okd/roles/openshift_examples/files/examples/v1.2/xpaas-templates/eap70-sso-s2i.json

{
    "kind": "Template",
    "apiVersion": "v1",
    "metadata": {
        "annotations": {
            "iconClass" : "icon-jboss",
            "description": "Application template for EAP 6 applications built using S2I, enabled for SSO.",
            "tags": "eap,javaee,java,jboss,xpaas,sso,keycloak",
            "version": "1.3.2"
        },
        "name": "eap70-sso-s2i"
    },
    "labels": {
        "template": "eap70-sso-s2i",
        "xpaas": "1.3.2"
    },
    "parameters": [
        {
            "description": "The name for the application.",
            "name": "APPLICATION_NAME",
            "value": "eap-app",
            "required": true
        },
        {
            "description": "Hostname for http service route (e.g. eap-app-myproject.example.com).  Required for SSO-enabled applications.  This is added to the white list of redirects in the SSO server.",
            "name": "HOSTNAME_HTTP",
            "value": "",
            "required": true
        },
        {
            "description": "Hostname for https service route (e.g. secure-eap-app-myproject.example.com).  Required for SSO-enabled applications.  This is added to the white list of redirects in the SSO server.",
            "name": "HOSTNAME_HTTPS",
            "value": "",
            "required": true
        },
        {
            "description": "Git source URI for application",
            "name": "SOURCE_REPOSITORY_URL",
            "value": "https://github.com/redhat-developer/redhat-sso-quickstarts",
            "required": true
        },
        {
            "description": "Git branch/tag reference",
            "name": "SOURCE_REPOSITORY_REF",
            "value": "7.0.x-ose",
            "required": false
        },
        {
            "description": "Path within Git project to build; empty for root project directory.",
            "name": "CONTEXT_DIR",
            "value": "",
            "required": false
        },
        {
            "description": "Queue names",
            "name": "HORNETQ_QUEUES",
            "value": "",
            "required": false
        },
        {
            "description": "Topic names",
            "name": "HORNETQ_TOPICS",
            "value": "",
            "required": false
        },
        {
            "description": "The name of the service account to use for the deployment.  The service account should be configured to allow useage of the secret(s) specified by HTTPS_SECRET and JGROUPS_ENCRYPT_SECRET.",
            "name": "SERVICE_ACCOUNT_NAME",
            "value": "eap7-service-account",
            "required": true
        },
        {
            "description": "The name of the secret containing the keystore file",
            "name": "HTTPS_SECRET",
            "value": "eap7-app-secret",
            "required": true
        },
        {
            "description": "The name of the keystore file within the secret",
            "name": "HTTPS_KEYSTORE",
            "value": "keystore.jks",
            "required": false
        },
        {
            "description": "The type of the keystore file (JKS or JCEKS)",
            "name": "HTTPS_KEYSTORE_TYPE",
            "value": "",
            "required": false
        },
        {
            "description": "The name associated with the server certificate (e.g. jboss)",
            "name": "HTTPS_NAME",
            "value": "",
            "required": false
        },
        {
            "description": "The password for the keystore and certificate (e.g. mykeystorepass)",
            "name": "HTTPS_PASSWORD",
            "value": "",
            "required": false
        },
        {
            "description": "HornetQ cluster admin password",
            "name": "HORNETQ_CLUSTER_PASSWORD",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "description": "GitHub trigger secret",
            "name": "GITHUB_WEBHOOK_SECRET",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "description": "Generic build trigger secret",
            "name": "GENERIC_WEBHOOK_SECRET",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "description": "Namespace in which the ImageStreams for Red Hat Middleware images are installed. These ImageStreams are normally installed in the openshift namespace. You should only need to modify this if you've installed the ImageStreams in a different namespace/project.",
            "name": "IMAGE_STREAM_NAMESPACE",
            "value": "openshift",
            "required": true
        },
        {
            "description": "The name of the secret containing the keystore file",
            "name": "JGROUPS_ENCRYPT_SECRET",
            "value": "eap7-app-secret",
            "required": false
        },
        {
            "description": "The name of the keystore file within the secret",
            "name": "JGROUPS_ENCRYPT_KEYSTORE",
            "value": "jgroups.jceks",
            "required": false
        },
        {
            "description": "The name associated with the server certificate (e.g. secret-key)",
            "name": "JGROUPS_ENCRYPT_NAME",
            "value": "",
            "required": false
        },
        {
            "description": "The password for the keystore and certificate (e.g. password)",
            "name": "JGROUPS_ENCRYPT_PASSWORD",
            "value": "",
            "required": false
        },
        {
            "description": "JGroups cluster password",
