rhpam76-managed.adoc

rhpam76-managed

Application template for a managed HA production runtime environment, for Red Hat Process Automation Manager 7.6 - Deprecated

Table of Contents

• Parameters
• Objects
  • Services
  • Routes
  • Deployment Configurations
    • Triggers
    • Replicas
    • Pod Template
      • Service Accounts
      • Image
      • Readiness Probe
      • Liveness Probe
      • Exposed Ports
      • Image Environment Variables
      • Volumes
  • External Dependencies
    • Volume Claims
    • Secrets

Parameters

Templates allow you to define parameters which take on a value. That value is then substituted wherever the parameter is referenced. References can be defined in any text field in the objects list field. Refer to the Openshift documentation for more information.

Variable name	Image Environment Variable	Description	Example value	Required
APPLICATION_NAME	—	The name for the application.	myapp	True
MAVEN_MIRROR_URL	MAVEN_MIRROR_URL	Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.	—	False
MAVEN_MIRROR_OF	MAVEN_MIRROR_OF	Maven mirror configuration for KIE server.	external:*	False
MAVEN_REPO_ID	MAVEN_REPO_ID	The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.	repo-custom	False
MAVEN_REPO_URL	MAVEN_REPO_URL	Fully qualified URL to a Maven repository or service.	http://nexus.nexus-project.svc.cluster.local:8081/nexus/content/groups/public/	True
MAVEN_REPO_USERNAME	MAVEN_REPO_USERNAME	Username to access the Maven repository, if required.	—	False
MAVEN_REPO_PASSWORD	MAVEN_REPO_PASSWORD	Password to access the Maven repository, if required.	—	False
BUSINESS_CENTRAL_SERVICE	RHPAMCENTR_MAVEN_REPO_SERVICE	The Service name for the optional Business Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required.	myapp-rhpamcentrmon	False
BUSINESS_CENTRAL_MAVEN_USERNAME	RHPAMCENTR_MAVEN_REPO_USERNAME	Username to access the Maven service hosted by Business Central inside EAP.	mavenUser	False
BUSINESS_CENTRAL_MAVEN_PASSWORD	RHPAMCENTR_MAVEN_REPO_PASSWORD	Password to access the Maven service hosted by Business Central inside EAP.	maven1!	False
KIE_ADMIN_USER	KIE_ADMIN_USER	KIE administrator username.	adminUser	False
KIE_ADMIN_PWD	KIE_ADMIN_PWD	KIE administrator password.	—	False
KIE_SERVER_USER	KIE_SERVER_USER	KIE server username. (Sets the org.kie.server.user system property)	executionUser	False
KIE_SERVER_PWD	KIE_SERVER_PWD	KIE server password. (Sets the org.kie.server.pwd system property)	—	False
KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED	KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED	If set to true, turns on KIE server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)	false	False
KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE	KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE	If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)	true	False
KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL	KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL	KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property)	60000	False
IMAGE_STREAM_NAMESPACE	—	Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you installed the ImageStreams in a different namespace/project.	openshift	True
KIE_SERVER_IMAGE_STREAM_NAME	—	The name of the image stream to use for KIE server. Default is "rhpam76-kieserver-openshift".	rhpam76-kieserver-openshift	True
IMAGE_STREAM_TAG	—	A named pointer to an image in an image stream. Default is "1.0".	1.0	True
KIE_SERVER_CONTROLLER_USER	KIE_SERVER_CONTROLLER_USER	KIE server controller username. (Sets the org.kie.server.controller.user system property)	controllerUser	False
KIE_SERVER_CONTROLLER_PWD	KIE_SERVER_CONTROLLER_PWD	KIE server controller password. (Sets the org.kie.server.controller.pwd system property)	—	False
KIE_SERVER_CONTROLLER_TOKEN	KIE_SERVER_CONTROLLER_TOKEN	KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)	—	False
KIE_SERVER_PERSISTENCE_DS	KIE_SERVER_PERSISTENCE_DS	KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)	java:/jboss/datasources/rhpam	False
POSTGRESQL_IMAGE_STREAM_NAMESPACE	—	Namespace in which the ImageStream for the PostgreSQL image is installed. The ImageStream is already installed in the openshift namespace. You should only need to modify this if you installed the ImageStream in a different namespace/project. Default is "openshift".	openshift	False
POSTGRESQL_IMAGE_STREAM_TAG	—	The PostgreSQL image version, which is intended to correspond to the PostgreSQL version. Default is "10".	10	False
KIE_SERVER_POSTGRESQL_USER	RHPAM_USERNAME	KIE server PostgreSQL database username.	rhpam	False
KIE_SERVER_POSTGRESQL_PWD	RHPAM_PASSWORD	KIE server PostgreSQL database password.	—	False
KIE_SERVER_POSTGRESQL_DB	RHPAM_DATABASE	KIE server PostgreSQL database name.	rhpam7	False
POSTGRESQL_MAX_PREPARED_TRANSACTIONS	POSTGRESQL_MAX_PREPARED_TRANSACTIONS	Allows the PostgreSQL to handle XA transactions.	100	True
DB_VOLUME_CAPACITY	—	Size of persistent storage for the database volume.	1Gi	True
KIE_SERVER_POSTGRESQL_DIALECT	KIE_SERVER_PERSISTENCE_DIALECT	KIE server PostgreSQL Hibernate dialect.	org.hibernate.dialect.PostgreSQLDialect	True
KIE_SERVER_MODE	KIE_SERVER_MODE	The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).	PRODUCTION	False
KIE_MBEANS	KIE_MBEANS	KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties)	enabled	False
DROOLS_SERVER_FILTER_CLASSES	DROOLS_SERVER_FILTER_CLASSES	KIE server class filtering. (Sets the org.drools.server.filter.classes system property)	true	False
PROMETHEUS_SERVER_EXT_DISABLED	PROMETHEUS_SERVER_EXT_DISABLED	If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)	false	False
BUSINESS_CENTRAL_HOSTNAME_HTTP	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-rhpamcentrmon-<project>.<default-domain-suffix>	—	False
BUSINESS_CENTRAL_HOSTNAME_HTTPS	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentrmon-<project>.<default-domain-suffix>	—	False
