Chapter 8. Reference 8.1. Custom Resource configuration reference A Custom Resource Definition (CRD) is a schema of configuration items for a custom OpenShift object deployed with an Operator. By deploying a corresponding Custom Resource (CR) instance, you specify values for configuration items shown in the CRD. The following sub-sections detail the configuration items that you can set in Custom Resource instances based on the main broker CRD. 8.1.1. Broker Custom Resource configuration reference A CR instance based on the main broker CRD enables you to configure brokers for deployment in an OpenShift project. The following table describes the items that you can configure in the CR instance. Important Configuration items marked with an asterisk ( * ) are required in any corresponding Custom Resource (CR) that you deploy. If you do not explicitly specify a value for a non-required item, the configuration uses the default value. Entry Sub-entry Description and usage adminUser* Administrator user name required for connecting to the broker and management console. If you do not specify a value, the value is automatically generated and stored in a secret. The default secret name has a format of <custom_resource_name> -credentials-secret . For example, my-broker-deployment-credentials-secret . Type : string Example : my-user Default value : Automatically-generated, random value adminPassword* Administrator password required for connecting to the broker and management console. If you do not specify a value, the value is automatically generated and stored in a secret. The default secret name has a format of <custom_resource_name> -credentials-secret . For example, my-broker-deployment-credentials-secret . Type : string Example : my-password Default value : Automatically-generated, random value deploymentPlan* Broker deployment configuration image* Full path of the broker container image used for each broker in the deployment. You do not need to explicitly specify a value for image in your CR. The default value of placeholder indicates that the Operator has not yet determined the appropriate image to use. To learn how the Operator chooses a broker container image to use, see Section 2.4, "How the Operator chooses container images" . Type : string Example : registry.redhat.io/amq7/amq-broker-rhel8@sha256:71aef8faa1c661212ef8a7ef450656a250d95b51d33d1ce77f12ece27cdb9442 Default value : placeholder size* Number of broker Pods to create in the deployment. If you specify a value of 2 or greater, your broker deployment is clustered by default. The cluster user name and password are automatically generated and stored in the same secret as adminUser and adminPassword , by default. Type : int Example : 1 Default value : 2 requireLogin Specify whether login credentials are required to connect to the broker. Type : Boolean Example : false Default value : true persistenceEnabled Specify whether to use journal storage for each broker Pod in the deployment. If set to true , each broker Pod requires an available Persistent Volume (PV) that the Operator can claim using a Persistent Volume Claim (PVC). Type : Boolean Example : false Default value : true initImage Init Container image used to configure the broker. You do not need to explicitly specify a value for initImage in your CR, unless you want to provide a custom image. To learn how the Operator chooses a built-in Init Container image to use, see Section 2.4, "How the Operator chooses container images" . To learn how to specify a custom Init Container image, see Section 4.6, "Specifying a custom Init Container image" . Type : string Example : registry.redhat.io/amq7/amq-broker-init-rhel8@sha256:d327d358e6cfccac14becc486bce643e34970ecfc6c4d187a862425867a9ac8a Default value : Not specified journalType Specify whether to use asynchronous I/O (AIO) or non-blocking I/O (NIO). Type : string Example : aio Default value : nio messageMigration When a broker Pod shuts down due to a failure or intentional scaledown of the broker deployment, specify whether to migrate messages to another broker Pod that is still running in the broker cluster. Type : Boolean Example : false Default value : true resources.limits.cpu Maximum amount of host-node CPU, in millicores, that each broker container running in a Pod in a deployment can consume. Type : string Example : "500m" Default value : Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator. resources.limits.memory Maximum amount of host-node memory, in bytes, that each broker container running in a Pod in a deployment can consume. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi). Type : string Example : "1024M" Default value : Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator. resources.requests.cpu Amount of host-node CPU, in millicores, that each broker container running in a Pod in a deployment explicitly requests. Type : string Example : "250m" Default value : Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator. resources.requests.memory Amount of host-node memory, in bytes, that each broker container running in a Pod in a deployment explicitly requests. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi). Type : string Example : "512M" Default value : Uses the same default value that your version of OpenShift Container Platform uses. Consult a cluster administrator. storage.size Size, in bytes, of the Persistent Volume Claim (PVC) that each broker in a deployment requires for persistent storage. This property applies only when persistenceEnabled is set to true . The value that you specify must include a unit. Supports byte notation (for example, K, M, G), or the binary equivalents (Ki, Mi, Gi). Type : string Example : 4Gi Default value : 2Gi jolokiaAgentEnabled Specifies whether the Jolokia JVM Agent is enabled for the brokers in the deployment. If the value of this property is set to true , Fuse Console can discover and display runtime data for the brokers. Type : Boolean Example : true Default value : false managementRBACEnabled Specifies whether role-based access control (RBAC) is enabled for the brokers in the deployment. To use Fuse Console, you must set the value to false , because Fuse Console uses its own role-based access control. Type : Boolean Example : false Default value : true console Configuration of broker management console. expose Specify whether to expose the management console port for each broker in a deployment. Type : Boolean Example : true Default value : false sslEnabled Specify whether to use SSL on the management console port. Type : Boolean Example : true Default value : false sslSecret Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored. If you do not specify a value for sslSecret , the console uses a default secret name. The default secret name is in the form of <custom_resource_name> -console-secret . Type : string Example : my-broker-deployment-console-secret Default value : Not specified useClientAuth Specify whether the management console requires client authorization. Type : Boolean Example : true Default value : false acceptors.acceptor A single acceptor configuration instance. name* Name of acceptor. Type : string Example : my-acceptor Default value : Not applicable port Port number to use for the acceptor instance. Type : int Example : 5672 Default value : 61626 for the first acceptor that you define. The default value then increments by 10 for every subsequent acceptor that you define. protocols Messaging protocols to be enabled on the acceptor instance. Type : string Example : amqp,core Default value : all sslEnabled Specify whether SSL is enabled on the acceptor port. If set to true , look in the secret name specified in sslSecret for the credentials required by TLS/SSL. Type : Boolean Example : true Default value : false sslSecret Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored. If you do not specify a custom secret name for sslSecret , the acceptor assumes a default secret name. The default secret name has a format of <custom_resource_name> - <acceptor_name> -secret . You must always create this secret yourself, even when the acceptor assumes a default name. Type : string Example : my-broker-deployment-my-acceptor-secret Default value : <custom_resource_name> - <acceptor_name> -secret enabledCipherSuites Comma-separated list of cipher suites to use for TLS/SSL communication. Specify the most secure cipher suite(s) supported by your client application. If you use a comma-separated list to specify a set of cipher suites that is common to both the broker and the client, or you do not specify any cipher suites, the broker and client mutually negotiate a cipher suite to use. If you do not know which cipher suites to specify, it is recommended that you first establish a broker-client connection with your client running in debug mode, to verify the cipher suites that are common to both the broker and the client. Then, configure enabledCipherSuites on the broker. Type : string Default value : Not specified enabledProtocols Comma-separated list of protocols to use for TLS/SSL communication. Type : string Example : TLSv1,TLSv1.1,TLSv1.2 Default value : Not specified needClientAuth Specify whether the broker informs clients that two-way TLS is required on the acceptor. This property overrides wantClientAuth . Type : Boolean Example : true Default value : Not specified wantClientAuth Specify whether the broker informs clients that two-way TLS is requested on the acceptor, but not required. This property is overridden by needClientAuth . Type : Boolean Example : true Default value : Not specified verifyHost Specify whether to compare the Common Name (CN) of a client's certificate to its host name, to verify that they match. This option applies only when two-way TLS is used. Type : Boolean Example : true Default value : Not specified sslProvider Specify whether the SSL provider is JDK or OPENSSL. Type : string Example : OPENSSL Default value : JDK sniHost Regular expression to match against the server_name extension on incoming connections. If the names don't match, connection to the acceptor is rejected. Type : string Example : some_regular_expression Default value : Not specified expose Specify whether to expose the acceptor to clients outside OpenShift Container Platform. When you expose an acceptor to clients outside OpenShift, the Operator automatically creates a dedicated Service and Route for each broker Pod in the deployment. Type : Boolean Example : true Default value : false anycastPrefix Prefix used by a client to specify that the anycast routing type should be used. Type : string Example : jms.queue Default value : Not specified multicastPrefix Prefix used by a client to specify that the multicast routing type should be used. Type : string Example : /topic/ Default value : Not specified connectionsAllowed Number of connections allowed on the acceptor. When this limit is reached, a DEBUG message is issued to the log, and the connection is refused. The type of client in use determines what happens when the connection is refused. Type : integer Example : 2 Default value : 0 (unlimited connections) amqpMinLargeMessageSize Minimum message size, in bytes, required for the broker to handle an AMQP message as a large message. If the size of an AMQP message is equal or greater to this value, the broker stores the message in a large messages directory ( /opt/ <custom_resource_name> /data/large-messages , by default) on the persistent volume (PV) used by the broker for message storage. Setting the value to -1 disables large message handling for AMQP messages. Type : integer Example : 204800 Default value : 102400 (100 KB) connectors.connector A single connector configuration instance. name* Name of connector. Type : string Example : my-connector Default value : Not applicable type The type of connector to create; tcp or vm . Type : string Example : vm Default value : tcp host* Host name or IP address to connect to. Type : string Example : 192.168.0.58 Default value : Not specified port* Port number to be used for the connector instance. Type : int Example : 22222 Default value : Not specified sslEnabled Specify whether SSL is enabled on the connector port. If set to true , look in the secret name specified in sslSecret for the credentials required by TLS/SSL. Type : Boolean Example : true Default value : false sslSecret Secret where broker key store, trust store, and their corresponding passwords (all Base64-encoded) are stored. If you do not specify a custom secret name for sslSecret , the connector assumes a default secret name. The default secret name has a format of <custom_resource_name> - <connector_name> -secret . You must always create this secret yourself, even when the connector assumes a default name. Type : string Example : my-broker-deployment-my-connector-secret Default value : <custom_resource_name> - <connector_name> -secret enabledCipherSuites Comma-separated list of cipher suites to use for TLS/SSL communication. Type : string NOTE : For a connector, it is recommended that you do not specify a list of cipher suites. Default value : Not specified enabledProtocols Comma-separated list of protocols to use for TLS/SSL communication. Type : string Example : TLSv1,TLSv1.1,TLSv1.2 Default value : Not specified needClientAuth Specify whether the broker informs clients that two-way TLS is required on the connector. This property overrides wantClientAuth . Type : Boolean Example : true Default value : Not specified wantClientAuth Specify whether the broker informs clients that two-way TLS is requested on the connector, but not required. This property is overridden by needClientAuth . Type : Boolean Example : true Default value : Not specified verifyHost Specify whether to compare the Common Name (CN) of client's certificate to its host name, to verify that they match. This option applies only when two-way TLS is used. Type : Boolean Example : true Default value : Not specified sslProvider Specify whether the SSL provider is JDK or OPENSSL . Type : string Example : OPENSSL Default value : JDK sniHost Regular expression to match against the server_name extension on outgoing connections. If the names don't match, the connector connection is rejected. Type : string Example : some_regular_expression Default value : Not specified expose Specify whether to expose the connector to clients outside OpenShift Container Platform. Type : Boolean Example : true Default value : false addressSettings.applyRule Specifies how the Operator applies the configuration that you add to the CR for each matching address or set of addresses. The values that you can specify are: merge_all For address settings specified in both the CR and the default configuration that match the same address or set of addresses: Replace any property values specified in the default configuration with those specified in the CR. Keep any property values that are specified uniquely in the CR or the default configuration. Include each of these in the final, merged configuration. For address settings specified in either the CR or the default configuration that uniquely match a particular address or set of addresses, include these in the final, merged configuration. merge_replace For address settings specified in both the CR and the default configuration that match the same address or set of addresses, include the settings specified in the CR in the final, merged configuration. Do not include any properties specified in the default configuration, even if these are not specified in the CR. For address settings specified in either the CR or the default configuration that uniquely match a particular address or set of addresses, include these in the final, merged configuration. replace_all Replace all address settings specified in the default configuration with those specified in the CR. The final, megred configuration corresponds exactly to that specified in the CR. Type : string Example : replace_all Default value : merge_all addressSettings.addressSetting Address settings for a matching address or set of addresses. addressFullPolicy Specify what happens when an address configured with maxSizeBytes becomes full. The available policies