            "name": "JGROUPS_CLUSTER_PASSWORD",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "description": "Controls whether exploded deployment content should be automatically deployed",
            "name": "AUTO_DEPLOY_EXPLODED",
            "value": "false",
            "required": false
        },
        {
            "description": "The URL for the SSO server (e.g. https://secure-sso-myproject.example.com/auth).  This is the URL through which the user will be redirected when a login or token is required by the application.",
            "name": "SSO_URL",
            "value": "",
            "required": true
        },
        {
            "description": "The URL for the interal SSO service, where secure-sso (the default) is the kubernetes service exposed by the SSO server.  This is used to create the application client(s) (see SSO_USERNAME).  This can also be the same as SSO_URL.",
            "name": "SSO_SERVICE_URL",
            "value": "https://secure-sso:8443/auth",
            "required": false
        },
        {
            "description": "The SSO realm to which the application client(s) should be associated (e.g. demo).",
            "name": "SSO_REALM",
            "value": "",
            "required": true
        },
        {
            "description": "The username used to access the SSO service.  This is used to create the appliction client(s) within the specified SSO realm. This should match the SSO_SERVICE_USERNAME specified through one of the sso70-* templates.",
            "name": "SSO_USERNAME",
            "value": "",
            "required": false
        },
        {
            "description": "The password for the SSO service user.",
            "name": "SSO_PASSWORD",
            "value": "",
            "required": false
        },
        {
            "description": "SSO Public Key. Public key is recommended to be passed into the template to avoid man-in-the-middle security vulnerability",
            "name": "SSO_PUBLIC_KEY",
            "value": "",
            "required": false
        },
        {
            "description": "SSO Client Access Type",
            "name": "SSO_BEARER_ONLY",
            "value": "",
            "required": false
        },
        {
            "description": "List of directories from which archives will be copied into the deployment folder.  If unspecified, all archives in /target will be copied.",
            "name": "ARTIFACT_DIR",
            "value": "app-jee-jsp/target,service-jee-jaxrs/target,app-profile-jee-jsp/target,app-profile-saml-jee-jsp/target",
            "required": false
        },
        {
            "description": "The name of the secret containing the keystore file",
            "name": "SSO_SAML_KEYSTORE_SECRET",
            "value": "eap7-app-secret",
            "required": false
        },
        {
            "description": "The name of the keystore file within the secret",
            "name": "SSO_SAML_KEYSTORE",
            "value": "keystore.jks",
            "required": false
        },
        {
            "description": "The name associated with the server certificate",
            "name": "SSO_SAML_CERTIFICATE_NAME",
            "value": "jboss",
            "required": false
        },
        {
            "description": "The password for the keystore and certificate",
            "name": "SSO_SAML_KEYSTORE_PASSWORD",
            "value": "mykeystorepass",
            "required": false
        },
        {
            "description": "The SSO Client Secret for Confidential Access",
            "name": "SSO_SECRET",
            "from": "[a-zA-Z0-9]{8}",
            "generate": "expression",
            "required": true
        },
        {
            "description": "Enable CORS for SSO applications",
            "name": "SSO_ENABLE_CORS",
            "value": "false",
            "required": false
        },
        {
            "description": "SSO logout page for SAML applications",
            "name": "SSO_SAML_LOGOUT_PAGE",
            "value": "/",
            "required": false
        },
        {
            "description": "If true SSL communication between EAP and the SSO Server will be insecure (i.e. certificate validation is disabled with curl)",
            "name": "SSO_DISABLE_SSL_CERTIFICATE_VALIDATION",
            "value": "true",
            "required": false
        },
        {
            "description": "The name of the truststore file within the secret (e.g. truststore.jks)",
            "name": "SSO_TRUSTSTORE",
            "value": "",
            "required": false
        },
        {
            "description": "The password for the truststore and certificate (e.g. mykeystorepass)",
            "name": "SSO_TRUSTSTORE_PASSWORD",
            "value": "",
            "required": false
        },
        {
            "description": "The name of the secret containing the truststore file (e.g. truststore-secret). Used for volume secretName",
            "name": "SSO_TRUSTSTORE_SECRET",
            "value": "eap7-app-secret",
            "required": false
        }
   ],
    "objects": [
        {
            "kind": "Service",
            "apiVersion": "v1",
            "spec": {
                "ports": [
                    {
                        "port": 8080,
                        "targetPort": 8080
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                }
            },
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "The web server's http port."