KIE_SERVER_HOSTNAME_HTTP	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>	—	False
KIE_SERVER_HOSTNAME_HTTPS	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>	—	False
BUSINESS_CENTRAL_HTTPS_SECRET	—	The name of the secret containing the keystore file for Business Central.	businesscentral-app-secret	True
BUSINESS_CENTRAL_HTTPS_KEYSTORE	HTTPS_KEYSTORE	The name of the keystore file within the secret.	keystore.jks	False
BUSINESS_CENTRAL_HTTPS_NAME	HTTPS_NAME	The name associated with the server certificate.	jboss	False
BUSINESS_CENTRAL_HTTPS_PASSWORD	HTTPS_PASSWORD	The password for the keystore and certificate.	mykeystorepass	False
KIE_SERVER_HTTPS_SECRET	—	The name of the secret containing the keystore file for KIE server.	kieserver-app-secret	True
KIE_SERVER_HTTPS_KEYSTORE	HTTPS_KEYSTORE	The name of the keystore file within the secret.	keystore.jks	False
KIE_SERVER_HTTPS_NAME	HTTPS_NAME	The name associated with the server certificate.	jboss	False
KIE_SERVER_HTTPS_PASSWORD	HTTPS_PASSWORD	The password for the keystore and certificate.	mykeystorepass	False
KIE_SERVER_BYPASS_AUTH_USER	KIE_SERVER_BYPASS_AUTH_USER	Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)	false	False
TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL	TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL	Sets refresh-interval for the EJB timer service database-data-store.	30000	False
BUSINESS_CENTRAL_MEMORY_LIMIT	—	Business Central Monitoring Container memory limit.	2Gi	False
KIE_SERVER_MEMORY_LIMIT	—	KIE server Container memory limit.	1Gi	False
BUSINESS_CENTRAL_MONITORING_CONTAINER_REPLICAS	—	Business Central Monitoring Container Replicas, will define how much Business Central Monitoring containers will be started.	3	True
KIE_SERVER_CONTAINER_REPLICAS	—	KIE Server Container Replicas, will define how much KIE Server containers will be started.	3	True
SSO_URL	SSO_URL	RH-SSO URL.	https://rh-sso.example.com/auth	False
SSO_REALM	SSO_REALM	RH-SSO Realm name.	—	False
BUSINESS_CENTRAL_SSO_CLIENT	SSO_CLIENT	Business Central Monitoring RH-SSO Client name.	—	False
BUSINESS_CENTRAL_SSO_SECRET	SSO_SECRET	Business Central Monitoring RH-SSO Client Secret.	252793ed-7118-4ca8-8dab-5622fa97d892	False
KIE_SERVER_SSO_CLIENT	SSO_CLIENT	KIE Server RH-SSO Client name.	—	False
KIE_SERVER_SSO_SECRET	SSO_SECRET	KIE Server RH-SSO Client Secret.	252793ed-7118-4ca8-8dab-5622fa97d892	False
SSO_USERNAME	SSO_USERNAME	RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.	—	False
SSO_PASSWORD	SSO_PASSWORD	RH-SSO Realm Admin Password used to create the Client.	—	False
SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	RH-SSO Disable SSL Certificate Validation.	false	False
SSO_PRINCIPAL_ATTRIBUTE	SSO_PRINCIPAL_ATTRIBUTE	RH-SSO Principal Attribute to use as username.	preferred_username	False
AUTH_LDAP_URL	AUTH_LDAP_URL	LDAP Endpoint to connect for authentication.	ldap://myldap.example.com	False
AUTH_LDAP_BIND_DN	AUTH_LDAP_BIND_DN	Bind DN used for authentication.	uid=admin,ou=users,ou=exmample,ou=com	False
AUTH_LDAP_BIND_CREDENTIAL	AUTH_LDAP_BIND_CREDENTIAL	LDAP Credentials used for authentication.	Password	False
AUTH_LDAP_JAAS_SECURITY_DOMAIN	AUTH_LDAP_JAAS_SECURITY_DOMAIN	The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.	—	False
AUTH_LDAP_BASE_CTX_DN	AUTH_LDAP_BASE_CTX_DN	LDAP Base DN of the top-level context to begin the user search.	ou=users,ou=example,ou=com	False
AUTH_LDAP_BASE_FILTER	AUTH_LDAP_BASE_FILTER	LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).	(uid={0})	False
AUTH_LDAP_SEARCH_SCOPE	AUTH_LDAP_SEARCH_SCOPE	The search scope to use.	SUBTREE_SCOPE	False
AUTH_LDAP_SEARCH_TIME_LIMIT	AUTH_LDAP_SEARCH_TIME_LIMIT	The timeout in milliseconds for user or role searches.	10000	False
AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE	AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE	The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.	distinguishedName	False
AUTH_LDAP_PARSE_USERNAME	AUTH_LDAP_PARSE_USERNAME	A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.	true	False
AUTH_LDAP_USERNAME_BEGIN_STRING	AUTH_LDAP_USERNAME_BEGIN_STRING	Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	—	False
AUTH_LDAP_USERNAME_END_STRING	AUTH_LDAP_USERNAME_END_STRING	Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	—	False
AUTH_LDAP_ROLE_ATTRIBUTE_ID	AUTH_LDAP_ROLE_ATTRIBUTE_ID	Name of the attribute containing the user roles.	memberOf	False
AUTH_LDAP_ROLES_CTX_DN	AUTH_LDAP_ROLES_CTX_DN	The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.	ou=groups,ou=example,ou=com	False
AUTH_LDAP_ROLE_FILTER	AUTH_LDAP_ROLE_FILTER	A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).	(memberOf={1})	False
AUTH_LDAP_ROLE_RECURSION	AUTH_LDAP_ROLE_RECURSION	The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.	1	False
AUTH_LDAP_DEFAULT_ROLE	AUTH_LDAP_DEFAULT_ROLE	A role included for all authenticated users	user	False
AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID	AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID	Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.	name	False
AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN	AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN	A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.	false	False
AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN	AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN	Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.	false	False
AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK	AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK	If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.	—	False
AUTH_ROLE_MAPPER_ROLES_PROPERTIES	AUTH_ROLE_MAPPER_ROLES_PROPERTIES	When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3	—	False
AUTH_ROLE_MAPPER_REPLACE_ROLE	AUTH_ROLE_MAPPER_REPLACE_ROLE	Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.	—	False

