAP_DEFAULT_ROLE
  example: "user"
  required: false
- displayName: LDAP Role name attribute ID
  description: Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.
  name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
  example: "name"
  required: false
- displayName: LDAP Role DN contains roleNameAttributeID
  description: A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.
  name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
  example: "false"
  required: false
- displayName: LDAP Role Attribute ID is DN
  description: Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.
  name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
  example: "false"
  required: false
- displayName: LDAP Referral user attribute ID
  description: If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.
  name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
  required: false
- displayName: RoleMapping rolesProperties file path
  description: When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3
  name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
  required: false
- displayName: RoleMapping replaceRole property
  description: Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.
  name: AUTH_ROLE_MAPPER_REPLACE_ROLE
  required: false
objects:
- kind: ServiceAccount
  apiVersion: v1
  metadata:
    name: "${APPLICATION_NAME}-rhdmsvc"
    labels:
      application: "${APPLICATION_NAME}"
- kind: RoleBinding
  apiVersion: v1
  metadata:
     name: "${APPLICATION_NAME}-rhdmsvc-edit"
     labels:
       application: "${APPLICATION_NAME}"
  subjects:
  - kind: ServiceAccount
    name: "${APPLICATION_NAME}-rhdmsvc"
  roleRef:
    name: edit
- kind: Service
  apiVersion: v1
  spec:
    ports:
    - name: http
      port: 8080
      targetPort: 8080
    - name: https
      port: 8443
      targetPort: 8443
    selector:
      deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
  metadata:
    name: "${APPLICATION_NAME}-rhdmcentr"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-rhdmcentr"
    annotations:
      description: All the Decision Central web server's ports.
- kind: Service
  apiVersion: v1
  spec:
    clusterIP: "None"
    ports:
    - name: "ping"
      port: 8888
      targetPort: 8888
    selector:
      deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
  metadata:
    name: "${APPLICATION_NAME}-rhdmcentr-ping"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-rhdmcentr-ping"
    annotations:
      service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
      description: "The JGroups ping port for rhdmcentr clustering."
- apiVersion: v1
  kind: Service
  metadata:
    name: ${APPLICATION_NAME}-datagrid-ping
    labels:
      application: ${APPLICATION_NAME}
    annotations:
      description: Provides a ping service for clustered applications.
      service.alpha.kubernetes.io/tolerate-unready-endpoints: "true"
  spec:
    clusterIP: None
    ports:
    - name: ping
      port: 8888
      targetPort: 8888
    selector:
      deploymentConfig: ${APPLICATION_NAME}-datagrid
- apiVersion: v1
  kind: Service
  metadata:
    name: ${APPLICATION_NAME}-datagrid
    labels:
      application: ${APPLICATION_NAME}
    annotations:
      description: Provides a service for accessing the application over Hot Rod protocol.
      service.alpha.openshift.io/serving-cert-secret-name: datagrid-service-certs
  spec:
    ports:
    - name: hotrod
      port: 11222
      targetPort: 11222
    selector:
      deploymentConfig: ${APPLICATION_NAME}-datagrid
- kind: Service
  apiVersion: v1
  spec:
    ports:
    - name: http
      port: 8080
      targetPort: 8080
    - name: https
      port: 8443
      targetPort: 8443
    selector:
      deploymentConfig: "${APPLICATION_NAME}-kieserver"
    sessionAffinity:
      ClientIP
    sessionAffinityConfig:
      clientIP:
        timeoutSeconds: 3600
  metadata:
    name: "${APPLICATION_NAME}-kieserver"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-kieserver"
    annotations:
      description: All the KIE server web server's ports.
- apiVersion: v1
  kind: Service
  spec:
    clusterIP: None
    ports:
    - port: 61616
      targetPort: 61616
    selector:
      deploymentConfig: "${APPLICATION_NAME}-amq"
  metadata:
    name: "${APPLICATION_NAME}-amq-tcp"
    annotations:
      description: The broker's OpenWire port.