                }
            }
        },
        {
            "kind": "Service",
            "apiVersion": "v1",
            "spec": {
                "ports": [
                    {
                        "port": 8443,
                        "targetPort": 8443
                    }
                ],
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                }
            },
            "metadata": {
                "name": "secure-${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "The web server's https port."
                }
            }
        },
        {
            "kind": "Route",
            "apiVersion": "v1",
            "id": "${APPLICATION_NAME}-http",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "Route for application's http service."
                }
            },
            "spec": {
                "host": "${HOSTNAME_HTTP}",
                "to": {
                    "name": "${APPLICATION_NAME}"
                }
            }
        },
        {
            "kind": "Route",
            "apiVersion": "v1",
            "id": "${APPLICATION_NAME}-https",
            "metadata": {
                "name": "secure-${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                },
                "annotations": {
                    "description": "Route for application's https service."
                }
            },
            "spec": {
                "host": "${HOSTNAME_HTTPS}",
                "to": {
                    "name": "secure-${APPLICATION_NAME}"
                },
                "tls": {
                    "termination": "passthrough"
                }
            }
        },
        {
            "kind": "ImageStream",
            "apiVersion": "v1",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                }
            }
        },
        {
            "kind": "BuildConfig",
            "apiVersion": "v1",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                }
            },
            "spec": {
                "source": {
                    "type": "Git",
                    "git": {
                        "uri": "${SOURCE_REPOSITORY_URL}",
                        "ref": "${SOURCE_REPOSITORY_REF}"
                    },
                    "contextDir": "${CONTEXT_DIR}"
                },
                "strategy": {
                    "type": "Source",
                    "sourceStrategy": {
                        "forcePull": true,
                        "from": {
                            "kind": "ImageStreamTag",
                            "namespace": "${IMAGE_STREAM_NAMESPACE}",
                            "name": "jboss-eap70-openshift:1.4"
                        },
                        "env": [
                            {
                                "name": "ARTIFACT_DIR",
                                "value": "${ARTIFACT_DIR}"
                            },
                            {
                                "name": "MAVEN_ARGS_APPEND",
                                "value": ""
                            }
                        ]
                    }
                },
                "output": {
                    "to": {
                        "kind": "ImageStreamTag",
                        "name": "${APPLICATION_NAME}:latest"
                    }
                },
                "triggers": [
                    {
                        "type": "GitHub",
                        "github": {
                            "secret": "${GITHUB_WEBHOOK_SECRET}"
                        }
                    },
                    {
                        "type": "Generic",
                        "generic": {
                            "secret": "${GENERIC_WEBHOOK_SECRET}"
                        }
                    },
                    {
                        "type": "ImageChange",
                        "imageChange": {}
                    },
                    {
                        "type": "ConfigChange"
                    }
                ]
            }
        },
        {
            "kind": "DeploymentConfig",
            "apiVersion": "v1",
            "metadata": {
                "name": "${APPLICATION_NAME}",
                "labels": {
                    "application": "${APPLICATION_NAME}"
                }
            },
            "spec": {
                "strategy": {
                    "type": "Recreate"
                },
                "triggers": [
                    {
                        "type": "ImageChange",
                        "imageChangeParams": {
                            "automatic": true,
                            "containerNames": [
                                "${APPLICATION_NAME}"
                            ],
                            "from": {
                                "kind": "ImageStreamTag",
                                "name": "${APPLICATION_NAME}:latest"
                            }
                        }
                    },
                    {
                        "type": "ConfigChange"
                    }
                ],
                "replicas": 1,
                "selector": {
                    "deploymentConfig": "${APPLICATION_NAME}"
                },
                "template": {
                    "metadata": {
                        "name": "${APPLICATION_NAME}",
                        "labels": {
                            "deploymentConfig": "${APPLICATION_NAME}",
                            "application": "${APPLICATION_NAME}"
                        }
                    },
                    "spec": {
                        "serviceAccountName": "${SERVICE_ACCOUNT_NAME}",
                        "terminationGracePeriodSeconds": 75,
                        "containers": [
                            {
                                "name": "${APPLICATION_NAME}",
                                "image": "${APPLICATION_NAME}",
                                "imagePullPolicy": "Always",
                                "volumeMounts": [
                                    {
                                        "name": "sso-saml-keystore-volume",
                                        "mountPath": "/etc/sso-saml-secret-volume",
                                        "readOnly": true
                                    },
                                    {
                                        "name": "eap-keystore-volume",
                                        "mountPath": "/etc/eap-secret-volume",
