kind: Template
apiVersion: v1
metadata:
  annotations:
    iconClass: icon-jboss
    tags: rhpam,processserver,jboss,prod
    version: "7.11"
    openshift.io/display-name: Red Hat Process Automation Manager 7.11 production environment
    openshift.io/provider-display-name: Red Hat, Inc.
    description: Application template for a managed HA production runtime environment, for Red Hat Process Automation Manager 7.11 - Deprecated
    template.openshift.io/long-description: This template defines resources needed for a HA production runtime environment for Red Hat Process Automation Manager 7.11, including application deployment configuration, secure and insecure http communication and persistent volume to store data that needs to survive a restart. Template for Red Hat OpenShift Container Platform version 3.11. Deprecated since Red Hat Process Automation Manager version 7.5; consider using the Red Hat Business Automation Operator.
    template.openshift.io/documentation-url: https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.11/html/deploying_a_red_hat_process_automation_manager_7.11_authoring_environment_on_red_hat_openshift_container_platform/
    template.openshift.io/support-url: https://access.redhat.com
    template.openshift.io/bindable: "false"
  name: rhpam711-prod
labels:
  template: rhpam711-prod
  rhpam: "7.11"
message: |-
  A new environment has been set up for Red Hat Process Automation Manager 7.
  The username/password needed for accessing the application are stored in "${CREDENTIALS_SECRET}" secret as
  KIE_ADMIN_USER and KIE_ADMIN_PWD

  You must create the secret named "${CREDENTIALS_SECRET}" containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values and the secrets named "${BUSINESS_CENTRAL_HTTPS_SECRET}", "${KIE_SERVER_HTTPS_SECRET}" and
  "${KIE_SERVER_ROUTER_HTTPS_SECRET}" containing the ${BUSINESS_CENTRAL_HTTPS_KEYSTORE}, ${KIE_SERVER_HTTPS_KEYSTORE} and
  ${KIE_SERVER_ROUTER_HTTPS_KEYSTORE} files used for serving secure content.
parameters:
  - displayName: Application Name
    description: The name for the application.
    name: APPLICATION_NAME
    value: myapp
    required: true
  - displayName: Maven mirror URL
    description: Maven mirror that the KIE Server must use. If you configure a mirror, this mirror must contain all artifacts that are required for deploying your services.
    name: MAVEN_MIRROR_URL
    required: false
  - displayName: Maven mirror of
    description: Maven mirror configuration for KIE Server.
    name: MAVEN_MIRROR_OF
    value: "external:*"
    required: false
  - displayName: Maven repository ID
    description: "The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won't be usable in MAVEN_MIRROR_OF."
    name: MAVEN_REPO_ID
    value: repo-custom
    required: false
  - displayName: Maven repository URL
    description: Fully qualified URL to a Maven repository or service.
    name: MAVEN_REPO_URL
    example: http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/
    required: true
  - displayName: Maven repository user name
    description: User name for accessing the Maven repository, if required.
    name: MAVEN_REPO_USERNAME
    required: false
  - displayName: Maven repository password
    description: Password to access the Maven repository, if required.
    name: MAVEN_REPO_PASSWORD
    required: false
  - displayName: Name of the Maven service hosted by Business Central
    description: The service name for the optional Business Central, where it can be reached, to allow service lookups (for maven repo usage), if required.
    name: BUSINESS_CENTRAL_MAVEN_SERVICE
    example: "myapp-rhpamcentr"
    required: false
  - displayName: Credentials secret
    description: Secret containing the KIE_ADMIN_USER and KIE_ADMIN_PWD values
    name: CREDENTIALS_SECRET
    example: rhpam-credentials
    required: true
  - displayName: ImageStream Namespace
    description: Namespace in which the ImageStreams for Red Hat Process Automation Manager images are installed. These ImageStreams are normally installed in the openshift namespace. You need to modify this parameter only if you installed the ImageStream in a different namespace/project. Default is "openshift".
    name: IMAGE_STREAM_NAMESPACE
    value: openshift
    required: true
  - displayName: KIE Server ImageStream Name
    description: The name of the image stream to use for KIE Server. Default is "rhpam-kieserver-rhel8".
    name: KIE_SERVER_IMAGE_STREAM_NAME
    value: "rhpam-kieserver-rhel8"
    required: true
  - displayName: ImageStream Tag
    description: A named pointer to an image in an image stream. Default is "7.11.1".
    name: IMAGE_STREAM_TAG
    value: "7.11.1"
    required: true
  - displayName: Smart Router Custom http Route Hostname
    description: Custom hostname for http service route.  Leave blank for default hostname, e.g. <application-name>-smartrouter-<project>.<default-domain-suffix>'
    name: SMART_ROUTER_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: Smart Router Custom https Route Hostname
    description: Custom hostname for https service route.  Leave blank for default hostname, e.g. secure-<application-name>-smartrouter-<project>.<default-domain-suffix>'
    name: SMART_ROUTER_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: Smart Router ID
    description: Router ID used when connecting to the controller. (router property org.kie.server.router.id)
    name: KIE_SERVER_ROUTER_ID
    value: kie-server-router
    required: true
  - displayName: Smart Router protocol
    description: KIE Server router protocol. (Used to build the org.kie.server.router.url.external property)
    name: KIE_SERVER_ROUTER_PROTOCOL
    example: "http"
    required: false
  - displayName: Smart Router external URL
    description: Public URL where the router can be found. Format http://<host>:<port>  (router property org.kie.server.router.url.external)
    name: KIE_SERVER_ROUTER_URL_EXTERNAL
    required: false
  - displayName: Smart Router name
    description: Router name used when connecting to the controller. (router property org.kie.server.router.name)
    name: KIE_SERVER_ROUTER_NAME
    value: KIE Server Router
    required: true
  - displayName: KIE Server Controller Token
    description: KIE Server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)
    name: KIE_SERVER_CONTROLLER_TOKEN
    required: false
  - displayName: KIE Server Persistence DS
    description: KIE Server persistence datasource. (Sets the org.kie.server.persistence.ds system property)
    name: KIE_SERVER_PERSISTENCE_DS
    value: java:/jboss/datasources/rhpam
    required: false
## PostgreSQL database parameters BEGIN
  - displayName: PostgreSQL ImageStream Namespace
    description: Namespace in which the ImageStream for the PostgreSQL image is installed. The ImageStream is already installed in the openshift namespace. You need to modify this parameter only if you installed the ImageStream in a different namespace/project. Default is "openshift".
    name: POSTGRESQL_IMAGE_STREAM_NAMESPACE
    value: "openshift"
    required: false
  - displayName: PostgreSQL ImageStream Tag
    description: The PostgreSQL image version, which is intended to correspond to the PostgreSQL version. Default is "10".
    name: POSTGRESQL_IMAGE_STREAM_TAG
    value: "10"
    required: false
  - displayName: KIE Server PostgreSQL Database User
    description: KIE Server PostgreSQL database user name.
    name: KIE_SERVER_POSTGRESQL_USER
    value: rhpam
    required: false
  - displayName: KIE Server PostgreSQL Database Password
    description: KIE Server PostgreSQL database password.
    name: KIE_SERVER_POSTGRESQL_PWD
    from: "[a-zA-Z]{6}[0-9]{1}!"
    generate: expression
    required: false
  - displayName: KIE Server PostgreSQL Database Name
    description: KIE Server PostgreSQL database name.
    name: KIE_SERVER_POSTGRESQL_DB
    value: rhpam7
    required: false
  - displayName: PostgreSQL Database max prepared connections
    description: Allows the PostgreSQL to handle XA transactions.
    name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS
    value: '100'
    required: true
  - displayName: Database Volume Capacity
    description: Size of persistent storage for the database volume.
    name: DB_VOLUME_CAPACITY
    value: 1Gi
    required: true
  - displayName: KIE Server PostgreSQL Dialect
    description: KIE Server PostgreSQL Hibernate dialect.
    name: KIE_SERVER_POSTGRESQL_DIALECT
    value: org.hibernate.dialect.PostgreSQLDialect
    required: true
## PostgreSQL database parameters END
  - displayName: KIE Server Mode
    description: "The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE Server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property)."