are: PAGE Messages sent to a full address are paged to disk. DROP Messages sent to a full address are silently dropped. FAIL Messages sent to a full address are dropped and the message producers receive an exception. BLOCK Message producers will block when they try to send any further messages. The BLOCK policy works only for AMQP, OpenWire, and Core Protocol, because those protocols support flow control. Type : string Example : DROP Default value : PAGE autoCreateAddresses Specify whether the broker automatically creates an address when a client sends a message to, or attempts to consume a message from, a queue that is bound to an address that does not exist. Type : Boolean Example : false Default value : true autoCreateDeadLetterResources Specify whether the broker automatically creates a dead letter address and queue to receive undelivered messages. If the parameter is set to true , the broker automatically creates a dead letter address and an associated dead letter queue. The name of the automatically-created address matches the value that you specify for deadLetterAddress . Type : Boolean Example : true Default value : false autoCreateExpiryResources Specify whether the broker automatically creates an address and queue to receive expired messages. If the parameter is set to true , the broker automatically creates an expiry address and an associated expiry queue. The name of the automatically-created address matches the value that you specify for expiryAddress . Type : Boolean Example : true Default value : false autoCreateJmsQueues This property is deprecated. Use autoCreateQueues instead. autoCreateJmsTopics This property is deprecated. Use autoCreateQueues instead. autoCreateQueues Specify whether the broker automatically creates a queue when a client sends a message to, or attempts to consume a message from, a queue that does not yet exist. Type : Boolean Example : false Default value : true autoDeleteAddresses Specify whether the broker automatically deletes automatically-created addresses when the broker no longer has any queues. Type : Boolean Example : false Default value : true autoDeleteAddressDelay Time, in milliseconds, that the broker waits before automatically deleting an automatically-created address when the address has no queues. Type : integer Example : 100 Default value : 0 autoDeleteJmsQueues This property is deprecated. Use autoDeleteQueues instead. autoDeleteJmsTopics This property is deprecated. Use autoDeleteQueues instead. autoDeleteQueues Specify whether the broker automatically deletes an automatically-created queue when the queue has no consumers and no messages. Type : Boolean Example : false Default value : true autoDeleteCreatedQueues Specify whether the broker automatically deletes a manually-created queue when the queue has no consumers and no messages. Type : Boolean Example : true Default value : false autoDeleteQueuesDelay Time, in milliseconds, that the broker waits before automatically deleting an automatically-created queue when the queue has no consumers. Type : integer Example : 10 Default value : 0 autoDeleteQueuesMessageCount Maximum number of messages that can be in a queue before the broker evaluates whether the queue can be automatically deleted. Type : integer Example : 5 Default value : 0 configDeleteAddresses When the configuration file is reloaded, this parameter specifies how to handle an address (and its queues) that has been deleted from the configuration file. You can specify the following values: OFF The broker does not delete the address when the configuration file is reloaded. FORCE The broker deletes the address and its queues when the configuration file is reloaded. If there are any messages in the queues, they are removed also. Type : string Example : FORCE Default value : OFF configDeleteQueues When the configuration file is reloaded, this setting specifies how the broker handles queues that have been deleted from the configuration file. You can specify the following values: OFF The broker does not delete the queue when the configuration file is reloaded. FORCE The broker deletes the queue when the configuration file is reloaded. If there are any messages in the queue, they are removed also. Type : string Example : FORCE Default value : OFF deadLetterAddress The address to which the broker sends dead (that is, undelivered ) messages. Type : string Example : DLA Default value : None deadLetterQueuePrefix Prefix that the broker applies to the name of an automatically-created dead letter queue. Type : string Example : myDLQ. Default value : DLQ. deadLetterQueueSuffix Suffix that the broker applies to an automatically-created dead letter queue. Type : string Example : .DLQ Default value : None defaultAddressRoutingType Routing type used on automatically-created addresses. Type : string Example : ANYCAST Default value : MULTICAST defaultConsumersBeforeDispatch Number of consumers needed before message dispatch can begin for queues on an address. Type : integer Example : 5 Default value : 0 defaultConsumerWindowSize Default window size, in bytes, for a consumer. Type : integer Example : 300000 Default value : 1048576 (1024*1024) defaultDelayBeforeDispatch Default time, in milliseconds, that the broker waits before dispatching messages if the value specified for defaultConsumersBeforeDispatch has not been reached. Type : integer Example : 5 Default value : -1 (no delay) defaultExclusiveQueue Specifies whether all queues on an address are exclusive queues by default. Type : Boolean Example : true Default value : false defaultGroupBuckets Number of buckets to use for message grouping. Type : integer Example : 0 (message grouping disabled) Default value : -1 (no limit) defaultGroupFirstKey Key used to indicate to a consumer which message in a group is first. Type : string Example : firstMessageKey Default value : None defaultGroupRebalance Specifies whether to rebalance groups when a new consumer connects to the broker. Type : Boolean Example : true Default value : false defaultGroupRebalancePauseDispatch Specifies whether to pause message dispatch while the broker is rebalancing groups. Type : Boolean Example : true Default value : false defaultLastValueQueue Specifies whether all queues on an address are last value queues by default. Type : Boolean Example : true Default value : false defaultLastValueKey Default key to use for a last value queue. Type : string Example : stock_ticker Default value : None defaultMaxConsumers Maximum number of consumers allowed on a queue at any time. Type : integer Example : 100 Default value : -1 (no limit) defaultNonDestructive Specifies whether all queues on an address are non-destructive by default. Type : Boolean Example : true Default value : false defaultPurgeOnNoConsumers Specifies whether the broker purges the contents of a queue once there are no consumers. Type : Boolean Example : true Default value : false defaultQueueRoutingType Routing type used on automatically-created queues. The default value is MULTICAST . Type : string Example : ANYCAST Default value : MULTICAST defaultRingSize Default ring size for a matching queue that does not have a ring size explicitly set. Type : integer Example : 3 Default value : -1 (no size limit) enableMetrics Specifies whether a configured metrics plugin such as the Prometheus plugin collects metrics for a matching address or set of addresses. Type : Boolean Example : false Default value : true expiryAddress Address that receives expired messages. Type : string Example : myExpiryAddress Default value : None expiryDelay Expiration time, in milliseconds, applied to messages that are using the default expiration time. Type : integer Example : 100 Default value : -1 (no expiration time applied) expiryQueuePrefix Prefix that the broker applies to the name of an automatically-created expiry queue. Type : string Example : myExp. Default value : EXP. expiryQueueSuffix Suffix that the broker applies to the name of an automatically-created expiry queue. Type : string Example : .EXP Default value : None lastValueQueue Specify whether a queue uses only last values or not. Type : Boolean Example : true Default value : false managementBrowsePageSize Specify how many messages a management resource can browse. Type : integer Example : 100 Default value : 200 match * String that matches address settings to addresses configured on the broker. You can specify an exact address name or use a wildcard expression to match the address settings to a set of addresses. If you use a wildcard expression as a value for the match property, you must enclose the value in single quotation marks, for example, 'myAddresses*' . Type : string Example : 'myAddresses*' Default value : None maxDeliveryAttempts Specifies how many times the broker attempts to deliver a message before sending the message to the configured dead letter address. Type : integer Example : 20 Default value : 10 maxExpiryDelay Expiration time, in milliseconds, applied to messages that are using an expiration time greater than this value. Type : integer Example : 20 Default value : -1 (no maximum expiration time applied) maxRedeliveryDelay Maximum value, in milliseconds, between message redelivery attempts made by the broker. Type : integer Example : 100 Default value : The default value is ten times the value of redeliveryDelay , which has a default value of 0 . maxSizeBytes Maximum memory size, in bytes, for an address. Used when addressFullPolicy is set to PAGING , BLOCK , or FAIL . Also supports byte notation such as "K", "Mb", and "GB". Type : string Example : 10Mb Default value : -1 (no limit) maxSizeBytesRejectThreshold Maximum size, in bytes, that an address can reach before the broker begins to reject messages. Used when the address-full-policy is set to BLOCK . Works in combination with maxSizeBytes for the AMQP protocol only. Type : integer Example : 500 Default value : -1 (no maximum size) messageCounterHistoryDayLimit Number of days for which a broker keeps a message counter history for an address. Type : integer Example : 5 Default value : 0 minExpiryDelay Expiration time, in milliseconds, applied to messages that are using an expiration time lower than this value. Type : integer Example : 20 Default value : -1 (no minimum expiration time applied) pageMaxCacheSize Number of page files to keep in memory to optimize I/O during paging navigation. Type : integer Example : 10 Default value : 5 pageSizeBytes Paging size in bytes. Also supports byte notation such as K , Mb , and GB . Type : string Example : 20971520 Default value : 10485760 (approximately 10.5 MB) redeliveryDelay Time, in milliseconds, that the broker waits before redelivering a cancelled message. Type : integer Example : 100 Default value : 0 redeliveryDelayMultiplier