                                        "readOnly": true
                                    },
                                    {
                                        "name": "eap-jgroups-keystore-volume",
                                        "mountPath": "/etc/jgroups-encrypt-secret-volume",
                                        "readOnly": true
                                    },
                                    {
                                        "name": "sso-truststore-volume",
                                        "mountPath": "/etc/sso-secret-volume",
                                        "readOnly": true
                                    }
                                ],
                                "lifecycle": {
                                    "preStop": {
                                        "exec": {
                                            "command": [
                                                "/opt/eap/bin/jboss-cli.sh",
                                                "-c",
                                                ":shutdown(timeout=60)"
                                            ]
                                        }
                                    }
                                },
                                "livenessProbe": {
                                    "exec": {
                                        "command": [
                                            "/bin/bash",
                                            "-c",
                                            "/opt/eap/bin/livenessProbe.sh"
                                        ]
                                    }
                                },
                                "readinessProbe": {
                                    "exec": {
                                        "command": [
                                            "/bin/bash",
                                            "-c",
                                            "/opt/eap/bin/readinessProbe.sh"
                                        ]
                                    }
                                },
                                "ports": [
                                    {
                                        "name": "jolokia",
                                        "containerPort": 8778,
                                        "protocol": "TCP"
                                    },
                                    {
                                        "name": "http",
                                        "containerPort": 8080,
                                        "protocol": "TCP"
                                    },
                                    {
                                        "name": "https",
                                        "containerPort": 8443,
                                        "protocol": "TCP"
                                    },
                                    {
                                        "name": "ping",
                                        "containerPort": 8888,
                                        "protocol": "TCP"
                                    }
                                ],
                                "env": [
                                    {
                                        "name": "OPENSHIFT_KUBE_PING_LABELS",
                                        "value": "application=${APPLICATION_NAME}"
                                    },
                                    {
                                        "name": "OPENSHIFT_KUBE_PING_NAMESPACE",
                                        "valueFrom": {
                                            "fieldRef": {
                                                "fieldPath": "metadata.namespace"
                                            }
                                        }
                                    },
                                    {
                                        "name": "HOSTNAME_HTTP",
                                        "value": "${HOSTNAME_HTTP}"
                                    },
                                    {
                                        "name": "HOSTNAME_HTTPS",
                                        "value": "${HOSTNAME_HTTPS}"
                                    }, 
                                    {
                                        "name": "HTTPS_KEYSTORE_DIR",
                                        "value": "/etc/eap-secret-volume"
                                    },
                                    {
                                        "name": "HTTPS_KEYSTORE",
                                        "value": "${HTTPS_KEYSTORE}"
                                    },
                                    {
                                        "name": "HTTPS_KEYSTORE_TYPE",
                                        "value": "${HTTPS_KEYSTORE_TYPE}"
                                    },
                                    {
                                        "name": "HTTPS_NAME",
                                        "value": "${HTTPS_NAME}"
                                    },
                                    {
                                        "name": "HTTPS_PASSWORD",
                                        "value": "${HTTPS_PASSWORD}"
                                    },
                                    {
                                        "name": "HORNETQ_CLUSTER_PASSWORD",
                                        "value": "${HORNETQ_CLUSTER_PASSWORD}"
                                    },
                                    {
                                        "name": "HORNETQ_QUEUES",
                                        "value": "${HORNETQ_QUEUES}"
                                    },
                                    {
                                        "name": "HORNETQ_TOPICS",
                                        "value": "${HORNETQ_TOPICS}"
                                    },
				                    {
                                        "name": "JGROUPS_ENCRYPT_SECRET",
                                        "value": "${JGROUPS_ENCRYPT_SECRET}"
                                    },
                                    {
                                        "name": "JGROUPS_ENCRYPT_KEYSTORE_DIR",
                                        "value": "/etc/jgroups-encrypt-secret-volume"
                                    },
                                    {