    name: KIE_SERVER_MODE
    value: "PRODUCTION"
    required: false
  - displayName: KIE MBeans
    description: KIE Server mbeans enabled/disabled. (Sets the kie.mbeans and kie.scanner.mbeans system properties)
    name: KIE_MBEANS
    value: enabled
    required: false
  - displayName: Drools Server Filter Classes
    description: KIE Server class filtering. (Sets the org.drools.server.filter.classes system property)
    name: DROOLS_SERVER_FILTER_CLASSES
    value: 'true'
    required: false
  - displayName: Prometheus Server Extension Disabled
    description: If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)
    name: PROMETHEUS_SERVER_EXT_DISABLED
    example: 'false'
    required: false
  - displayName: Business Central Monitoring Custom http Route Hostname
    description: 'Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentrmon-<project>.<default-domain-suffix>'
    name: BUSINESS_CENTRAL_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: Business Central Monitoring Custom https Route Hostname
    description: 'Custom hostname for https service route.  Leave blank for default hostname, e.g.: secure-<application-name>-rhpamcentrmon-<project>.<default-domain-suffix>'
    name: BUSINESS_CENTRAL_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: KIE Server 1 Custom http Route Hostname
    description: 'Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER1_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: KIE Server 1 Custom https Route Hostname
    description: 'Custom hostname for https service route.  Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER1_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: Use the secure route name to link application requests to KIE_SERVER1_HOSTNAME_HTTPS vs KIE_SERVER1_HOSTNAME_HTTP.
    description: 'If true, the KIE Server will use secure-<application-name>-kieserver vs. <application-name>-kieserver as the KIE Server route endpoint for Business Central to report. Therefore, Business Central displays the secure link to the user.'
    name: KIE_SERVER1_USE_SECURE_ROUTE_NAME
    value: 'false'
    required: false
  - displayName: KIE Server 2 Custom http Route Hostname
    description: 'Custom hostname for http service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER2_HOSTNAME_HTTP
    value: ''
    required: false
  - displayName: KIE Server 2 Custom https Route Hostname
    description: 'Custom hostname for https service route.  Leave blank for default hostname, e.g.: secure-<application-name>-kieserver-<project>.<default-domain-suffix>'
    name: KIE_SERVER2_HOSTNAME_HTTPS
    value: ''
    required: false
  - displayName: Use the secure route name to link application requests to KIE_SERVER2_HOSTNAME_HTTPS vs KIE_SERVER2_HOSTNAME_HTTP.
    description: 'If true, will use secure-APPLICATION_NAME-kieserver-2 vs. APPLICATION_NAME-kieserver-2 as the route name.'
    name: KIE_SERVER2_USE_SECURE_ROUTE_NAME
    value: 'false'
    required: false
  - displayName: Business Central Monitoring Server Keystore Secret Name
    description: The name of the secret containing the keystore file for Business Central.
    name: BUSINESS_CENTRAL_HTTPS_SECRET
    example: businesscentral-app-secret
    required: true
  - displayName: Business Central Monitoring Server Keystore Filename
    description: The name of the keystore file within the secret.
    name: BUSINESS_CENTRAL_HTTPS_KEYSTORE
    value: keystore.jks
    required: false
  - displayName: Business Central Monitoring Server Certificate Name
    description: The name associated with the server certificate.
    name: BUSINESS_CENTRAL_HTTPS_NAME
    value: jboss
    required: false
  - displayName: Business Central Monitoring Server Keystore Password
    description: The password for the keystore and certificate.
    name: BUSINESS_CENTRAL_HTTPS_PASSWORD
    value: mykeystorepass
    required: false
  - displayName: Smart Router Keystore Secret Name
    description: The name of the secret containing the keystore file for Smart Router.
    name: KIE_SERVER_ROUTER_HTTPS_SECRET
    example: smartrouter-app-secret
    required: true
  - displayName: Smart Router Keystore Filename
    description: The name of the keystore file within the secret.
    name: KIE_SERVER_ROUTER_HTTPS_KEYSTORE
    value: keystore.jks
    required: false
  - displayName: Smart Router Certificate Name
    description: The name associated with the server certificate.
    name: KIE_SERVER_ROUTER_HTTPS_NAME
    value: jboss
    required: false
  - displayName: Smart Router Keystore Password
    description: The password for the keystore and certificate.
    name: KIE_SERVER_ROUTER_HTTPS_PASSWORD
    value: mykeystorepass
    required: false
  - displayName: KIE Server Keystore Secret Name
    description: The name of the secret containing the keystore file for KIE Server.
    name: KIE_SERVER_HTTPS_SECRET
    example: kieserver-app-secret
    required: true
  - displayName: KIE Server Keystore Filename
    description: The name of the keystore file within the secret.
    name: KIE_SERVER_HTTPS_KEYSTORE
    value: keystore.jks
    required: false
  - displayName: KIE Server Certificate Name
    description: The name associated with the server certificate.
    name: KIE_SERVER_HTTPS_NAME
    value: jboss
    required: false
  - displayName: KIE Server Keystore Password
    description: The password for the keystore and certificate.
    name: KIE_SERVER_HTTPS_PASSWORD
    value: mykeystorepass
    required: false
  - displayName: KIE Server Bypass Auth User
    description: Allows the KIE Server to bypass the authenticated user for task-related operations, for example, queries. (Sets the org.kie.server.bypass.auth.user system property)
    name: KIE_SERVER_BYPASS_AUTH_USER
    value: 'false'
    required: false
  - displayName: "Timer service data store refresh interval (in milliseconds)"
    description: "Sets refresh-interval for the EJB timer service database-data-store."
    name: TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL
    value: '30000'
    required: false
  - displayName: Business Central Monitoring Container Memory Limit
    description: Business Central Monitoring Container memory limit.
    name: BUSINESS_CENTRAL_MEMORY_LIMIT
    value: 2Gi
    required: true
  - displayName: Business Central Monitoring Container Memory Request
    description: Business Central Monitoring Container memory request.
    name: BUSINESS_CENTRAL_MEMORY_REQUEST
    value: 1536Mi
    required: true
  - displayName: Business Central Monitoring Container CPU Limit
    description: Business Central Monitoring Container CPU limit.
    name: BUSINESS_CENTRAL_CPU_LIMIT
    value: '1'
    required: true
  - displayName: Business Central Monitoring Container CPU Request
    description: Business Central Monitoring Container CPU request.
    name: BUSINESS_CENTRAL_CPU_REQUEST
    value: '750m'
    required: true
  - displayName: KIE Server Container Memory Limit
    description: KIE Server Container memory limit.
    name: KIE_SERVER_MEMORY_LIMIT
    value: 2Gi
    required: true
  - displayName: KIE Server Container Memory Request
    description: KIE Server Container memory request.
    name: KIE_SERVER_MEMORY_REQUEST
    value: 1536Mi
    required: true
  - displayName: KIE Server Container CPU Limit
    description: KIE Server Container CPU limit.
    name: KIE_SERVER_CPU_LIMIT
    value: '1'
    required: true
  - displayName: KIE Server Container CPU Request
    description: KIE Server Container CPU request.
    name: KIE_SERVER_CPU_REQUEST
    value: '750m'
    required: true
  - displayName: Smart Router Container Memory Limit
    description: Smart Router Container memory limit
    name: SMART_ROUTER_MEMORY_LIMIT
    value: 512Mi
    required: false
  - displayName: Business Central Monitoring Container Replicas
    description: Business Central Monitoring Container Replicas, defines how many Business Central Monitoring containers will be started.
    name: BUSINESS_CENTRAL_MONITORING_CONTAINER_REPLICAS
    value: '3'
    required: true
  - displayName: Smart Router Container Replicas
    description: Smart Router Container Replicas, defines how many smart router containers will be started.
    name: SMART_ROUTER_CONTAINER_REPLICAS
    value: '2'
    required: true
  - displayName: KIE Server Container Replicas
    description: KIE Server Container Replicas, defines how many KIE Server containers will be started.
    name: KIE_SERVER_CONTAINER_REPLICAS
    value: '3'
    required: true
  - displayName: RH-SSO URL
    description: RH-SSO URL.
    name: SSO_URL
    example: https://rh-sso.example.com/auth
    required: false
  - displayName: RH-SSO Realm name
    description: RH-SSO Realm name.
    name: SSO_REALM
    required: false
  - displayName: Business Central Monitoring RH-SSO Client name
    description: Business Central Monitoring RH-SSO Client name.
    name: BUSINESS_CENTRAL_SSO_CLIENT
    required: false
  - displayName: Business Central Monitoring RH-SSO Client Secret
    description: Business Central Monitoring RH-SSO Client Secret.
    name: BUSINESS_CENTRAL_SSO_SECRET
    example: "252793ed-7118-4ca8-8dab-5622fa97d892"
    required: false
  - displayName: KIE Server 1 RH-SSO Client name
    description: KIE Server 1 RH-SSO Client name.