Objects

The CLI supports various object types. A list of these object types as well as their abbreviations can be found in the Openshift documentation.

Services

A service is an abstraction which defines a logical set of pods and a policy by which to access them. Refer to the container-engine documentation for more information.

Service	Port	Name	Description
${APPLICATION_NAME}-rhpamcentrmon	8080	http	All the Business Central Monitoring web server’s ports.
	8443	https
${APPLICATION_NAME}-rhpamcentrmon-ping	8888	ping	The JGroups ping port for clustering.
${APPLICATION_NAME}-kieserver	8080	http	All the KIE server web server’s ports. (First KIE server)
	8443	https
${APPLICATION_NAME}-kieserver-ping	8888	ping	The JGroups ping port for clustering.
${APPLICATION_NAME}-postgresql	5432	—	The first database server’s port.

Routes

A route is a way to expose a service by giving it an externally-reachable hostname such as www.example.com. A defined route and the endpoints identified by its service can be consumed by a router to provide named connectivity from external clients to your applications. Each route consists of a route name, service selector, and (optionally) security configuration. Refer to the Openshift documentation for more information.

Service	Security	Hostname
insecure-${APPLICATION_NAME}-rhpamcentrmon-http	none	${BUSINESS_CENTRAL_HOSTNAME_HTTP}
${APPLICATION_NAME}-rhpamcentrmon-https	TLS passthrough	${BUSINESS_CENTRAL_HOSTNAME_HTTPS}
insecure-${APPLICATION_NAME}-kieserver-http	none	${KIE_SERVER_HOSTNAME_HTTP}
${APPLICATION_NAME}-kieserver-https	TLS passthrough	${KIE_SERVER_HOSTNAME_HTTPS}

Deployment Configurations

A deployment in OpenShift is a replication controller based on a user defined template called a deployment configuration. Deployments are created manually or in response to triggered events. Refer to the Openshift documentation for more information.

Triggers

A trigger drives the creation of new deployments in response to events, both inside and outside OpenShift. Refer to the Openshift documentation for more information.