Multiplying factor to apply to the value of redeliveryDelay . Type : number Example : 5 Default value : 1 redeliveryCollisionAvoidanceFactor Multiplying factor to apply to the value of redeliveryDelay to avoid collisions. Type : number Example : 1.1 Default value : 0 redistributionDelay Time, in milliseconds, that the broker waits after the last consumer is closed on a queue before redistributing any remaining messages. Type : integer Example : 100 Default value : -1 (not set) retroactiveMessageCount Number of messages to keep for future queues created on an address. Type : integer Example : 100 Default value : 0 sendToDlaOnNoRoute Specify whether a message will be sent to the configured dead letter address if it cannot be routed to any queues. Type : Boolean Example : true Default value : false slowConsumerCheckPeriod How often, in seconds , that the broker checks for slow consumers. Type : integer Example : 15 Default value : 5 slowConsumerPolicy Specifies what happens when a slow consumer is identified. Valid options are KILL or NOTIFY . KILL kills the consumer's connection, which impacts any client threads using that same connection. NOTIFY sends a CONSUMER_SLOW management notification to the client. Type : string Example : KILL Default value : NOTIFY slowConsumerThreshold Minimum rate of message consumption, in messages per second, before a consumer is considered slow. Type : integer Example : 100 Default value : -1 (not set) upgrades enabled When you update the value of version to specify a new target version of AMQ Broker, specify whether to allow the Operator to automatically update the deploymentPlan.image value to a broker container image that corresponds to that version of AMQ Broker. Type : Boolean Example : true Default value : false minor Specify whether to allow the Operator to automatically update the deploymentPlan.image value when you update the value of version from one minor version of AMQ Broker to another, for example, from 7.8.0 to 7.9.4 . Type : Boolean Example : true Default value : false version Specify a target minor version of AMQ Broker for which you want the Operator to automatically update the CR to use a corresponding broker container image. For example, if you change the value of version from 7.6.0 to 7.7.0 (and upgrades.enabled and upgrades.minor are both set to true ), then the Operator updates deploymentPlan.image to a broker image of the form registry.redhat.io/amq7/amq-broker-rhel8:7.8-x . Type : string Example : 7.7.0 Default value : Current version of AMQ Broker 8.1.2. Address Custom Resource configuration reference A CR instance based on the address CRD enables you to define addresses and queues for the brokers in your deployment. The following table details the items that you can configure. Important Configuration items marked with an asterisk ( * ) are required in any corresponding Custom Resource (CR) that you deploy. If you do not explicitly specify a value for a non-required item, the configuration uses the default value. Entry Description and usage addressName* Address name to be created on broker. Type : string Example : address0 Default value : Not specified queueName Queue name to be created on broker. If queueName is not specified, the CR creates only the address. Type : string Example : queue0 Default value : Not specified removeFromBrokerOnDelete* Specify whether the Operator removes existing addresses for all brokers in a deployment when you remove the address CR instance for that deployment. The default value is false , which means the Operator does not delete existing addresses when you remove the CR. Type : Boolean Example : true Default value : false routingType* Routing type to be used; anycast or multicast . Type : string Example : anycast Default value : multicast 8.1.3. Security Custom Resource configuration reference A CR instance based on the security CRD enables you to define the security configuration for the brokers in your deployment, including: users and roles login modules, including propertiesLoginModule , guestLoginModule and keycloakLoginModule role based access control console access control Note Many of the options require you understand the broker security concepts described in Securing brokers The following table details the items that you can configure. Important Configuration items marked with an asterisk ( * ) are required in any corresponding Custom Resource (CR) that you deploy. If you do not explicitly specify a value for a non-required item, the configuration uses the default value. Entry Sub-entry Description and usage loginModules One or more login module configurations. A login module can be one of the following types: propertiesLoginModule - allows you define broker users directly. guestLoginModule - for a user who does not have login credentials, or whose credentials fail authentication, you can grant limited access to the broker using a guest account. keycloakLoginModule . - allows you secure brokers using Red Hat Single Sign-On. propertiesLoginModule name* Name of login module. Type : string Example : my-login Default value : Not applicable users.name* Name of user. Type : string Example : jdoe Default value : Not applicable users.password* password of user. Type : string Example : password Default value : Not applicable users.roles Names of roles. Type : string Example : viewer Default value : Not applicable guestLoginModule