    name: KIE_SERVER1_SSO_CLIENT
    required: false
  - displayName: KIE Server 1 RH-SSO Client Secret
    description: KIE Server 1 RH-SSO Client Secret.
    name: KIE_SERVER1_SSO_SECRET
    example: "252793ed-7118-4ca8-8dab-5622fa97d892"
    required: false
  - displayName: KIE Server 2 RH-SSO Client name
    description: KIE Server 2 RH-SSO Client name.
    name: KIE_SERVER2_SSO_CLIENT
    required: false
  - displayName: KIE Server 2 RH-SSO Client Secret
    description: KIE Server 2 RH-SSO Client Secret.
    name: KIE_SERVER2_SSO_SECRET
    example: "252793ed-7118-4ca8-8dab-5622fa97d892"
    required: false
  - displayName: RH-SSO Realm admin user name
    description: RH-SSO Realm admin user name for creating the Client if it doesn't exist.
    name: SSO_USERNAME
    required: false
  - displayName: RH-SSO Realm Admin Password
    description: RH-SSO Realm Admin Password used to create the Client.
    name: SSO_PASSWORD
    required: false
  - displayName: RH-SSO Disable SSL Certificate Validation
    description: RH-SSO Disable SSL Certificate Validation.
    name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
    value: "false"
    required: false
  - displayName: RH-SSO Principal Attribute
    description: RH-SSO Principal Attribute to use as user name.
    name: SSO_PRINCIPAL_ATTRIBUTE
    value: preferred_username
    required: false
  - displayName: LDAP Endpoint
    description: LDAP endpoint to connect for authentication. For failover, set two or more LDAP endpoints separated by space.
    name: AUTH_LDAP_URL
    example: "ldap://myldap.example.com:389"
    required: false
  - displayName: LDAP Bind DN
    description: Bind DN used for authentication.
    name: AUTH_LDAP_BIND_DN
    example: "uid=admin,ou=users,ou=example,ou=com"
    required: false
  - displayName: LDAP Bind Credentials
    description: LDAP Credentials used for authentication.
    name: AUTH_LDAP_BIND_CREDENTIAL
    example: "Password"
    required: false
  - displayName: LDAP Flag Login Module
    name: AUTH_LDAP_LOGIN_MODULE
    description: "A flag to set login module to optional. The default value is required"
    required: false
    example: "optional"
  - displayName: LDAP JAAS Security Domain
    description: The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.
    name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
    required: false
  - displayName: LDAP Base DN
    description: LDAP Base DN of the top-level context to begin the user search.
    name: AUTH_LDAP_BASE_CTX_DN
    example: "ou=users,ou=example,ou=com"
    required: false
  - displayName: LDAP Base Search filter
    description: LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).
    name: AUTH_LDAP_BASE_FILTER
    example: "(uid={0})"
    required: false
  - displayName: LDAP Search scope
    description: The search scope to use.
    name: AUTH_LDAP_SEARCH_SCOPE
    example: "SUBTREE_SCOPE"
    required: false
  - displayName: LDAP Search time limit
    description: The timeout in milliseconds for user or role searches.
    name: AUTH_LDAP_SEARCH_TIME_LIMIT
    example: "10000"
    required: false
  - displayName: LDAP DN attribute
    description: The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.
    name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
    example: "distinguishedName"
    required: false
  - displayName: LDAP Parse username
    description: A flag indicating if the DN is to be parsed for the user name. If set to true, the DN is parsed for the user name. If set to false the DN is not parsed for the user name. This option is used together with usernameBeginString and usernameEndString.
    name: AUTH_LDAP_PARSE_USERNAME
    example: "true"
    required: false
  - displayName: LDAP Username begin string
    description: Defines the String which is to be removed from the start of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.
    name: AUTH_LDAP_USERNAME_BEGIN_STRING
    required: false
  - displayName: LDAP Username end string
    description: Defines the String which is to be removed from the end of the DN to reveal the user name. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.
    name: AUTH_LDAP_USERNAME_END_STRING
    required: false
  - displayName: LDAP Role attributeID
    description: Name of the attribute containing the user roles.
    name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
    example: memberOf
    required: false
  - displayName: LDAP Roles Search DN
    description: The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.
    name: AUTH_LDAP_ROLES_CTX_DN
    example: "ou=groups,ou=example,ou=com"
    required: false
  - displayName: LDAP Role search filter
    description: A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).
    name: AUTH_LDAP_ROLE_FILTER
    example: "(memberOf={1})"
    required: false
  - displayName: LDAP Role recursion
    description: The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.
    name: AUTH_LDAP_ROLE_RECURSION
    example: "1"
    required: false
  - displayName: LDAP Default role
    description: A role included for all authenticated users.
    name: AUTH_LDAP_DEFAULT_ROLE
    example: "user"
    required: false
  - displayName: LDAP Role name attribute ID
    description: Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.
    name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
    example: "name"
    required: false
  - displayName: LDAP Role DN contains roleNameAttributeID
    description: A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.
    name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
    example: "false"
    required: false
  - displayName: LDAP Role Attribute ID is DN
    description: Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.
    name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
    example: "false"
    required: false
  - displayName: LDAP Referral user attribute ID
    description: If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.
    name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
    required: false
  - displayName: RoleMapping rolesProperties file path
    description: When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3
    name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
    required: false
  - displayName: RoleMapping replaceRole property
    description: Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.
    name: AUTH_ROLE_MAPPER_REPLACE_ROLE
    required: false
objects:
  - kind: ServiceAccount
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-kieserver"
      labels:
        application: "${APPLICATION_NAME}"
  - kind: RoleBinding
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-kieserver-view"
      labels:
        application: "${APPLICATION_NAME}"
    subjects:
      - kind: ServiceAccount
        name: "${APPLICATION_NAME}-kieserver"
    roleRef:
      name: view
  - kind: ServiceAccount
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-smartrouter"
      labels:
        application: "${APPLICATION_NAME}"
  - kind: RoleBinding
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-smartrouter-view"
      labels:
        application: "${APPLICATION_NAME}"
    subjects:
      - kind: ServiceAccount
        name: "${APPLICATION_NAME}-smartrouter"
    roleRef:
      name: view
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 8080
          targetPort: 8080
        - name: https
          port: 8443
          targetPort: 8443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon"
    metadata:
      name: "${APPLICATION_NAME}-rhpamcentrmon"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhpamcentrmon"
      annotations:
        description: All the Business Central Monitoring web server's ports.
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 9000
          targetPort: 9000
        - name: https
          port: 9443
          targetPort: 9443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-smartrouter"
    metadata:
      name: "${APPLICATION_NAME}-smartrouter"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-smartrouter"
      annotations:
        description: The smart router server http and https ports.
## KIE Server services 1 BEGIN
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 8080
          targetPort: 8080
        - name: https
          port: 8443
          targetPort: 8443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver-1"
    metadata:
      name: "${APPLICATION_NAME}-kieserver-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-1"
      annotations:
        description: All the KIE Server web server's ports. (First KIE Server)
## KIE Server services 1 END
## KIE Server services 2 BEGIN
  - kind: Service
    apiVersion: v1
    spec:
      ports:
        - name: http
          port: 8080
          targetPort: 8080
        - name: https
          port: 8443
          targetPort: 8443
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver-2"
    metadata:
      name: "${APPLICATION_NAME}-kieserver-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-2"
      annotations:
        description: All the KIE Server web server's ports. (Second KIE Server)
## KIE Server services 2 END
## PostgreSQL service 1 BEGIN
  - apiVersion: v1
    kind: Service
    metadata:
      annotations:
        description: The first database server's port.
      labels:
        application: ${APPLICATION_NAME}
        service: "${APPLICATION_NAME}-postgresql-1"
      name: ${APPLICATION_NAME}-postgresql-1
    spec:
      ports:
        - port: 5432
          targetPort: 5432
      selector:
        deploymentConfig: ${APPLICATION_NAME}-postgresql-1
## PostgreSQL service 1 END
## PostgreSQL service 2 BEGIN
  - apiVersion: v1
    kind: Service
    metadata:
      annotations:
        description: The second database server's port.
      labels:
        application: ${APPLICATION_NAME}
        service: "${APPLICATION_NAME}-postgresql-2"
      name: ${APPLICATION_NAME}-postgresql-2
    spec:
      ports:
        - port: 5432
          targetPort: 5432
      selector:
        deploymentConfig: ${APPLICATION_NAME}-postgresql-2
## PostgreSQL service 2 END
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-rhpamcentrmon-http"
    metadata:
      name: "${APPLICATION_NAME}-rhpamcentrmon"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhpamcentrmon"
      annotations:
        description: Route for Business Central Monitoring's http service.