Deployment	Triggers
${APPLICATION_NAME}-rhpamcentrmon	ImageChange
${APPLICATION_NAME}-kieserver	ImageChange
${APPLICATION_NAME}-postgresql	ImageChange

Replicas

A replication controller ensures that a specified number of pod "replicas" are running at any one time. If there are too many, the replication controller kills some pods. If there are too few, it starts more. Refer to the container-engine documentation for more information.

Deployment	Replicas
${APPLICATION_NAME}-rhpamcentrmon	3
${APPLICATION_NAME}-kieserver	3
${APPLICATION_NAME}-postgresql	1

Pod Template

Service Accounts

Service accounts are API objects that exist within each project. They can be created or deleted like any other API object. Refer to the Openshift documentation for more information.

Deployment	Service Account
${APPLICATION_NAME}-rhpamcentrmon	${APPLICATION_NAME}-rhpamsvc
${APPLICATION_NAME}-kieserver	${APPLICATION_NAME}-rhpamsvc

Image

Deployment	Image
${APPLICATION_NAME}-rhpamcentrmon	rhpam76-businesscentral-monitoring-openshift
${APPLICATION_NAME}-kieserver	${KIE_SERVER_IMAGE_STREAM_NAME}
${APPLICATION_NAME}-postgresql	postgresql

Readiness Probe

${APPLICATION_NAME}-rhpamcentrmon

Http Get on http://localhost:8080/rest/ready

${APPLICATION_NAME}-kieserver

Http Get on http://localhost:8080/services/rest/server/readycheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container

Liveness Probe

${APPLICATION_NAME}-rhpamcentrmon

Http Get on http://localhost:8080/rest/healthy

${APPLICATION_NAME}-kieserver

Http Get on http://localhost:8080/services/rest/server/healthcheck

${APPLICATION_NAME}-postgresql

/usr/libexec/check-container --live

Exposed Ports

Deployments	Name	Port	Protocol
${APPLICATION_NAME}-rhpamcentrmon	jolokia	8778	TCP
	http	8080	TCP
	https	8443	TCP
	ping	8888	TCP
${APPLICATION_NAME}-kieserver	jolokia	8778	TCP
	http	8080	TCP
	https	8443	TCP
	ping	8888	TCP
${APPLICATION_NAME}-postgresql	—	5432	TCP