name* Name of guest login module. Type : string Example : guest-login Default value : Not applicable guestUser Name of guest user. Type : string Example : myguest Default value : Not applicable guestRole Name of role for guest user. Type : string Example : guest Default value : Not applicable keycloakLoginModule name Name for KeycloakLoginModule Type : string Example : sso Default value : Not applicable moduleType Type of KeycloakLoginModule (directAccess or bearerToken) Type : string Example : bearerToken Default value : Not applicable configuration The following configuration items are related to Red Hat Single Sign-On and detailed information is available from the OpenID Connect documentation. configuration.realm* Realm for KeycloakLoginModule Type : string Example : myrealm Default value : Not applicable configuration.realmPublicKey Public key for the realm Type : string Default value : Not applicable configuration.authServerUrl* URL of the keycloak authentication server Type : string Default value : Not applicable configuration.sslRequired Specify whether SSL is required Type : string Valid values are 'all', 'external' and 'none'. configuration.resource* Resource Name The client-id of the application. Each application has a client-id that is used to identify the application. configuration.publicClient Specify whether it is public client. Type : Boolean Default value : false Example : false configuration.credentials.key Specify the credentials key. Type : string Default value : Not applicable Type : string Default value : Not applicable configuration.credentials.value Specify the credentials value Type : string Default value : Not applicable configuration.useResourceRoleMappings Specify whether to use resource role mappings Type : Boolean Example : false configuration.enableCors Specify whether to enable Cross-Origin Resource Sharing (CORS) It will handle CORS preflight requests. It will also look into the access token to determine valid origins. Type : Boolean Default value : false configuration.corsMaxAge CORS max age If CORS is enabled, this sets the value of the Access-Control-Max-Age header. configuration.corsAllowedMethods CORS allowed methods If CORS is enabled, this sets the value of the Access-Control-Allow-Methods header. This should be a comma-separated string. configuration.corsAllowedHeaders CORS allowed headers If CORS is enabled, this sets the value of the Access-Control-Allow-Headers header. This should be a comma-separated string. configuration.corsExposedHeaders CORS exposed headers If CORS is enabled, this sets the value of the Access-Control-Expose-Headers header. This should be a comma-separated string. configuration.exposeToken Specify whether to expose access token Type : Boolean Default value : false configuration.bearerOnly Specify whether to verify bearer token Type : Boolean Default value : false configuration.autoDetectBearerOnly Specify whether to only auto-detect bearer token Type : Boolean Default value : false configuration.connectionPoolSize Size of the connection pool Type : Integer Default value : 20 configuration.allowAnyHostName Specify whether to allow any host name Type : Boolean Default value : false configuration.disableTrustManager Specify whether to disable trust manager Type : Boolean Default value : false configuration.trustStore* Path of a trust store This is REQUIRED unless ssl-required is none or disable-trust-manager is true. configuration.trustStorePassword* Truststore password This is REQUIRED if truststore is set and the truststore requires a password. configuration.clientKeyStore Path of a client keystore Type : string Default value : Not applicable configuration.clientKeyStorePassword Client keystore password Type : string Default value : Not applicable configuration.clientKeyPassword Client key password Type : string Default value : Not applicable configuration.alwaysRefreshToken Specify whether to always refresh token Type : Boolean Example : false configuration.registerNodeAtStartup Specify whether to register node at startup Type : Boolean Example : false configuration.registerNodePeriod Period for re-registering node Type : string Default value : Not applicable configuration.tokenStore Type of token store (session or cookie) Type : string Default value : Not applicable configuration.tokenCookiePath Cookie path for a cookie store Type : string Default value : Not applicable configuration.principalAttribute OpenID Connect ID Token attribute to populate the UserPrincipal name with OpenID Connect ID Token attribute to populate the UserPrincipal name with. If token attribute is null, defaults to sub. Possible values are sub, preferred_username, email, name, nickname, given_name, family_name. configuration.proxyUrl The proxy URL configuration.turnOffChangeSessionIdOnLogin Specify whether to change session id on a successful login Type : Boolean Example : false configuration.tokenMinimumTimeToLive Minimum time to refresh an active access token Type : Integer Default value : 0 configuration.minTimeBetweenJwksRequests Minimum interval between two requests to Keycloak to retrieve new public keys Type : Integer Default value : 10 configuration.publicKeyCacheTtl Maximum interval between two requests to Keycloak to retrieve new public keys Type : Integer Default value : 86400 configuration.ignoreOauthQueryParameter Whether to turn off processing of the access_token