        haproxy.router.openshift.io/timeout: 1h
    spec:
      host: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-rhpamcentrmon"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-rhpamcentrmon-https"
    metadata:
      name: "secure-${APPLICATION_NAME}-rhpamcentrmon"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhpamcentrmon"
      annotations:
        description: Route for Business Central Monitoring's https service.
        haproxy.router.openshift.io/timeout: 1h
    spec:
      host: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}"
      to:
        name: "${APPLICATION_NAME}-rhpamcentrmon"
      port:
        targetPort: https
      tls:
        termination: passthrough
## KIE Server routes 1 BEGIN
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-kieserver-1-http"
    metadata:
      name: "${APPLICATION_NAME}-kieserver-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-1"
      annotations:
        description: Route for First KIE Server's http service.
    spec:
      host: "${KIE_SERVER1_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-kieserver-1"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-kieserver-1-https"
    metadata:
      name: "secure-${APPLICATION_NAME}-kieserver-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-1"
      annotations:
        description: Route for First KIE Server's https service.
    spec:
      host: "${KIE_SERVER1_HOSTNAME_HTTPS}"
      to:
        name: "${APPLICATION_NAME}-kieserver-1"
      port:
        targetPort: https
      tls:
        termination: passthrough
## KIE Server routes 1 END
## KIE Server routes 2 BEGIN
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-kieserver-2-http"
    metadata:
      name: "${APPLICATION_NAME}-kieserver-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-2"
      annotations:
        description: Route for Second KIE Server's http service.
    spec:
      host: "${KIE_SERVER2_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-kieserver-2"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-kieserver-2-https"
    metadata:
      name: "secure-${APPLICATION_NAME}-kieserver-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-2"
      annotations:
        description: Route for Second KIE Server's https service.
    spec:
      host: "${KIE_SERVER2_HOSTNAME_HTTPS}"
      to:
        name: "${APPLICATION_NAME}-kieserver-2"
      port:
        targetPort: https
      tls:
        termination: passthrough
## KIE Server routes 2 END
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-smartrouter-http"
    metadata:
      name: "${APPLICATION_NAME}-smartrouter"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-smartrouter"
      annotations:
        description: Route for Smart Router's http service.
    spec:
      host: "${SMART_ROUTER_HOSTNAME_HTTP}"
      to:
        name: "${APPLICATION_NAME}-smartrouter"
      port:
        targetPort: http
  - kind: Route
    apiVersion: v1
    id: "${APPLICATION_NAME}-smartrouter-https"
    metadata:
      name: "secure-${APPLICATION_NAME}-smartrouter"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-smartrouter"
      annotations:
        description: Route for Smart Router's https service.
    spec:
      host: "${SMART_ROUTER_HOSTNAME_HTTPS}"
      to:
        name: "${APPLICATION_NAME}-smartrouter"
      port:
        targetPort: https
      tls:
        termination: passthrough
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-rhpamcentrmon"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhpamcentrmon"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      strategy:
        rollingParams:
          maxSurge: 100%
          maxUnavailable: 0
        type: Rolling
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-rhpamcentrmon"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "rhpam-businesscentral-monitoring-rhel8:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{BUSINESS_CENTRAL_MONITORING_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon"
      template:
        metadata:
          name: "${APPLICATION_NAME}-rhpamcentrmon"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-rhpamcentrmon"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-rhpamcentrmon"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.rhpamcentrmon"
        spec:
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-rhpamcentrmon"
              image: rhpam-businesscentral-monitoring-rhel8
              imagePullPolicy: Always
              resources:
                limits:
                  memory: "${BUSINESS_CENTRAL_MEMORY_LIMIT}"
                  cpu: "${BUSINESS_CENTRAL_CPU_LIMIT}"
                requests:
                  memory: "${BUSINESS_CENTRAL_MEMORY_REQUEST}"
                  cpu: "${BUSINESS_CENTRAL_CPU_REQUEST}"
              volumeMounts:
                - name: businesscentral-keystore-volume
                  mountPath: "/etc/businesscentral-secret-volume"
                  readOnly: true
                - name: "${APPLICATION_NAME}-rhpamcentr-pvol"
                  mountPath: "/opt/kie/data"
              livenessProbe:
                httpGet:
                  path: /rest/healthy
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 180
                timeoutSeconds: 2
                periodSeconds: 15
                failureThreshold: 36
              readinessProbe:
                httpGet:
                  path: /rest/ready
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 60
                timeoutSeconds: 2
                periodSeconds: 5
                failureThreshold: 36
              ports:
                - name: jolokia
                  containerPort: 8778
                  protocol: TCP
                - name: http
                  containerPort: 8080
                  protocol: TCP
                - name: https
                  containerPort: 8443
                  protocol: TCP
              env:
                - name: APPLICATION_USERS_PROPERTIES
                  value: "/opt/kie/data/configuration/application-users.properties"
                - name: APPLICATION_ROLES_PROPERTIES
                  value: "/opt/kie/data/configuration/application-roles.properties"
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: MAVEN_MIRROR_URL
                  value: "${MAVEN_MIRROR_URL}"
                - name: MAVEN_REPO_ID
                  value: "${MAVEN_REPO_ID}"
                - name: MAVEN_REPO_URL
                  value: "${MAVEN_REPO_URL}"
                - name: MAVEN_REPO_USERNAME
                  value: "${MAVEN_REPO_USERNAME}"
                - name: MAVEN_REPO_PASSWORD
                  value: "${MAVEN_REPO_PASSWORD}"
                - name: KIE_SERVER_CONTROLLER_TOKEN
                  value: "${KIE_SERVER_CONTROLLER_TOKEN}"
                - name: HTTPS_KEYSTORE_DIR
                  value: "/etc/businesscentral-secret-volume"
                - name: HTTPS_KEYSTORE
                  value: "${BUSINESS_CENTRAL_HTTPS_KEYSTORE}"
                - name: HTTPS_NAME
                  value: "${BUSINESS_CENTRAL_HTTPS_NAME}"
                - name: HTTPS_PASSWORD
                  value: "${BUSINESS_CENTRAL_HTTPS_PASSWORD}"
                - name: JGROUPS_PING_PROTOCOL
                  value: "kubernetes.KUBE_PING"
                - name: KUBERNETES_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: KUBERNETES_LABELS
                  value: "cluster=jgrp.k8s.${APPLICATION_NAME}.rhpamcentrmon"
                - name: SSO_URL
                  value: "${SSO_URL}"
                - name: SSO_OPENIDCONNECT_DEPLOYMENTS
                  value: "ROOT.war"
                - name: SSO_REALM
                  value: "${SSO_REALM}"
                - name: SSO_SECRET
                  value: "${BUSINESS_CENTRAL_SSO_SECRET}"
                - name: SSO_CLIENT
                  value: "${BUSINESS_CENTRAL_SSO_CLIENT}"
                - name: SSO_USERNAME
                  value: "${SSO_USERNAME}"
                - name: SSO_PASSWORD
                  value: "${SSO_PASSWORD}"
                - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
                  value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                - name: SSO_PRINCIPAL_ATTRIBUTE
                  value: "${SSO_PRINCIPAL_ATTRIBUTE}"
                - name: HOSTNAME_HTTP
                  value: "${BUSINESS_CENTRAL_HOSTNAME_HTTP}"
                - name: HOSTNAME_HTTPS
                  value: "${BUSINESS_CENTRAL_HOSTNAME_HTTPS}"
                - name: AUTH_LDAP_URL
                  value: "${AUTH_LDAP_URL}"
                - name: AUTH_LDAP_BIND_DN
                  value: "${AUTH_LDAP_BIND_DN}"
                - name: AUTH_LDAP_BIND_CREDENTIAL
                  value: "${AUTH_LDAP_BIND_CREDENTIAL}"
                - name: AUTH_LDAP_LOGIN_MODULE
                  value: "${AUTH_LDAP_LOGIN_MODULE}"
                - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