Image Environment Variables

Deployment	Variable name	Description	Example value
${APPLICATION_NAME}-rhpamcentrmon	APPLICATION_USERS_PROPERTIES	—	/opt/kie/data/configuration/application-users.properties
	APPLICATION_ROLES_PROPERTIES	—	/opt/kie/data/configuration/application-roles.properties
	KIE_ADMIN_PWD	KIE administrator password.	${KIE_ADMIN_PWD}
	KIE_ADMIN_USER	KIE administrator username.	${KIE_ADMIN_USER}
	KIE_SERVER_PWD	KIE server password. (Sets the org.kie.server.pwd system property)	${KIE_SERVER_PWD}
	KIE_SERVER_USER	KIE server username. (Sets the org.kie.server.user system property)	${KIE_SERVER_USER}
	MAVEN_MIRROR_URL	Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.	${MAVEN_MIRROR_URL}
	MAVEN_REPO_ID	The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.	${MAVEN_REPO_ID}
	MAVEN_REPO_URL	Fully qualified URL to a Maven repository or service.	${MAVEN_REPO_URL}
	MAVEN_REPO_USERNAME	Username to access the Maven repository, if required.	${MAVEN_REPO_USERNAME}
	MAVEN_REPO_PASSWORD	Password to access the Maven repository, if required.	${MAVEN_REPO_PASSWORD}
	KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED	If set to true, turns on KIE server global discovery feature (Sets the org.kie.server.controller.openshift.global.discovery.enabled system property)	${KIE_SERVER_CONTROLLER_OPENSHIFT_GLOBAL_DISCOVERY_ENABLED}
	KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE	If OpenShift integration of Business Central is turned on, setting this parameter to true enables connection to KIE Server via an OpenShift internal Service endpoint. (Sets the org.kie.server.controller.openshift.prefer.kieserver.service system property)	${KIE_SERVER_CONTROLLER_OPENSHIFT_PREFER_KIESERVER_SERVICE}
	KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL	KIE ServerTemplate Cache TTL in milliseconds. (Sets the org.kie.server.controller.template.cache.ttl system property)	${KIE_SERVER_CONTROLLER_TEMPLATE_CACHE_TTL}
	KIE_WORKBENCH_CONTROLLER_OPENSHIFT_ENABLED	—	true
	KIE_SERVER_CONTROLLER_USER	KIE server controller username. (Sets the org.kie.server.controller.user system property)	${KIE_SERVER_CONTROLLER_USER}
	KIE_SERVER_CONTROLLER_PWD	KIE server controller password. (Sets the org.kie.server.controller.pwd system property)	${KIE_SERVER_CONTROLLER_PWD}
	KIE_SERVER_CONTROLLER_TOKEN	KIE server controller token for bearer authentication. (Sets the org.kie.server.controller.token system property)	${KIE_SERVER_CONTROLLER_TOKEN}
	HTTPS_KEYSTORE_DIR	—	/etc/businesscentral-secret-volume
	HTTPS_KEYSTORE	The name of the keystore file within the secret.	${BUSINESS_CENTRAL_HTTPS_KEYSTORE}
	HTTPS_NAME	The name associated with the server certificate.	${BUSINESS_CENTRAL_HTTPS_NAME}
	HTTPS_PASSWORD	The password for the keystore and certificate.	${BUSINESS_CENTRAL_HTTPS_PASSWORD}
	JGROUPS_PING_PROTOCOL	—	openshift.DNS_PING
	OPENSHIFT_DNS_PING_SERVICE_NAME	—	${APPLICATION_NAME}-rhpamcentrmon-ping
	OPENSHIFT_DNS_PING_SERVICE_PORT	—	8888
	SSO_URL	RH-SSO URL.	${SSO_URL}
	SSO_OPENIDCONNECT_DEPLOYMENTS	—	ROOT.war
	SSO_REALM	RH-SSO Realm name.	${SSO_REALM}
	SSO_SECRET	Business Central Monitoring RH-SSO Client Secret.	${BUSINESS_CENTRAL_SSO_SECRET}
	SSO_CLIENT	Business Central Monitoring RH-SSO Client name.	${BUSINESS_CENTRAL_SSO_CLIENT}
	SSO_USERNAME	RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.	${SSO_USERNAME}
	SSO_PASSWORD	RH-SSO Realm Admin Password used to create the Client.	${SSO_PASSWORD}
	SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	RH-SSO Disable SSL Certificate Validation.	${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}
	SSO_PRINCIPAL_ATTRIBUTE	RH-SSO Principal Attribute to use as username.	${SSO_PRINCIPAL_ATTRIBUTE}
	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-rhpamcentrmon-<project>.<default-domain-suffix>	${BUSINESS_CENTRAL_HOSTNAME_HTTP}
	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-rhpamcentrmon-<project>.<default-domain-suffix>	${BUSINESS_CENTRAL_HOSTNAME_HTTPS}
	AUTH_LDAP_URL	LDAP Endpoint to connect for authentication.	${AUTH_LDAP_URL}
	AUTH_LDAP_BIND_DN	Bind DN used for authentication.	${AUTH_LDAP_BIND_DN}
	AUTH_LDAP_BIND_CREDENTIAL	LDAP Credentials used for authentication.	${AUTH_LDAP_BIND_CREDENTIAL}
	AUTH_LDAP_JAAS_SECURITY_DOMAIN	The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.	${AUTH_LDAP_JAAS_SECURITY_DOMAIN}
	AUTH_LDAP_BASE_CTX_DN	LDAP Base DN of the top-level context to begin the user search.	${AUTH_LDAP_BASE_CTX_DN}
	AUTH_LDAP_BASE_FILTER	LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).	${AUTH_LDAP_BASE_FILTER}
	AUTH_LDAP_SEARCH_SCOPE	The search scope to use.	${AUTH_LDAP_SEARCH_SCOPE}
	AUTH_LDAP_SEARCH_TIME_LIMIT	The timeout in milliseconds for user or role searches.	${AUTH_LDAP_SEARCH_TIME_LIMIT}
	AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE	The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.	${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}
	AUTH_LDAP_PARSE_USERNAME	A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.	${AUTH_LDAP_PARSE_USERNAME}
	AUTH_LDAP_USERNAME_BEGIN_STRING	Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	${AUTH_LDAP_USERNAME_BEGIN_STRING}
	AUTH_LDAP_USERNAME_END_STRING	Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	${AUTH_LDAP_USERNAME_END_STRING}
	AUTH_LDAP_ROLE_ATTRIBUTE_ID	Name of the attribute containing the user roles.	${AUTH_LDAP_ROLE_ATTRIBUTE_ID}
	AUTH_LDAP_ROLES_CTX_DN	The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.	${AUTH_LDAP_ROLES_CTX_DN}
	AUTH_LDAP_ROLE_FILTER	A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).	${AUTH_LDAP_ROLE_FILTER}
	AUTH_LDAP_ROLE_RECURSION	The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.	${AUTH_LDAP_ROLE_RECURSION}
	AUTH_LDAP_DEFAULT_ROLE	A role included for all authenticated users	${AUTH_LDAP_DEFAULT_ROLE}
	AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID	Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.	${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}
	AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN	A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.	${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}
	AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN	Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.	${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}
	AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK	If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.	${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}
	AUTH_ROLE_MAPPER_ROLES_PROPERTIES	When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3	${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}
	AUTH_ROLE_MAPPER_REPLACE_ROLE	Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.	${AUTH_ROLE_MAPPER_REPLACE_ROLE}
${APPLICATION_NAME}-kieserver	WORKBENCH_SERVICE_NAME	—	${APPLICATION_NAME}-rhpamcentrmon
	KIE_ADMIN_USER	KIE administrator username.	${KIE_ADMIN_USER}
	KIE_ADMIN_PWD	KIE administrator password.	${KIE_ADMIN_PWD}
	KIE_SERVER_MODE	The KIE Server mode. Valid values are 'DEVELOPMENT' or 'PRODUCTION'. In production mode, you can not deploy SNAPSHOT versions of artifacts on the KIE server and can not change the version of an artifact in an existing container. (Sets the org.kie.server.mode system property).	${KIE_SERVER_MODE}
	KIE_MBEANS	KIE server mbeans enabled/disabled (Sets the kie.mbeans and kie.scanner.mbeans system properties)	${KIE_MBEANS}
	DROOLS_SERVER_FILTER_CLASSES	KIE server class filtering. (Sets the org.drools.server.filter.classes system property)	${DROOLS_SERVER_FILTER_CLASSES}
	PROMETHEUS_SERVER_EXT_DISABLED	If set to false, the prometheus server extension will be enabled. (Sets the org.kie.prometheus.server.ext.disabled system property)	${PROMETHEUS_SERVER_EXT_DISABLED}
	KIE_SERVER_BYPASS_AUTH_USER	Allows the KIE server to bypass the authenticated user for task related operations e.g. queries. (Sets the org.kie.server.bypass.auth.user system property)	${KIE_SERVER_BYPASS_AUTH_USER}
	KIE_SERVER_ID	—	—
	KIE_SERVER_ROUTE_NAME	—	${APPLICATION_NAME}-kieserver
	KIE_SERVER_STARTUP_STRATEGY	—	OpenShiftStartupStrategy
	KIE_SERVER_USER	KIE server username. (Sets the org.kie.server.user system property)	${KIE_SERVER_USER}
	KIE_SERVER_PWD	KIE server password. (Sets the org.kie.server.pwd system property)	${KIE_SERVER_PWD}
	MAVEN_MIRROR_URL	Maven mirror that the KIE server must use. If you configure a mirror, this mirror must contain all artifacts that are required for building and deploying your services.	${MAVEN_MIRROR_URL}
	MAVEN_MIRROR_OF	Maven mirror configuration for KIE server.	${MAVEN_MIRROR_OF}
	MAVEN_REPOS	—	RHPAMCENTR,EXTERNAL
	RHPAMCENTR_MAVEN_REPO_ID	—	repo-rhpamcentr
	RHPAMCENTR_MAVEN_REPO_SERVICE	The Service name for the optional Business Central, where it can be reached, to allow service lookups (for example, maven repo usage), if required.	${BUSINESS_CENTRAL_SERVICE}
	RHPAMCENTR_MAVEN_REPO_PATH	—	/maven2/
	RHPAMCENTR_MAVEN_REPO_USERNAME	Username to access the Maven service hosted by Business Central inside EAP.	${BUSINESS_CENTRAL_MAVEN_USERNAME}
	RHPAMCENTR_MAVEN_REPO_PASSWORD	Password to access the Maven service hosted by Business Central inside EAP.	${BUSINESS_CENTRAL_MAVEN_PASSWORD}
	EXTERNAL_MAVEN_REPO_ID	The id to use for the maven repository. If set, it can be excluded from the optionally configured mirror by adding it to MAVEN_MIRROR_OF. For example: external:*,!repo-rhpamcentr,!repo-custom. If MAVEN_MIRROR_URL is set but MAVEN_MIRROR_ID is not set, an id will be generated randomly, but won’t be usable in MAVEN_MIRROR_OF.	${MAVEN_REPO_ID}