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-amq-tcp"
- apiVersion: v1
  kind: Service
  spec:
    clusterIP: None
    ports:
      - port: 8888
        protocol: TCP
        targetPort: 8888
    selector:
      deploymentConfig: ${APPLICATION_NAME}-amq
  metadata:
    name: ping
    annotations:
      description: The JGroups ping port for amq clustering.
      service.alpha.kubernetes.io/tolerate-unready-endpoints: 'true'
    labels:
      application: ${APPLICATION_NAME}
      service: ping
- kind: Route
  apiVersion: v1
  id: "insecure-${APPLICATION_NAME}-rhdmcentr-http"
  metadata:
    name: "insecure-${APPLICATION_NAME}-rhdmcentr"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-rhdmcentr"
    annotations:
      description: Route for Decision Central's http service.
      haproxy.router.openshift.io/balance: source
      haproxy.router.openshift.io/timeout: 1h
  spec:
    host: "${DECISION_CENTRAL_HOSTNAME_HTTP}"
    to:
      name: "${APPLICATION_NAME}-rhdmcentr"
    port:
      targetPort: http
- kind: Route
  apiVersion: v1
  id: "${APPLICATION_NAME}-rhdmcentr-https"
  metadata:
    name: "${APPLICATION_NAME}-rhdmcentr"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-rhdmcentr"
    annotations:
      description: Route for Decision Central's https service.
      haproxy.router.openshift.io/timeout: 1h
  spec:
    host: "${DECISION_CENTRAL_HOSTNAME_HTTPS}"
    to:
      name: ${APPLICATION_NAME}-rhdmcentr
    port:
      targetPort: https
    tls:
      termination: passthrough
- kind: Route
  apiVersion: v1
  id: "insecure-${APPLICATION_NAME}-kieserver-http"
  metadata:
    name: "insecure-${APPLICATION_NAME}-kieserver"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-kieserver"
    annotations:
      description: Route for KIE server's http service.
      haproxy.router.openshift.io/balance: source
  spec:
    host: "${KIE_SERVER_HOSTNAME_HTTP}"
    to:
      name: "${APPLICATION_NAME}-kieserver"
    port:
      targetPort: http
- kind: Route
  apiVersion: v1
  id: "${APPLICATION_NAME}-kieserver-https"
  metadata:
    name: "${APPLICATION_NAME}-kieserver"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-kieserver"
    annotations:
      description: Route for KIE server's https service.
  spec:
    host: "${KIE_SERVER_HOSTNAME_HTTPS}"
    to:
      name: ${APPLICATION_NAME}-kieserver
    port:
      targetPort: https
    tls:
      termination: passthrough
- kind: StatefulSet
  apiVersion: apps/v1
  metadata:
    name: ${APPLICATION_NAME}-datagrid
    labels:
      application: ${APPLICATION_NAME}
  spec:
    podManagementPolicy: OrderedReady
    updateStrategy:
      rollingUpdate:
        partition: 0
      type: RollingUpdate
    replicas: 2
    selector:
      matchLabels:
        deploymentConfig: ${APPLICATION_NAME}-datagrid
    serviceName: ${APPLICATION_NAME}-datagrid
    template:
      metadata:
        name: ${APPLICATION_NAME}-datagrid
        labels:
          application: ${APPLICATION_NAME}
          deploymentConfig: ${APPLICATION_NAME}-datagrid
      spec:
        containers:
        - env:
          - name: SERVICE_NAME
            value: ${APPLICATION_NAME}-datagrid
          - name: SERVICE_PROFILE
            value: ${APPLICATION_NAME}-datagrid
          - name: JGROUPS_PING_PROTOCOL
            value: openshift.DNS_PING
          - name: OPENSHIFT_DNS_PING_SERVICE_NAME
            value: ${APPLICATION_NAME}-datagrid-ping
          - name: INFINISPAN_CONNECTORS
            value: "hotrod"
          image: ${DATAGRID_IMAGE}
          imagePullPolicy: IfNotPresent
          name: ${APPLICATION_NAME}-datagrid
          ports:
          - containerPort: 8888
            name: ping
            protocol: TCP
          - containerPort: 11222
            name: hotrod
            protocol: TCP
          livenessProbe:
            exec:
              command:
              - /opt/datagrid/bin/livenessProbe.sh
            failureThreshold: 5
            initialDelaySeconds: 15
            periodSeconds: 20
            successThreshold: 1
            timeoutSeconds: 10
          readinessProbe:
            exec:
              command:
              - /opt/datagrid/bin/readinessProbe.sh
            failureThreshold: 5
            initialDelaySeconds: 17
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 10
          resources:
            limits:
              cpu: ${DATAGRID_CPU_LIMIT}
              memory: ${DATAGRID_MEMORY_LIMIT}
            requests:
              cpu: ${DATAGRID_CPU_LIMIT}
              memory: ${DATAGRID_MEMORY_LIMIT}
          volumeMounts:
          - mountPath: /opt/datagrid/standalone/data
            name: srv-data
          - mountPath: /var/run/secrets/java.io/keystores
            name: datagrid-keystore-volume
          - mountPath: /var/run/secrets/openshift.io/serviceaccount
            name: datagrid-service-certs
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 60
        volumes:
        - empty-dir: {}
          name: datagrid-keystore-volume
        - name: datagrid-service-certs
          secret:
            secretName: datagrid-service-certs
    triggers:
    - type: ConfigChange
    volumeClaimTemplates:
    - metadata:
        name: srv-data
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: ${DATAGRID_VOLUME_CAPACITY}
- kind: DeploymentConfig
  apiVersion: v1
  metadata:
    name: "${APPLICATION_NAME}-rhdmcentr"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-rhdmcentr"
    annotations:
      template.alpha.openshift.io/wait-for-ready: "true"
  spec:
    strategy:
      type: Recreate
    triggers:
    - type: ImageChange
      imageChangeParams:
        automatic: true
        containerNames:
        - "${APPLICATION_NAME}-rhdmcentr"
        from:
          kind: ImageStreamTag
          namespace: "${IMAGE_STREAM_NAMESPACE}"
          name: "${DECISION_CENTRAL_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
    - type: ConfigChange
    replicas: 2
    selector:
      deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
    template:
      metadata:
        name: "${APPLICATION_NAME}-rhdmcentr"
        labels:
          deploymentConfig: "${APPLICATION_NAME}-rhdmcentr"
          application: "${APPLICATION_NAME}"
      spec:
        serviceAccountName: "${APPLICATION_NAME}-rhdmsvc"
        terminationGracePeriodSeconds: 60
        containers:
        - name: "${APPLICATION_NAME}-rhdmcentr"
          image: "${DECISION_CENTRAL_IMAGE_STREAM_NAME}"
          imagePullPolicy: Always
          resources:
            limits:
              cpu: ${DECISION_CENTRAL_CPU_LIMIT}
              memory: ${DECISION_CENTRAL_MEMORY_LIMIT}
            requests:
              cpu: ${DECISION_CENTRAL_CPU_LIMIT}
              memory: ${DECISION_CENTRAL_MEMORY_LIMIT}
          volumeMounts:
          - name: decisioncentral-keystore-volume
            mountPath: "/etc/decisioncentral-secret-volume"
            readOnly: true
          - name: "${APPLICATION_NAME}-rhdmcentr-pvol"
            mountPath: "/opt/kie/data"
          livenessProbe:
            httpGet:
              path: /rest/healthy
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 2
            periodSeconds: 15
          readinessProbe:
            httpGet:
              path: /rest/ready
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            timeoutSeconds: 2
            periodSeconds: 5
            failureThreshold: 36
          ports:
          - name: jolokia
            containerPort: 8778
            protocol: TCP
          - name: http
            containerPort: 8080
            protocol: TCP
          - name: https
            containerPort: 8443
            protocol: TCP
          - name: ping
            containerPort: 8888
            protocol: TCP