                  value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}"
                - name: AUTH_LDAP_BASE_CTX_DN
                  value: "${AUTH_LDAP_BASE_CTX_DN}"
                - name: AUTH_LDAP_BASE_FILTER
                  value: "${AUTH_LDAP_BASE_FILTER}"
                - name: AUTH_LDAP_SEARCH_SCOPE
                  value: "${AUTH_LDAP_SEARCH_SCOPE}"
                - name: AUTH_LDAP_SEARCH_TIME_LIMIT
                  value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
                - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
                  value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}"
                - name: AUTH_LDAP_PARSE_USERNAME
                  value: "${AUTH_LDAP_PARSE_USERNAME}"
                - name: AUTH_LDAP_USERNAME_BEGIN_STRING
                  value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}"
                - name: AUTH_LDAP_USERNAME_END_STRING
                  value: "${AUTH_LDAP_USERNAME_END_STRING}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_ROLES_CTX_DN
                  value: "${AUTH_LDAP_ROLES_CTX_DN}"
                - name: AUTH_LDAP_ROLE_FILTER
                  value: "${AUTH_LDAP_ROLE_FILTER}"
                - name: AUTH_LDAP_ROLE_RECURSION
                  value: "${AUTH_LDAP_ROLE_RECURSION}"
                - name: AUTH_LDAP_DEFAULT_ROLE
                  value: "${AUTH_LDAP_DEFAULT_ROLE}"
                - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
                  value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}"
                - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
                  value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}"
                - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
                  value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
                - name: AUTH_ROLE_MAPPER_REPLACE_ROLE
                  value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}"
          volumes:
            - name: businesscentral-keystore-volume
              secret:
                secretName: "${BUSINESS_CENTRAL_HTTPS_SECRET}"
            - name: "${APPLICATION_NAME}-rhpamcentr-pvol"
              persistentVolumeClaim:
                claimName: "${APPLICATION_NAME}-rhpamcentr-claim"
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: ${APPLICATION_NAME}-smartrouter
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-smartrouter"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      strategy:
        rollingParams:
          maxSurge: 100%
          maxUnavailable: 0
        type: Rolling
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-smartrouter"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "rhpam-smartrouter-rhel8:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{SMART_ROUTER_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-smartrouter"
      template:
        metadata:
          name: "${APPLICATION_NAME}-smartrouter"
          labels:
            application: "${APPLICATION_NAME}"
            deploymentConfig: "${APPLICATION_NAME}-smartrouter"
            service: "${APPLICATION_NAME}-smartrouter"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.kieserver"
        spec:
          serviceAccountName: "${APPLICATION_NAME}-smartrouter"
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-smartrouter"
              image: rhpam-smartrouter-rhel8
              imagePullPolicy: Always
              resources:
                limits:
                  memory: "${SMART_ROUTER_MEMORY_LIMIT}"
              ports:
                - name: http
                  containerPort: 9000
                  protocol: TCP
              env:
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: KIE_SERVER_ROUTER_HOST
                  valueFrom:
                    fieldRef:
                      fieldPath: status.podIP
                - name: KIE_SERVER_ROUTER_PORT
                  value: "9000"
                - name: KIE_SERVER_ROUTER_PORT_TLS
                  value: "9443"
                - name: KIE_SERVER_ROUTER_URL_EXTERNAL
                  value: "${KIE_SERVER_ROUTER_URL_EXTERNAL}"
                - name: KIE_SERVER_ROUTER_ID
                  value: "${KIE_SERVER_ROUTER_ID}"
                - name: KIE_SERVER_ROUTER_NAME
                  value: "${KIE_SERVER_ROUTER_NAME}"
                - name: KIE_SERVER_ROUTER_ROUTE_NAME
                  value: "${APPLICATION_NAME}-smartrouter"
                - name: KIE_SERVER_ROUTER_SERVICE
                  value: "${APPLICATION_NAME}-smartrouter"
                - name: KIE_SERVER_ROUTER_PROTOCOL
                  value: "${KIE_SERVER_ROUTER_PROTOCOL}"
                - name: KIE_SERVER_ROUTER_TLS_KEYSTORE_KEYALIAS
                  value: "${KIE_SERVER_ROUTER_HTTPS_NAME}"
                - name: KIE_SERVER_ROUTER_TLS_KEYSTORE_PASSWORD
                  value: "${KIE_SERVER_ROUTER_HTTPS_PASSWORD}"
                - name: KIE_SERVER_ROUTER_TLS_KEYSTORE
                  value: "/etc/smartrouter-secret-volume/${KIE_SERVER_ROUTER_HTTPS_KEYSTORE}"
                - name: KIE_SERVER_CONTROLLER_TOKEN
                  value: "${KIE_SERVER_CONTROLLER_TOKEN}"
                - name: KIE_SERVER_CONTROLLER_SERVICE
                  value: "${APPLICATION_NAME}-rhpamcentrmon"
                - name: KIE_SERVER_CONTROLLER_PROTOCOL
                  value: "http"
                - name: KIE_SERVER_ROUTER_REPO
                  value: "/opt/rhpam-smartrouter/data"
                - name: KIE_SERVER_ROUTER_CONFIG_WATCHER_ENABLED
                  value: "true"
              volumeMounts:
                - name: "${APPLICATION_NAME}-smartrouter"
                  mountPath: "/opt/rhpam-smartrouter/data"
                - name: smartrouter-keystore-volume
                  mountPath: "/etc/smartrouter-secret-volume"
                  readOnly: true
          volumes:
            - name: "${APPLICATION_NAME}-smartrouter"
              persistentVolumeClaim:
                claimName: "${APPLICATION_NAME}-smartrouter-claim"
            - name: smartrouter-keystore-volume
              secret:
                secretName: "${KIE_SERVER_ROUTER_HTTPS_SECRET}"
## KIE Server deployment config 1 BEGIN
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-kieserver-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-1"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      revisionHistoryLimit: 10
      strategy:
        rollingParams:
          maxSurge: 100%
          maxUnavailable: 0
        type: Rolling
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-kieserver-1"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{KIE_SERVER_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver-1"
      template:
        metadata:
          name: "${APPLICATION_NAME}-kieserver-1"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-kieserver-1"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-kieserver-1"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.kieserver"
        spec:
          serviceAccountName: "${APPLICATION_NAME}-kieserver"
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-kieserver-1"
              image: "${KIE_SERVER_IMAGE_STREAM_NAME}"
              imagePullPolicy: Always
              resources:
                limits:
                  memory: "${KIE_SERVER_MEMORY_LIMIT}"
                  cpu: "${KIE_SERVER_CPU_LIMIT}"
                requests:
                  memory: "${KIE_SERVER_MEMORY_REQUEST}"
                  cpu: "${KIE_SERVER_CPU_REQUEST}"
              volumeMounts:
                - name: kieserver-keystore-volume
                  mountPath: "/etc/kieserver-secret-volume"
                  readOnly: true
              livenessProbe:
                httpGet:
                  path: /services/rest/server/healthcheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 180
                timeoutSeconds: 2
                periodSeconds: 15
                failureThreshold: 3
              readinessProbe:
                httpGet:
                  path: /services/rest/server/readycheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 30
                timeoutSeconds: 2
                periodSeconds: 5
                failureThreshold: 36
              ports:
                - name: jolokia
                  containerPort: 8778
                  protocol: TCP
                - name: http
                  containerPort: 8080
                  protocol: TCP
                - name: https
                  containerPort: 8443
                  protocol: TCP
              env:
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: KIE_SERVER_MODE
                  value: "${KIE_SERVER_MODE}"
                - name: KIE_MBEANS
                  value: "${KIE_MBEANS}"
                - name: DROOLS_SERVER_FILTER_CLASSES
                  value: "${DROOLS_SERVER_FILTER_CLASSES}"