	EXTERNAL_MAVEN_REPO_URL	Fully qualified URL to a Maven repository or service.	${MAVEN_REPO_URL}
	EXTERNAL_MAVEN_REPO_USERNAME	Username to access the Maven repository, if required.	${MAVEN_REPO_USERNAME}
	EXTERNAL_MAVEN_REPO_PASSWORD	Password to access the Maven repository, if required.	${MAVEN_REPO_PASSWORD}
	KIE_SERVER_PERSISTENCE_DS	KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)	${KIE_SERVER_PERSISTENCE_DS}
	DATASOURCES	—	RHPAM
	RHPAM_JNDI	KIE server persistence datasource. (Sets the org.kie.server.persistence.ds system property)	${KIE_SERVER_PERSISTENCE_DS}
	RHPAM_JTA	—	true
	RHPAM_DATABASE	KIE server PostgreSQL database name.	${KIE_SERVER_POSTGRESQL_DB}
	RHPAM_DRIVER	—	postgresql
	KIE_SERVER_PERSISTENCE_DIALECT	KIE server PostgreSQL Hibernate dialect.	${KIE_SERVER_POSTGRESQL_DIALECT}
	RHPAM_USERNAME	KIE server PostgreSQL database username.	${KIE_SERVER_POSTGRESQL_USER}
	RHPAM_PASSWORD	KIE server PostgreSQL database password.	${KIE_SERVER_POSTGRESQL_PWD}
	RHPAM_SERVICE_HOST	—	${APPLICATION_NAME}-postgresql
	RHPAM_SERVICE_PORT	—	5432
	TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL	Sets refresh-interval for the EJB timer service database-data-store.	${TIMER_SERVICE_DATA_STORE_REFRESH_INTERVAL}
	HTTPS_KEYSTORE_DIR	—	/etc/kieserver-secret-volume
	HTTPS_KEYSTORE	The name of the keystore file within the secret.	${KIE_SERVER_HTTPS_KEYSTORE}
	HTTPS_NAME	The name associated with the server certificate.	${KIE_SERVER_HTTPS_NAME}
	HTTPS_PASSWORD	The password for the keystore and certificate.	${KIE_SERVER_HTTPS_PASSWORD}
	JGROUPS_PING_PROTOCOL	—	openshift.DNS_PING
	OPENSHIFT_DNS_PING_SERVICE_NAME	—	${APPLICATION_NAME}-kieserver-ping
	OPENSHIFT_DNS_PING_SERVICE_PORT	—	8888
	SSO_URL	RH-SSO URL.	${SSO_URL}
	SSO_OPENIDCONNECT_DEPLOYMENTS	—	ROOT.war
	SSO_REALM	RH-SSO Realm name.	${SSO_REALM}
	SSO_SECRET	KIE Server RH-SSO Client Secret.	${KIE_SERVER_SSO_SECRET}
	SSO_CLIENT	KIE Server RH-SSO Client name.	${KIE_SERVER_SSO_CLIENT}
	SSO_USERNAME	RH-SSO Realm Admin Username used to create the Client if it doesn’t exist.	${SSO_USERNAME}
	SSO_PASSWORD	RH-SSO Realm Admin Password used to create the Client.	${SSO_PASSWORD}
	SSO_DISABLE_SSL_CERTIFICATE_VALIDATION	RH-SSO Disable SSL Certificate Validation.	${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}
	SSO_PRINCIPAL_ATTRIBUTE	RH-SSO Principal Attribute to use as username.	${SSO_PRINCIPAL_ATTRIBUTE}
	HOSTNAME_HTTP	Custom hostname for http service route. Leave blank for default hostname, e.g.: insecure-<application-name>-kieserver-<project>.<default-domain-suffix>	${KIE_SERVER_HOSTNAME_HTTP}
	HOSTNAME_HTTPS	Custom hostname for https service route. Leave blank for default hostname, e.g.: <application-name>-kieserver-<project>.<default-domain-suffix>	${KIE_SERVER_HOSTNAME_HTTPS}
	AUTH_LDAP_URL	LDAP Endpoint to connect for authentication.	${AUTH_LDAP_URL}
	AUTH_LDAP_BIND_DN	Bind DN used for authentication.	${AUTH_LDAP_BIND_DN}
	AUTH_LDAP_BIND_CREDENTIAL	LDAP Credentials used for authentication.	${AUTH_LDAP_BIND_CREDENTIAL}
	AUTH_LDAP_JAAS_SECURITY_DOMAIN	The JMX ObjectName of the JaasSecurityDomain used to decrypt the password.	${AUTH_LDAP_JAAS_SECURITY_DOMAIN}
	AUTH_LDAP_BASE_CTX_DN	LDAP Base DN of the top-level context to begin the user search.	${AUTH_LDAP_BASE_CTX_DN}
	AUTH_LDAP_BASE_FILTER	LDAP search filter used to locate the context of the user to authenticate. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. A common example for the search filter is (uid={0}).	${AUTH_LDAP_BASE_FILTER}
	AUTH_LDAP_SEARCH_SCOPE	The search scope to use.	${AUTH_LDAP_SEARCH_SCOPE}
	AUTH_LDAP_SEARCH_TIME_LIMIT	The timeout in milliseconds for user or role searches.	${AUTH_LDAP_SEARCH_TIME_LIMIT}
	AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE	The name of the attribute in the user entry that contains the DN of the user. This may be necessary if the DN of the user itself contains special characters, backslash for example, that prevent correct user mapping. If the attribute does not exist, the entry’s DN is used.	${AUTH_LDAP_DISTINGUISHED_NAME_ATTRIBUTE}
AUTH_LDAP_PARSE_USERNAME	A flag indicating if the DN is to be parsed for the username. If set to true, the DN is parsed for the username. If set to false the DN is not parsed for the username. This option is used together with usernameBeginString and usernameEndString.	${AUTH_LDAP_PARSE_USERNAME}
AUTH_LDAP_USERNAME_BEGIN_STRING	Defines the String which is to be removed from the start of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	${AUTH_LDAP_USERNAME_BEGIN_STRING}
AUTH_LDAP_USERNAME_END_STRING	Defines the String which is to be removed from the end of the DN to reveal the username. This option is used together with usernameEndString and only taken into account if parseUsername is set to true.	${AUTH_LDAP_USERNAME_END_STRING}