          env:
          - name: APPLICATION_USERS_PROPERTIES
            value: "/opt/kie/data/configuration/application-users.properties"
          - name: APPLICATION_ROLES_PROPERTIES
            value: "/opt/kie/data/configuration/application-roles.properties"
          - name: KIE_ADMIN_USER
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_USER
          - name: KIE_ADMIN_PWD
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_PWD
          - name: KIE_MBEANS
            value: "${KIE_MBEANS}"
## OpenShift Enhancement BEGIN
          - name: KIE_SERVER_CONTROLLER_OPENSHIFT_ENABLED
            value: "true"
          - name: KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED
            value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED}"
          - name: KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE
            value: "${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}"
          - name: KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL
            value: "${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}"
## OpenShift Enhancement END
          - name: KIE_SERVER_CONTROLLER_TOKEN
            value: "${KIE_SERVER_CONTROLLER_TOKEN}"
          - name: WORKBENCH_ROUTE_NAME
            value: "${APPLICATION_NAME}-rhdmcentr"
          - name: MAVEN_MIRROR_URL
            value: "${MAVEN_MIRROR_URL}"
          - name: MAVEN_REPO_ID
            value: "${MAVEN_REPO_ID}"
          - name: MAVEN_REPO_URL
            value: "${MAVEN_REPO_URL}"
          - name: MAVEN_REPO_USERNAME
            value: "${MAVEN_REPO_USERNAME}"
          - name: MAVEN_REPO_PASSWORD
            value: "${MAVEN_REPO_PASSWORD}"
          - name: GIT_HOOKS_DIR
            value: "${GIT_HOOKS_DIR}"
          - name: HTTPS_KEYSTORE_DIR
            value: "/etc/decisioncentral-secret-volume"
          - name: HTTPS_KEYSTORE
            value: "${DECISION_CENTRAL_HTTPS_KEYSTORE}"
          - name: HTTPS_NAME
            value: "${DECISION_CENTRAL_HTTPS_NAME}"
          - name: HTTPS_PASSWORD
            value: "${DECISION_CENTRAL_HTTPS_PASSWORD}"
          - name: JGROUPS_PING_PROTOCOL
            value: "openshift.DNS_PING"
          - name: OPENSHIFT_DNS_PING_SERVICE_NAME
            value: "${APPLICATION_NAME}-rhdmcentr-ping"
          - name: OPENSHIFT_DNS_PING_SERVICE_PORT
            value: "8888"
          - name: APPFORMER_INFINISPAN_SERVICE_NAME
            value: "${APPLICATION_NAME}-datagrid"
          - name: APPFORMER_INFINISPAN_PORT
            value: "11222"
          - name: APPFORMER_JMS_BROKER_ADDRESS
            value: "${APPLICATION_NAME}-amq-tcp"
          - name: APPFORMER_JMS_BROKER_PORT
            value: "61616"
          - name: APPFORMER_JMS_BROKER_USER
            value: "${APPFORMER_JMS_BROKER_USER}"
          - name: APPFORMER_JMS_BROKER_PASSWORD
            value: "${APPFORMER_JMS_BROKER_PASSWORD}"
          - name: JAVA_MAX_MEM_RATIO
            value: "${DECISION_CENTRAL_JAVA_MAX_MEM_RATIO}"
          - name: SSO_URL
            value: "${SSO_URL}"
          - name: SSO_OPENIDCONNECT_DEPLOYMENTS
            value: "ROOT.war"
          - name: SSO_REALM
            value: "${SSO_REALM}"
          - name: SSO_SECRET
            value: "${DECISION_CENTRAL_SSO_SECRET}"
          - name: SSO_CLIENT
            value: "${DECISION_CENTRAL_SSO_CLIENT}"
          - name: SSO_USERNAME
            value: "${SSO_USERNAME}"
          - name: SSO_PASSWORD
            value: "${SSO_PASSWORD}"
          - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
            value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
          - name: SSO_PRINCIPAL_ATTRIBUTE
            value: "${SSO_PRINCIPAL_ATTRIBUTE}"
          - name: HOSTNAME_HTTP
            value: "${DECISION_CENTRAL_HOSTNAME_HTTP}"
          - name: HOSTNAME_HTTPS
            value: "${DECISION_CENTRAL_HOSTNAME_HTTPS}"