                - name: PROMETHEUS_SERVER_EXT_DISABLED
                  value: "${PROMETHEUS_SERVER_EXT_DISABLED}"
                - name: KIE_SERVER_BYPASS_AUTH_USER
                  value: "${KIE_SERVER_BYPASS_AUTH_USER}"
                - name: KIE_SERVER_CONTROLLER_TOKEN
                  value: "${KIE_SERVER_CONTROLLER_TOKEN}"
                - name: KIE_SERVER_CONTROLLER_SERVICE
                  value: "${APPLICATION_NAME}-rhpamcentrmon"
                - name: KIE_SERVER_CONTROLLER_PROTOCOL
                  value: "ws"
                - name: KIE_SERVER_ID
                  value: "${APPLICATION_NAME}-kieserver-1"
                - name: KIE_SERVER_ROUTE_NAME
                  value: "${APPLICATION_NAME}-kieserver-1"
                - name: KIE_SERVER_USE_SECURE_ROUTE_NAME
                  value: "${KIE_SERVER1_USE_SECURE_ROUTE_NAME}"
                - name: KIE_SERVER_CONTAINER_DEPLOYMENT
                  value: ""
                - name: MAVEN_MIRROR_URL
                  value: "${MAVEN_MIRROR_URL}"
                - name: MAVEN_MIRROR_OF
                  value: "${MAVEN_MIRROR_OF}"
                - name: MAVEN_REPOS
                  value: "RHPAMCENTR,EXTERNAL"
                - name: RHPAMCENTR_MAVEN_REPO_ID
                  value: "repo-rhpamcentr"
                - name: RHPAMCENTR_MAVEN_REPO_SERVICE
                  value: "${BUSINESS_CENTRAL_MAVEN_SERVICE}"
                - name: RHPAMCENTR_MAVEN_REPO_PATH
                  value: "/maven2/"
                - name: EXTERNAL_MAVEN_REPO_ID
                  value: "${MAVEN_REPO_ID}"
                - name: EXTERNAL_MAVEN_REPO_URL
                  value: "${MAVEN_REPO_URL}"
                - name: EXTERNAL_MAVEN_REPO_USERNAME
                  value: "${MAVEN_REPO_USERNAME}"
                - name: EXTERNAL_MAVEN_REPO_PASSWORD
                  value: "${MAVEN_REPO_PASSWORD}"
                - name: KIE_SERVER_ROUTER_SERVICE
                  value: "${APPLICATION_NAME}-smartrouter"
                - name: KIE_SERVER_ROUTER_PORT
                  value: "9000"
                - name: KIE_SERVER_ROUTER_PROTOCOL
                  value: "${KIE_SERVER_ROUTER_PROTOCOL}"
                - name: KIE_SERVER_PERSISTENCE_DS
                  value: "${KIE_SERVER_PERSISTENCE_DS}"
                - name: DATASOURCES
                  value: "RHPAM"
                - name: RHPAM_JNDI
                  value: "${KIE_SERVER_PERSISTENCE_DS}"
                - name: RHPAM_JTA
                  value: "true"
## PostgreSQL driver settings 1 BEGIN
                - name: RHPAM_DATABASE
                  value: "${KIE_SERVER_POSTGRESQL_DB}"
                - name: RHPAM_DRIVER
                  value: "postgresql"
                - name: KIE_SERVER_PERSISTENCE_DIALECT
                  value: "${KIE_SERVER_POSTGRESQL_DIALECT}"
                - name: RHPAM_USERNAME
                  value: "${KIE_SERVER_POSTGRESQL_USER}"
                - name: RHPAM_PASSWORD
                  value: "${KIE_SERVER_POSTGRESQL_PWD}"
                - name: RHPAM_SERVICE_HOST
                  value: "${APPLICATION_NAME}-postgresql-1"
                - name: RHPAM_SERVICE_PORT
                  value: "5432"
                - name: TIMER_SERVICE_DATA_STORE
                  value: "${APPLICATION_NAME}-postgresql-1"
## PostgreSQL driver settings 1 END
                - name: TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL
                  value: "${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}"
                - name: HTTPS_KEYSTORE_DIR
                  value: "/etc/kieserver-secret-volume"
                - name: HTTPS_KEYSTORE
                  value: "${KIE_SERVER_HTTPS_KEYSTORE}"
                - name: HTTPS_NAME
                  value: "${KIE_SERVER_HTTPS_NAME}"
                - name: HTTPS_PASSWORD
                  value: "${KIE_SERVER_HTTPS_PASSWORD}"
                - name: JGROUPS_PING_PROTOCOL
                  value: "kubernetes.KUBE_PING"
                - name: KUBERNETES_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: KUBERNETES_LABELS
                  value: "cluster=jgrp.k8s.${APPLICATION_NAME}.kieserver"
                - name: SSO_URL
                  value: "${SSO_URL}"
                - name: SSO_OPENIDCONNECT_DEPLOYMENTS
                  value: "ROOT.war"
                - name: SSO_REALM
                  value: "${SSO_REALM}"
                - name: SSO_SECRET
                  value: "${KIE_SERVER1_SSO_SECRET}"
                - name: SSO_CLIENT
                  value: "${KIE_SERVER1_SSO_CLIENT}"
                - name: SSO_USERNAME
                  value: "${SSO_USERNAME}"
                - name: SSO_PASSWORD
                  value: "${SSO_PASSWORD}"
                - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
                  value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                - name: SSO_PRINCIPAL_ATTRIBUTE
                  value: "${SSO_PRINCIPAL_ATTRIBUTE}"
                - name: HOSTNAME_HTTP
                  value: "${KIE_SERVER1_HOSTNAME_HTTP}"
                - name: HOSTNAME_HTTPS
                  value: "${KIE_SERVER1_HOSTNAME_HTTPS}"
                - name: AUTH_LDAP_URL
                  value: "${AUTH_LDAP_URL}"
                - name: AUTH_LDAP_BIND_DN
                  value: "${AUTH_LDAP_BIND_DN}"
                - name: AUTH_LDAP_BIND_CREDENTIAL
                  value: "${AUTH_LDAP_BIND_CREDENTIAL}"
                - name: AUTH_LDAP_LOGIN_MODULE
                  value: "${AUTH_LDAP_LOGIN_MODULE}"
                - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
                  value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}"
                - name: AUTH_LDAP_BASE_CTX_DN
                  value: "${AUTH_LDAP_BASE_CTX_DN}"
                - name: AUTH_LDAP_BASE_FILTER
                  value: "${AUTH_LDAP_BASE_FILTER}"
                - name: AUTH_LDAP_SEARCH_SCOPE
                  value: "${AUTH_LDAP_SEARCH_SCOPE}"
                - name: AUTH_LDAP_SEARCH_TIME_LIMIT
                  value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
                - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
                  value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}"
                - name: AUTH_LDAP_PARSE_USERNAME
                  value: "${AUTH_LDAP_PARSE_USERNAME}"
                - name: AUTH_LDAP_USERNAME_BEGIN_STRING
                  value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}"
                - name: AUTH_LDAP_USERNAME_END_STRING
                  value: "${AUTH_LDAP_USERNAME_END_STRING}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_ROLES_CTX_DN
                  value: "${AUTH_LDAP_ROLES_CTX_DN}"
                - name: AUTH_LDAP_ROLE_FILTER
                  value: "${AUTH_LDAP_ROLE_FILTER}"
                - name: AUTH_LDAP_ROLE_RECURSION
                  value: "${AUTH_LDAP_ROLE_RECURSION}"
                - name: AUTH_LDAP_DEFAULT_ROLE
                  value: "${AUTH_LDAP_DEFAULT_ROLE}"
                - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
                  value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}"
                - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
                  value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}"
                - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
                  value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
                - name: AUTH_ROLE_MAPPER_REPLACE_ROLE
                  value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}"
          volumes:
            - name: kieserver-keystore-volume
              secret:
                secretName: "${KIE_SERVER_HTTPS_SECRET}"
          initContainers:
            - command:
                - /bin/bash
                - '-c'
                - >-
                  replicas=$(oc get dc ${APPLICATION_NAME}-postgresql-1 -o=jsonpath='{.status.availableReplicas}'); until "[" $replicas -gt 0 "]"; do echo waiting for ${APPLICATION_NAME}-postgresql-1; replicas=$(oc get dc ${APPLICATION_NAME}-postgresql-1 -o=jsonpath='{.status.availableReplicas}'); sleep 2; done;
              image: registry.redhat.io/openshift3/ose-cli
              imagePullPolicy: IfNotPresent
              name: ${APPLICATION_NAME}-postgresql-init-1
              terminationMessagePolicy: FallbackToLogsOnError
## KIE Server deployment config 1 END
## PostgreSQL deployment config 1 BEGIN
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-postgresql-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-postgresql-1"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      strategy:
        type: Recreate
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-postgresql-1"
            from:
              kind: ImageStreamTag
              namespace: "${POSTGRESQL_IMAGE_STREAM_NAMESPACE}"