AUTH_LDAP_ROLE_ATTRIBUTE_ID	Name of the attribute containing the user roles.	${AUTH_LDAP_ROLE_ATTRIBUTE_ID}
AUTH_LDAP_ROLES_CTX_DN	The fixed DN of the context to search for user roles. This is not the DN where the actual roles are, but the DN where the objects containing the user roles are. For example, in a Microsoft Active Directory server, this is the DN where the user account is.	${AUTH_LDAP_ROLES_CTX_DN}
AUTH_LDAP_ROLE_FILTER	A search filter used to locate the roles associated with the authenticated user. The input username or userDN obtained from the login module callback is substituted into the filter anywhere a {0} expression is used. The authenticated userDN is substituted into the filter anywhere a {1} is used. An example search filter that matches on the input username is (member={0}). An alternative that matches on the authenticated userDN is (member={1}).	${AUTH_LDAP_ROLE_FILTER}
AUTH_LDAP_ROLE_RECURSION	The number of levels of recursion the role search will go below a matching context. Disable recursion by setting this to 0.	${AUTH_LDAP_ROLE_RECURSION}
AUTH_LDAP_DEFAULT_ROLE	A role included for all authenticated users	${AUTH_LDAP_DEFAULT_ROLE}
AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID	Name of the attribute within the roleCtxDN context which contains the role name. If the roleAttributeIsDN property is set to true, this property is used to find the role object’s name attribute.	${AUTH_LDAP_ROLE_NAME_ATTRIBUTE_ID}
AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN	A flag indicating if the DN returned by a query contains the roleNameAttributeID. If set to true, the DN is checked for the roleNameAttributeID. If set to false, the DN is not checked for the roleNameAttributeID. This flag can improve the performance of LDAP queries.	${AUTH_LDAP_PARSE_ROLE_NAME_FROM_DN}
AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN	Whether or not the roleAttributeID contains the fully-qualified DN of a role object. If false, the role name is taken from the value of the roleNameAttributeId attribute of the context name. Certain directory schemas, such as Microsoft Active Directory, require this attribute to be set to true.	${AUTH_LDAP_ROLE_ATTRIBUTE_IS_DN}
AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK	If you are not using referrals, you can ignore this option. When using referrals, this option denotes the attribute name which contains users defined for a certain role, for example member, if the role object is inside the referral. Users are checked against the content of this attribute name. If this option is not set, the check will always fail, so role objects cannot be stored in a referral tree.	${AUTH_LDAP_REFERRAL_USER_ATTRIBUTE_ID_TO_CHECK}
AUTH_ROLE_MAPPER_ROLES_PROPERTIES	When present, the RoleMapping Login Module will be configured to use the provided file. This parameter defines the fully-qualified file path and name of a properties file or resource which maps roles to replacement roles. The format is original_role=role1,role2,role3	${AUTH_ROLE_MAPPER_ROLES_PROPERTIES}
AUTH_ROLE_MAPPER_REPLACE_ROLE	Whether to add to the current roles, or replace the current roles with the mapped ones. Replaces if set to true.	${AUTH_ROLE_MAPPER_REPLACE_ROLE}
${APPLICATION_NAME}-postgresql	POSTGRESQL_USER	KIE server PostgreSQL database username.	${KIE_SERVER_POSTGRESQL_USER}
	POSTGRESQL_PASSWORD	KIE server PostgreSQL database password.	${KIE_SERVER_POSTGRESQL_PWD}
	POSTGRESQL_DATABASE	KIE server PostgreSQL database name.	${KIE_SERVER_POSTGRESQL_DB}
	POSTGRESQL_MAX_PREPARED_TRANSACTIONS	Allows the PostgreSQL to handle XA transactions.	${POSTGRESQL_MAX_PREPARED_TRANSACTIONS}

Volumes

Deployment	Name	mountPath	Purpose	readOnly
${APPLICATION_NAME}-rhpamcentrmon	businesscentral-keystore-volume	/etc/businesscentral-secret-volume	ssl certs	True
${APPLICATION_NAME}-kieserver	kieserver-keystore-volume	/etc/kieserver-secret-volume	ssl certs	True
${APPLICATION_NAME}-postgresql	${APPLICATION_NAME}-postgresql-pvol	/var/lib/pgsql/data	postgresql	false

External Dependencies

Volume Claims

A PersistentVolume object is a storage resource in an OpenShift cluster. Storage is provisioned by an administrator by creating PersistentVolume objects from sources such as GCE Persistent Disks, AWS Elastic Block Stores (EBS), and NFS mounts. Refer to the Openshift documentation for more information.

Name	Access Mode
${APPLICATION_NAME}-postgresql-claim	ReadWriteOnce
${APPLICATION_NAME}-rhpamcentr-claim	ReadWriteMany

Secrets

This template requires the following secrets to be installed for the application to run.

businesscentral-app-secret kieserver-app-secret