          - name: AUTH_LDAP_URL
            value: "${AUTH_LDAP_URL}"
          - name: AUTH_LDAP_BIND_DN
            value: "${AUTH_LDAP_BIND_DN}"
          - name: AUTH_LDAP_BIND_CREDENTIAL
            value: "${AUTH_LDAP_BIND_CREDENTIAL}"
          - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
            value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}"
          - name: AUTH_LDAP_BASE_CTX_DN
            value: "${AUTH_LDAP_BASE_CTX_DN}"
          - name: AUTH_LDAP_BASE_FILTER
            value: "${AUTH_LDAP_BASE_FILTER}"
          - name: AUTH_LDAP_SEARCH_SCOPE
            value: "${AUTH_LDAP_SEARCH_SCOPE}"
          - name: AUTH_LDAP_SEARCH_TIME_LIMIT
            value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
          - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
            value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}"
          - name: AUTH_LDAP_PARSE_USERNAME
            value: "${AUTH_LDAP_PARSE_USERNAME}"
          - name: AUTH_LDAP_USERNAME_BEGIN_STRING
            value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}"
          - name: AUTH_LDAP_USERNAME_END_STRING
            value: "${AUTH_LDAP_USERNAME_END_STRING}"
          - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
            value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
          - name: AUTH_LDAP_ROLES_CTX_DN
            value: "${AUTH_LDAP_ROLES_CTX_DN}"
          - name: AUTH_LDAP_ROLE_FILTER
            value: "${AUTH_LDAP_ROLE_FILTER}"
          - name: AUTH_LDAP_ROLE_RECURSION
            value: "${AUTH_LDAP_ROLE_RECURSION}"
          - name: AUTH_LDAP_DEFAULT_ROLE
            value: "${AUTH_LDAP_DEFAULT_ROLE}"
          - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
            value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}"
          - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
            value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}"
          - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
            value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}"
          - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
            value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}"
          - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
            value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
          - name: AUTH_ROLE_MAPPER_REPLACE_ROLE
            value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}"
        volumes:
        - name: decisioncentral-keystore-volume
          secret:
            secretName: "${DECISION_CENTRAL_HTTPS_SECRET}"
        - name: "${APPLICATION_NAME}-rhdmcentr-pvol"
          persistentVolumeClaim:
            claimName: "${APPLICATION_NAME}-rhdmcentr-claim"
- kind: DeploymentConfig
  apiVersion: v1
  metadata:
    name: "${APPLICATION_NAME}-kieserver"
    labels:
      application: "${APPLICATION_NAME}"
      service: "${APPLICATION_NAME}-kieserver"
      services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver"
    annotations:
      template.alpha.openshift.io/wait-for-ready: "true"
  spec:
    revisionHistoryLimit: 10
    strategy:
      rollingParams:
        maxSurge: 100%
        maxUnavailable: 0
      type: Rolling
    triggers:
    - type: ImageChange
      imageChangeParams:
        automatic: true
        containerNames:
        - "${APPLICATION_NAME}-kieserver"
        from:
          kind: ImageStreamTag
          namespace: "${IMAGE_STREAM_NAMESPACE}"
          name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
    - type: ConfigChange
    replicas: 2
    selector:
      deploymentConfig: "${APPLICATION_NAME}-kieserver"
    template:
      metadata:
        name: "${APPLICATION_NAME}-kieserver"
        labels:
          deploymentConfig: "${APPLICATION_NAME}-kieserver"