              name: "postgresql:${POSTGRESQL_IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: 1
      selector:
        deploymentConfig: "${APPLICATION_NAME}-postgresql-1"
      template:
        metadata:
          name: "${APPLICATION_NAME}-postgresql-1"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-postgresql-1"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-postgresql-1"
        spec:
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-postgresql-1"
              image: postgresql
              imagePullPolicy: Always
              livenessProbe:
                exec:
                  command:
                    - "/usr/libexec/check-container"
                    - "--live"
                initialDelaySeconds: 120
                timeoutSeconds: 10
              readinessProbe:
                exec:
                  command:
                    - "/usr/libexec/check-container"
                initialDelaySeconds: 5
                timeoutSeconds: 1
              ports:
                - containerPort: 5432
                  protocol: TCP
              volumeMounts:
                - mountPath: "/var/lib/pgsql/data"
                  name: "${APPLICATION_NAME}-postgresql-pvol"
              env:
                - name: POSTGRESQL_USER
                  value: "${KIE_SERVER_POSTGRESQL_USER}"
                - name: POSTGRESQL_PASSWORD
                  value: "${KIE_SERVER_POSTGRESQL_PWD}"
                - name: POSTGRESQL_DATABASE
                  value: "${KIE_SERVER_POSTGRESQL_DB}"
                - name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS
                  value: "${POSTGRESQL_MAX_PREPARED_TRANSACTIONS}"
          volumes:
            - name: "${APPLICATION_NAME}-postgresql-pvol"
              persistentVolumeClaim:
                claimName: "${APPLICATION_NAME}-postgresql-claim-1"
## PostgreSQL deployment config 1 END
## KIE Server deployment config 2 BEGIN
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-kieserver-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-kieserver-2"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      revisionHistoryLimit: 10
      strategy:
        rollingParams:
          maxSurge: 100%
          maxUnavailable: 0
        type: Rolling
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-kieserver-2"
            from:
              kind: ImageStreamTag
              namespace: "${IMAGE_STREAM_NAMESPACE}"
              name: "${KIE_SERVER_IMAGE_STREAM_NAME}:${IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: "${{KIE_SERVER_CONTAINER_REPLICAS}}"
      selector:
        deploymentConfig: "${APPLICATION_NAME}-kieserver-2"
      template:
        metadata:
          name: "${APPLICATION_NAME}-kieserver-2"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-kieserver-2"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-kieserver-2"
            cluster: "jgrp.k8s.${APPLICATION_NAME}.kieserver"
        spec:
          serviceAccountName: "${APPLICATION_NAME}-kieserver"
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-kieserver-2"
              image: "${KIE_SERVER_IMAGE_STREAM_NAME}"
              imagePullPolicy: Always
              resources:
                limits:
                  memory: "${KIE_SERVER_MEMORY_LIMIT}"
                  cpu: "${KIE_SERVER_CPU_LIMIT}"
                requests:
                  memory: "${KIE_SERVER_MEMORY_REQUEST}"
                  cpu: "${KIE_SERVER_CPU_REQUEST}"
              volumeMounts:
                - name: kieserver-keystore-volume
                  mountPath: "/etc/kieserver-secret-volume"
                  readOnly: true
              livenessProbe:
                httpGet:
                  path: /services/rest/server/healthcheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 180
                timeoutSeconds: 2
                periodSeconds: 15
                failureThreshold: 3
              readinessProbe:
                httpGet:
                  path: /services/rest/server/readycheck
                  port: 8080
                  scheme: HTTP
                initialDelaySeconds: 30
                timeoutSeconds: 2
                periodSeconds: 5
                failureThreshold: 36
              ports:
                - name: jolokia
                  containerPort: 8778
                  protocol: TCP
                - name: http
                  containerPort: 8080
                  protocol: TCP
                - name: https
                  containerPort: 8443
                  protocol: TCP
              env:
                - name: KIE_ADMIN_USER
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_USER
                - name: KIE_ADMIN_PWD
                  valueFrom:
                    secretKeyRef:
                      name: "${CREDENTIALS_SECRET}"
                      key: KIE_ADMIN_PWD
                - name: KIE_SERVER_MODE
                  value: "${KIE_SERVER_MODE}"
                - name: KIE_MBEANS
                  value: "${KIE_MBEANS}"
                - name: DROOLS_SERVER_FILTER_CLASSES
                  value: "${DROOLS_SERVER_FILTER_CLASSES}"
                - name: PROMETHEUS_SERVER_EXT_DISABLED
                  value: "${PROMETHEUS_SERVER_EXT_DISABLED}"
                - name: KIE_SERVER_BYPASS_AUTH_USER
                  value: "${KIE_SERVER_BYPASS_AUTH_USER}"
                - name: KIE_SERVER_CONTROLLER_TOKEN
                  value: "${KIE_SERVER_CONTROLLER_TOKEN}"
                - name: KIE_SERVER_CONTROLLER_SERVICE
                  value: "${APPLICATION_NAME}-rhpamcentrmon"
                - name: KIE_SERVER_CONTROLLER_PROTOCOL
                  value: "ws"
                - name: KIE_SERVER_ID
                  value: "${APPLICATION_NAME}-kieserver-2"
                - name: KIE_SERVER_ROUTE_NAME
                  value: "${APPLICATION_NAME}-kieserver-2"
                - name: KIE_SERVER_USE_SECURE_ROUTE_NAME
                  value: "${KIE_SERVER2_USE_SECURE_ROUTE_NAME}"
                - name: KIE_SERVER_CONTAINER_DEPLOYMENT
                  value: ""
                - name: MAVEN_MIRROR_URL
                  value: "${MAVEN_MIRROR_URL}"
                - name: MAVEN_MIRROR_OF
                  value: "${MAVEN_MIRROR_OF}"
                - name: MAVEN_REPOS
                  value: "RHPAMCENTR,EXTERNAL"
                - name: RHPAMCENTR_MAVEN_REPO_ID
                  value: "repo-rhpamcentr"
                - name: RHPAMCENTR_MAVEN_REPO_SERVICE
                  value: "${BUSINESS_CENTRAL_MAVEN_SERVICE}"
                - name: RHPAMCENTR_MAVEN_REPO_PATH
                  value: "/maven2/"
                - name: EXTERNAL_MAVEN_REPO_ID
                  value: "${MAVEN_REPO_ID}"
                - name: EXTERNAL_MAVEN_REPO_URL
                  value: "${MAVEN_REPO_URL}"
                - name: EXTERNAL_MAVEN_REPO_USERNAME
                  value: "${MAVEN_REPO_USERNAME}"
                - name: EXTERNAL_MAVEN_REPO_PASSWORD
                  value: "${MAVEN_REPO_PASSWORD}"
                - name: KIE_SERVER_ROUTER_SERVICE
                  value: "${APPLICATION_NAME}-smartrouter"
                - name: KIE_SERVER_ROUTER_PORT
                  value: "9000"
                - name: KIE_SERVER_ROUTER_PROTOCOL
                  value: "${KIE_SERVER_ROUTER_PROTOCOL}"
                - name: KIE_SERVER_PERSISTENCE_DS
                  value: "${KIE_SERVER_PERSISTENCE_DS}"
                - name: DATASOURCES
                  value: "RHPAM"
                - name: RHPAM_JNDI
                  value: "${KIE_SERVER_PERSISTENCE_DS}"
                - name: RHPAM_JTA
                  value: "true"
## PostgreSQL driver settings 2 BEGIN
                - name: RHPAM_DATABASE
                  value: "${KIE_SERVER_POSTGRESQL_DB}"
                - name: RHPAM_DRIVER
                  value: "postgresql"
                - name: KIE_SERVER_PERSISTENCE_DIALECT
                  value: "${KIE_SERVER_POSTGRESQL_DIALECT}"
                - name: RHPAM_USERNAME
                  value: "${KIE_SERVER_POSTGRESQL_USER}"
                - name: RHPAM_PASSWORD
                  value: "${KIE_SERVER_POSTGRESQL_PWD}"
                - name: RHPAM_SERVICE_HOST
                  value: "${APPLICATION_NAME}-postgresql-2"
                - name: RHPAM_SERVICE_PORT
                  value: "5432"
                - name: TIMER_SERVICE_DATA_STORE
                  value: "${APPLICATION_NAME}-postgresql-2"
## PostgreSQL driver settings 2 END
                - name: TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL
                  value: "${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}"
                - name: HTTPS_KEYSTORE_DIR
                  value: "/etc/kieserver-secret-volume"
                - name: HTTPS_KEYSTORE
                  value: "${KIE_SERVER_HTTPS_KEYSTORE}"
                - name: HTTPS_NAME
                  value: "${KIE_SERVER_HTTPS_NAME}"
                - name: HTTPS_PASSWORD