                                        "name": "JGROUPS_ENCRYPT_KEYSTORE",
                                        "value": "${JGROUPS_ENCRYPT_KEYSTORE}"
                                    },
                                    {
                                        "name": "JGROUPS_ENCRYPT_NAME",
                                        "value": "${JGROUPS_ENCRYPT_NAME}"
                                    },
                                    {
                                        "name": "JGROUPS_ENCRYPT_PASSWORD",
                                        "value": "${JGROUPS_ENCRYPT_PASSWORD}"
                                    },
                                    {
                                        "name": "JGROUPS_CLUSTER_PASSWORD",
                                        "value": "${JGROUPS_CLUSTER_PASSWORD}"
                                    },
                                    {
                                        "name": "AUTO_DEPLOY_EXPLODED",
                                        "value": "${AUTO_DEPLOY_EXPLODED}"
                                    },
                                    {
                                        "name": "SSO_URL",
                                        "value": "${SSO_URL}"
                                    },
                                    {
                                        "name": "SSO_SERVICE_URL",
                                        "value": "${SSO_SERVICE_URL}"
                                    },
                                    {
                                        "name": "SSO_REALM",
                                        "value": "${SSO_REALM}"
                                    },
                                    {
                                        "name": "SSO_USERNAME",
                                        "value": "${SSO_USERNAME}"
                                    },
                                    {
                                        "name": "SSO_PASSWORD",
                                        "value": "${SSO_PASSWORD}"
                                    },
                                    {
                                        "name": "SSO_PUBLIC_KEY",
                                        "value": "${SSO_PUBLIC_KEY}"
                                    },
                                    {
                                        "name": "SSO_BEARER_ONLY",
                                        "value": "${SSO_BEARER_ONLY}"
                                    },
                                    {
                                        "name": "SSO_SAML_KEYSTORE_SECRET",
                                        "value": "${SSO_SAML_KEYSTORE_SECRET}"
                                    },
                                    {
                                        "name": "SSO_SAML_KEYSTORE",
                                        "value": "${SSO_SAML_KEYSTORE}"
                                    },
                                    {
                                        "name": "SSO_SAML_KEYSTORE_DIR",
                                        "value": "/etc/sso-saml-secret-volume"
                                    },
                                    {
                                        "name": "SSO_SAML_CERTIFICATE_NAME",
                                        "value": "${SSO_SAML_CERTIFICATE_NAME}"
                                    },
                                    {
                                        "name": "SSO_SAML_KEYSTORE_PASSWORD",
                                        "value": "${SSO_SAML_KEYSTORE_PASSWORD}"
                                    },
                                    {
                                        "name": "SSO_SECRET",
                                        "value": "${SSO_SECRET}"
                                    },
                                    {
                                        "name": "SSO_ENABLE_CORS",
                                        "value": "${SSO_ENABLE_CORS}"
                                    },
                                    {
                                        "name": "SSO_SAML_LOGOUT_PAGE",
                                        "value": "${SSO_SAML_LOGOUT_PAGE}"
                                    },
                                    {
                                        "name": "SSO_DISABLE_SSL_CERTIFICATE_VALIDATION",
                                        "value": "${SSO_DISABLE_SSL_CERTIFICATE_VALIDATION}"
                                    },
                                    {
                                        "name": "SSO_TRUSTSTORE",
                                        "value": "${SSO_TRUSTSTORE}"
                                    },
                                    {
                                        "name": "SSO_TRUSTSTORE_DIR",
                                        "value": "/etc/sso-secret-volume"
                                    },
                                    {
                                        "name": "SSO_TRUSTSTORE_PASSWORD",
                                        "value": "${SSO_TRUSTSTORE_PASSWORD}"
                                    }
                                ]
                            }
                        ],
                        "volumes": [
                            {
                                "name": "sso-saml-keystore-volume",
                                "secret": {
                                    "secretName": "${SSO_SAML_KEYSTORE_SECRET}"
                                }
                            },
                            {
                                "name": "eap-keystore-volume",
                                "secret": {
                                    "secretName": "${HTTPS_SECRET}"
                                }
                            },
                            {
                                "name": "eap-jgroups-keystore-volume",
                                "secret": {
                                    "secretName": "${JGROUPS_ENCRYPT_SECRET}"
                                }
                            },
                            {
                                "name": "sso-truststore-volume",
                                "secret": {
                                    "secretName": "${SSO_TRUSTSTORE_SECRET}"
                                }
                            }
                        ]
                    }
                }
            }
        }
    ]
}