          application: "${APPLICATION_NAME}"
          service: "${APPLICATION_NAME}-kieserver"
          services.server.kie.org/kie-server-id: "${APPLICATION_NAME}-kieserver"
      spec:
        serviceAccountName: "${APPLICATION_NAME}-rhdmsvc"
        terminationGracePeriodSeconds: 90
        containers:
        - name: "${APPLICATION_NAME}-kieserver"
          image: "${KIE_SERVER_IMAGE_STREAM_NAME}"
          imagePullPolicy: Always
          lifecycle:
            postStart:
              exec:
                command:
                - /bin/sh
                - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh
            preStop:
              exec:
                command:
                - /bin/sh
                - /opt/eap/bin/launch/jboss-kie-kieserver-hooks.sh
          resources:
            limits:
              cpu: ${KIE_SERVER_CPU_LIMIT}
              memory: ${KIE_SERVER_MEMORY_LIMIT}
            requests:
              cpu: ${KIE_SERVER_CPU_LIMIT}
              memory: ${KIE_SERVER_MEMORY_LIMIT}
          volumeMounts:
          - name: kieserver-keystore-volume
            mountPath: "/etc/kieserver-secret-volume"
            readOnly: true
          livenessProbe:
            httpGet:
              path: /services/rest/server/healthcheck
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 180
            timeoutSeconds: 2
            periodSeconds: 15
            failureThreshold: 3
          readinessProbe:
            httpGet:
              path: /services/rest/server/readycheck
              port: 8080
              scheme: HTTP
            initialDelaySeconds: 30
            timeoutSeconds: 2
            periodSeconds: 5
            failureThreshold: 36
          ports:
          - name: jolokia
            containerPort: 8778
            protocol: TCP
          - name: http
            containerPort: 8080
            protocol: TCP
          - name: https
            containerPort: 8443
            protocol: TCP
          env:
          - name: WORKBENCH_SERVICE_NAME
            value: "${APPLICATION_NAME}-rhdmcentr"
          - name: KIE_ADMIN_USER
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_USER
          - name: KIE_ADMIN_PWD
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_PWD
          - name: KIE_SERVER_MODE
            value: "${KIE_SERVER_MODE}"
          - name: KIE_MBEANS
            value: "${KIE_MBEANS}"
          - name: DROOLS_SERVER_FILTER_CLASSES
            value: "${DROOLS_SERVER_FILTER_CLASSES}"
          - name: PROMETHEUS_SERVER_EXT_DISABLED
            value: "${PROMETHEUS_SERVER_EXT_DISABLED}"
          - name: KIE_SERVER_BYPASS_AUTH_USER
            value: "${KIE_SERVER_BYPASS_AUTH_USER}"
          - name: KIE_SERVER_CONTROLLER_SERVICE
            value: "${APPLICATION_NAME}-rhdmcentr"
          - name: KIE_SERVER_CONTROLLER_PROTOCOL
            value: "ws"
          - name: KIE_SERVER_ID
            valueFrom:
              fieldRef:
                fieldPath: metadata.labels['services.server.kie.org/kie-server-id']
          - name: KIE_SERVER_ROUTE_NAME
            value: "insecure-${APPLICATION_NAME}-kieserver"
          - name: KIE_SERVER_STARTUP_STRATEGY
            value: "OpenShiftStartupStrategy"
          - name: MAVEN_MIRROR_URL
            value: "${MAVEN_MIRROR_URL}"
          - name: MAVEN_MIRROR_OF
            value: "${MAVEN_MIRROR_OF}"
          - name: MAVEN_REPOS
            value: "RHDMCENTR,EXTERNAL"
          - name: RHDMCENTR_MAVEN_REPO_ID
            value: "repo-rhdmcentr"
          - name: RHDMCENTR_MAVEN_REPO_SERVICE
            value: "${APPLICATION_NAME}-rhdmcentr"
          - name: RHDMCENTR_MAVEN_REPO_PATH
            value: "/maven2/"
          - name: RHDMCENTR_MAVEN_REPO_USERNAME
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_USER
          - name: RHDMCENTR_MAVEN_REPO_PASSWORD
            valueFrom:
              secretKeyRef:
                name: "${CREDENTIALS_SECRET}"
                key: KIE_ADMIN_PWD
          - name: EXTERNAL_MAVEN_REPO_ID
            value: "${MAVEN_REPO_ID}"
          - name: EXTERNAL_MAVEN_REPO_URL
            value: "${MAVEN_REPO_URL}"
          - name: EXTERNAL_MAVEN_REPO_USERNAME
            value: "${MAVEN_REPO_USERNAME}"
          - name: EXTERNAL_MAVEN_REPO_PASSWORD
            value: "${MAVEN_REPO_PASSWORD}"
          - name: HTTPS_KEYSTORE_DIR
            value: "/etc/kieserver-secret-volume"
          - name: HTTPS_KEYSTORE
            value: "${KIE_SERVER_HTTPS_KEYSTORE}"
          - name: HTTPS_NAME
            value: "${KIE_SERVER_HTTPS_NAME}"
          - name: HTTPS_PASSWORD
            value: "${KIE_SERVER_HTTPS_PASSWORD}"
          - name: SSO_URL
            value: "${SSO_URL}"
          - name: SSO_OPENIDCONNECT_DEPLOYMENTS
            value: "ROOT.war"
          - name: SSO_REALM
            value: "${SSO_REALM}"
          - name: SSO_SECRET
            value: "${KIE_SERVER_SSO_SECRET}"
          - name: SSO_CLIENT
            value: "${KIE_SERVER_SSO_CLIENT}"
          - name: SSO_USERNAME
            value: "${SSO_USERNAME}"
          - name: SSO_PASSWORD
            value: "${SSO_PASSWORD}"
          - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
            value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
          - name: SSO_PRINCIPAL_ATTRIBUTE
            value: "${SSO_PRINCIPAL_ATTRIBUTE}"
          - name: HOSTNAME_HTTP
            value: "${KIE_SERVER_HOSTNAME_HTTP}"
          - name: HOSTNAME_HTTPS
            value: "${KIE_SERVER_HOSTNAME_HTTPS}"
          - name: AUTH_LDAP_URL
            value: "${AUTH_LDAP_URL}"
          - name: AUTH_LDAP_BIND_DN
            value: "${AUTH_LDAP_BIND_DN}"
          - name: AUTH_LDAP_BIND_CREDENTIAL
            value: "${AUTH_LDAP_BIND_CREDENTIAL}"
          - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
            value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}"
          - name: AUTH_LDAP_BASE_CTX_DN
            value: "${AUTH_LDAP_BASE_CTX_DN}"
          - name: AUTH_LDAP_BASE_FILTER
            value: "${AUTH_LDAP_BASE_FILTER}"
          - name: AUTH_LDAP_SEARCH_SCOPE
            value: "${AUTH_LDAP_SEARCH_SCOPE}"
          - name: AUTH_LDAP_SEARCH_TIME_LIMIT
            value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
          - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
            value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}"
          - name: AUTH_LDAP_PARSE_USERNAME
            value: "${AUTH_LDAP_PARSE_USERNAME}"
          - name: AUTH_LDAP_USERNAME_BEGIN_STRING
            value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}"
          - name: AUTH_LDAP_USERNAME_END_STRING
            value: "${AUTH_LDAP_USERNAME_END_STRING}"
          - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
            value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
          - name: AUTH_LDAP_ROLES_CTX_DN
            value: "${AUTH_LDAP_ROLES_CTX_DN}"
          - name: AUTH_LDAP_ROLE_FILTER
            value: "${AUTH_LDAP_ROLE_FILTER}"
          - name: AUTH_LDAP_ROLE_RECURSION
            value: "${AUTH_LDAP_ROLE_RECURSION}"
          - name: AUTH_LDAP_DEFAULT_ROLE
            value: "${AUTH_LDAP_DEFAULT_ROLE}"
          - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
            value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}"
          - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
            value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}"
          - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
            value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}"
          - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
            value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}"
          - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
            value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
          - name: AUTH_ROLE_MAPPER_REPLACE_ROLE
            value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}"
        volumes:
        - name: kieserver-keystore-volume
          secret:
            secretName: "${KIE_SERVER_HTTPS_SECRET}"
- kind: StatefulSet
  apiVersion: apps/v1
  metadata:
    name: ${APPLICATION_NAME}-amq
    annotations:
      alpha.image.policy.openshift.io/resolve-names: '*'
    labels:
      application: ${APPLICATION_NAME}
  spec:
    podManagementPolicy: OrderedReady
    updateStrategy:
      rollingUpdate:
        partition: 0
      type: RollingUpdate
    replicas: ${{AMQ_REPLICAS}}
    revisionHistoryLimit: 10
    selector:
      matchLabels:
        deploymentConfig: ${APPLICATION_NAME}-amq
    serviceName: ${APPLICATION_NAME}-amq-tcp
    template:
      metadata:
        name: ${APPLICATION_NAME}-amq
        labels:
          application: ${APPLICATION_NAME}
          deploymentConfig: ${APPLICATION_NAME}-amq
      spec:
        containers:
        - env:
          - name: AMQ_USER
            value: "${APPFORMER_JMS_BROKER_USER}"
          - name: AMQ_PASSWORD
            value: "${APPFORMER_JMS_BROKER_PASSWORD}"
          - name: AMQ_ROLE
            value: ${AMQ_ROLE}
          - name: AMQ_NAME
            value: ${AMQ_NAME}
          - name: AMQ_TRANSPORTS
            value: "openwire"
          - name: AMQ_GLOBAL_MAX_SIZE
            value: ${AMQ_GLOBAL_MAX_SIZE}
          - name: AMQ_REQUIRE_LOGIN
          - name: AMQ_DATA_DIR
            value: /opt/amq/data
          - name: AMQ_DATA_DIR_LOGGING
            value: "true"
          - name: AMQ_CLUSTERED
            value: "true"
          - name: AMQ_REPLICAS
            value: "${AMQ_REPLICAS}"
          - name: AMQ_CLUSTER_USER
            value: ${APPFORMER_JMS_BROKER_USER}
          - name: AMQ_CLUSTER_PASSWORD
            value: ${APPFORMER_JMS_BROKER_PASSWORD}
          - name: AMQ_EXTRA_ARGS
          - name: AMQ_ANYCAST_PREFIX
          - name: AMQ_MULTICAST_PREFIX
          - name: POD_NAMESPACE
            valueFrom:
              fieldRef:
                apiVersion: v1
                fieldPath: metadata.namespace
          image: ${AMQ_BROKER_IMAGE}
          imagePullPolicy: IfNotPresent
          name: broker-amq
          ports:
          - containerPort: 8161
            name: jolokia
            protocol: TCP
          - containerPort: 5672
            name: amqp
            protocol: TCP
          - containerPort: 1883
            name: mqtt
            protocol: TCP
          - containerPort: 61613
            name: stomp
            protocol: TCP
          - containerPort: 61616
            name: artemis
            protocol: TCP
          readinessProbe:
            exec:
              command:
              - /bin/bash
              - -c
              - /opt/amq/bin/readinessProbe.sh
            failureThreshold: 3
            periodSeconds: 10
            successThreshold: 1
            timeoutSeconds: 1
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
          - mountPath: /opt/amq/data
            name: "${APPLICATION_NAME}-amq-pvol"
        dnsPolicy: ClusterFirst
        restartPolicy: Always
        schedulerName: default-scheduler
        securityContext: {}
        terminationGracePeriodSeconds: 60
    volumeClaimTemplates:
    - metadata:
        name: ${APPLICATION_NAME}-amq-pvol
      spec:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: ${AMQ_VOLUME_CAPACITY}
- apiVersion: v1
  kind: PersistentVolumeClaim
  metadata:
    name: "${APPLICATION_NAME}-rhdmcentr-claim"
    labels:
      application: "${APPLICATION_NAME}"
  spec:
    accessModes:
    - ReadWriteMany
    resources:
      requests:
        storage: "${DECISION_CENTRAL_VOLUME_CAPACITY}"