                  value: "${KIE_SERVER_HTTPS_PASSWORD}"
                - name: JGROUPS_PING_PROTOCOL
                  value: "kubernetes.KUBE_PING"
                - name: KUBERNETES_NAMESPACE
                  valueFrom:
                    fieldRef:
                      fieldPath: metadata.namespace
                - name: KUBERNETES_LABELS
                  value: "cluster=jgrp.k8s.${APPLICATION_NAME}.kieserver"
                - name: SSO_URL
                  value: "${SSO_URL}"
                - name: SSO_OPENIDCONNECT_DEPLOYMENTS
                  value: "ROOT.war"
                - name: SSO_REALM
                  value: "${SSO_REALM}"
                - name: SSO_SECRET
                  value: "${KIE_SERVER2_SSO_SECRET}"
                - name: SSO_CLIENT
                  value: "${KIE_SERVER2_SSO_CLIENT}"
                - name: SSO_USERNAME
                  value: "${SSO_USERNAME}"
                - name: SSO_PASSWORD
                  value: "${SSO_PASSWORD}"
                - name: SSO_DISABLE_SSL_CERTIFICATE_VALIDATION
                  value: "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                - name: SSO_PRINCIPAL_ATTRIBUTE
                  value: "${SSO_PRINCIPAL_ATTRIBUTE}"
                - name: HOSTNAME_HTTP
                  value: "${KIE_SERVER2_HOSTNAME_HTTP}"
                - name: HOSTNAME_HTTPS
                  value: "${KIE_SERVER2_HOSTNAME_HTTPS}"
                - name: AUTH_LDAP_URL
                  value: "${AUTH_LDAP_URL}"
                - name: AUTH_LDAP_BIND_DN
                  value: "${AUTH_LDAP_BIND_DN}"
                - name: AUTH_LDAP_BIND_CREDENTIAL
                  value: "${AUTH_LDAP_BIND_CREDENTIAL}"
                - name: AUTH_LDAP_LOGIN_MODULE
                  value: "${AUTH_LDAP_LOGIN_MODULE}"
                - name: AUTH_LDAP_JAAS_SECURITY_DOMAIN
                  value: "${AUTH_LDAP_JAAS_SECURITY_DOMAIN}"
                - name: AUTH_LDAP_BASE_CTX_DN
                  value: "${AUTH_LDAP_BASE_CTX_DN}"
                - name: AUTH_LDAP_BASE_FILTER
                  value: "${AUTH_LDAP_BASE_FILTER}"
                - name: AUTH_LDAP_SEARCH_SCOPE
                  value: "${AUTH_LDAP_SEARCH_SCOPE}"
                - name: AUTH_LDAP_SEARCH_TIME_LIMIT
                  value: "${AUTH_LDAP_SEARCH_TIME_LIMIT}"
                - name: AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE
                  value: "${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}"
                - name: AUTH_LDAP_PARSE_USERNAME
                  value: "${AUTH_LDAP_PARSE_USERNAME}"
                - name: AUTH_LDAP_USERNAME_BEGIN_STRING
                  value: "${AUTH_LDAP_USERNAME_BEGIN_STRING}"
                - name: AUTH_LDAP_USERNAME_END_STRING
                  value: "${AUTH_LDAP_USERNAME_END_STRING}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_ROLES_CTX_DN
                  value: "${AUTH_LDAP_ROLES_CTX_DN}"
                - name: AUTH_LDAP_ROLE_FILTER
                  value: "${AUTH_LDAP_ROLE_FILTER}"
                - name: AUTH_LDAP_ROLE_RECURSION
                  value: "${AUTH_LDAP_ROLE_RECURSION}"
                - name: AUTH_LDAP_DEFAULT_ROLE
                  value: "${AUTH_LDAP_DEFAULT_ROLE}"
                - name: AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID
                  value: "${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}"
                - name: AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN
                  value: "${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}"
                - name: AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN
                  value: "${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}"
                - name: AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK
                  value: "${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}"
                - name: AUTH_ROLE_MAPPER_ROLES_PROPERTIES
                  value: "${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}"
                - name: AUTH_ROLE_MAPPER_REPLACE_ROLE
                  value: "${AUTH_ROLE_MAPPER_REPLACE_ROLE}"
          volumes:
            - name: kieserver-keystore-volume
              secret:
                secretName: "${KIE_SERVER_HTTPS_SECRET}"
          initContainers:
            - command:
                - /bin/bash
                - '-c'
                - >-
                  replicas=$(oc get dc ${APPLICATION_NAME}-postgresql-2 -o=jsonpath='{.status.availableReplicas}'); until "[" $replicas -gt 0 "]"; do echo waiting for ${APPLICATION_NAME}-postgresql-2; replicas=$(oc get dc ${APPLICATION_NAME}-postgresql-2 -o=jsonpath='{.status.availableReplicas}'); sleep 2; done;
              image: registry.redhat.io/openshift3/ose-cli
              imagePullPolicy: IfNotPresent
              name: ${APPLICATION_NAME}-postgresql-init-2
              terminationMessagePolicy: FallbackToLogsOnError
## KIE Server deployment config 2 END
## PostgreSQL deployment config 2 BEGIN
  - kind: DeploymentConfig
    apiVersion: v1
    metadata:
      name: "${APPLICATION_NAME}-postgresql-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-postgresql-2"
      annotations:
        template.alpha.openshift.io/wait-for-ready: "true"
    spec:
      strategy:
        type: Recreate
      triggers:
        - type: ImageChange
          imageChangeParams:
            automatic: true
            containerNames:
              - "${APPLICATION_NAME}-postgresql-2"
            from:
              kind: ImageStreamTag
              namespace: "${POSTGRESQL_IMAGE_STREAM_NAMESPACE}"
              name: "postgresql:${POSTGRESQL_IMAGE_STREAM_TAG}"
        - type: ConfigChange
      replicas: 1
      selector:
        deploymentConfig: "${APPLICATION_NAME}-postgresql-2"
      template:
        metadata:
          name: "${APPLICATION_NAME}-postgresql-2"
          labels:
            deploymentConfig: "${APPLICATION_NAME}-postgresql-2"
            application: "${APPLICATION_NAME}"
            service: "${APPLICATION_NAME}-postgresql-2"
        spec:
          terminationGracePeriodSeconds: 60
          containers:
            - name: "${APPLICATION_NAME}-postgresql-2"
              image: postgresql
              imagePullPolicy: Always
              livenessProbe:
                exec:
                  command:
                    - "/usr/libexec/check-container"
                    - "--live"
                initialDelaySeconds: 120
                timeoutSeconds: 10
              readinessProbe:
                exec:
                  command:
                    - "/usr/libexec/check-container"
                initialDelaySeconds: 5
                timeoutSeconds: 1
              ports:
                - containerPort: 5432
                  protocol: TCP
              volumeMounts:
                - mountPath: "/var/lib/pgsql/data"
                  name: "${APPLICATION_NAME}-postgresql-pvol"
              env:
                - name: POSTGRESQL_USER
                  value: "${KIE_SERVER_POSTGRESQL_USER}"
                - name: POSTGRESQL_PASSWORD
                  value: "${KIE_SERVER_POSTGRESQL_PWD}"
                - name: POSTGRESQL_DATABASE
                  value: "${KIE_SERVER_POSTGRESQL_DB}"
                - name: POSTGRESQL_MAX_PREPARED_TRANSACTIONS
                  value: "${POSTGRESQL_MAX_PREPARED_TRANSACTIONS}"
          volumes:
            - name: "${APPLICATION_NAME}-postgresql-pvol"
              persistentVolumeClaim:
                claimName: "${APPLICATION_NAME}-postgresql-claim-2"
## PostgreSQL deployment config 2 END
## PostgreSQL persistent volume claim 1 BEGIN
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: "${APPLICATION_NAME}-postgresql-claim-1"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-postgresql-1"
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: "${DB_VOLUME_CAPACITY}"
## PostgreSQL persistent volume claim 1 END
## PostgreSQL persistent volume claim 2 BEGIN
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: "${APPLICATION_NAME}-postgresql-claim-2"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-postgresql-2"
    spec:
      accessModes:
        - ReadWriteOnce
      resources:
        requests:
          storage: "${DB_VOLUME_CAPACITY}"
## PostgreSQL persistent volume claim 2 END
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: "${APPLICATION_NAME}-smartrouter-claim"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-smartrouter"
    spec:
      accessModes:
        - ReadWriteMany
      resources:
        requests:
          storage: "64Mi"
  - apiVersion: v1
    kind: PersistentVolumeClaim
    metadata:
      name: "${APPLICATION_NAME}-rhpamcentr-claim"
      labels:
        application: "${APPLICATION_NAME}"
        service: "${APPLICATION_NAME}-rhpamcentrmon"
    spec:
      accessModes:
        - ReadWriteMany
      resources:
        requests:
          storage: "64Mi"