query parameter for bearer token processing Type : Boolean Example : false configuration.verifyTokenAudience Verify whether the token contains this client name (resource) as an audience Type : Boolean Example : false configuration.enableBasicAuth Whether to support basic authentication Type : Boolean Default value : false configuration.confidentialPort The confidential port used by the Keycloak server for secure connections over SSL/TLS Type : Integer Example : 8443 configuration.redirectRewriteRules.key The regular expression used to match the Redirect URI. Type : string Default value : Not applicable configuration.redirectRewriteRules.value The replacement String Type : string Default value : Not applicable configuration.scope The OAuth2 scope parameter for DirectAccessGrantsLoginModule Type : string Default value : Not applicable securityDomains Broker security domains brokerDomain.name Broker domain name Type : string Example : activemq Default value : Not applicable brokerDomain.loginModules One or more login modules. Each entry must be previously defined in the loginModules section above. brokerDomain.loginModules.name Name of login module Type : string Example : prop-module Default value : Not applicable brokerDomain.loginModules.flag Same as propertiesLoginModule, required , requisite , sufficient and optional are valid values. Type : string Example : sufficient Default value : Not applicable brokerDomain.loginModules.debug Debug brokerDomain.loginModules.reload Reload consoleDomain.name Broker domain name Type : string Example : activemq Default value : Not applicable consoleDomain.loginModules A single login module configuration. consoleDomain.loginModules.name Name of login module Type : string Example : prop-module Default value : Not applicable consoleDomain.loginModules.flag Same as propertiesLoginModule, required , requisite , sufficient and optional are valid values. Type : string Example : sufficient Default value : Not applicable consoleDomain.loginModules.debug Debug Type : Boolean Example : false consoleDomain.loginModules.reload Reload Type : Boolean Example : true Default : false securitySettings Additional security settings to add to broker.xml or management.xml broker.match The address match pattern for a security setting section. See AMQ Broker wildcard syntax for details about the match pattern syntax. broker.permissions.operationType The operation type of a security setting, as described in Setting permissions . Type : string Example : createAddress Default value : Not applicable broker.permissions.roles The security settings are applied to these roles, as described in Setting permissions . Type : string Example : root Default value : Not applicable securitySettings.management Options to configure management.xml . hawtioRoles The roles allowed to log into the Broker console. Type : string Example : root Default value : Not applicable connector.host The connector host for connecting to the management API. Type : string Example : myhost Default value : localhost connector.port The connector port for connecting to the management API. Type : integer Example : 1099 Default value : 1099 connector.jmxRealm The JMX realm of the management API. Type : string Example : activemq Default value : activemq connector.objectName The JMX object name of the management API. Type : String Example : connector:name=rmi Default : connector:name=rmi connector.authenticatorType The management API authentication type. Type : String Example : password Default : password connector.secured Whether the management API connection is secured. Type : Boolean Example : true Default value : false connector.keyStoreProvider The keystore provider for the management connector. Required if you have set connector.secured="true". The default value is JKS. connector.keyStorePath Location of the keystore. Required if you have set connector.secured="true". connector.keyStorePassword The keystore password for the management connector. Required if you have set connector.secured="true". connector.trustStoreProvider The truststore provider for the management connector Required if you have set connector.secured="true". Type : String Example : JKS Default : JKS connector.trustStorePath Location of the truststore for the management connector. Required if you have set connector.secured="true". Type : string Default value : Not applicable connector.trustStorePassword The truststore password for the management connector. Required if you have set connector.secured="true". Type : string Default value : Not applicable connector.passwordCodec The password codec for management connector The fully qualified class name of the password codec to use as described in Encrypting a password in a configuration file . authorisation.allowedList.domain The domain of allowedList Type : string Default value : Not applicable authorisation.allowedList.key The key of allowedList Type : string Default value : Not applicable authorisation.defaultAccess.method The method of defaultAccess List Type : string Default value : Not applicable authorisation.defaultAccess.roles The roles of defaultAccess List Type : string Default value : Not applicable authorisation.roleAccess.domain The domain of roleAccess List Type : string Default value : Not applicable authorisation.roleAccess.key The key of roleAccess List Type : string Default value : Not applicable authorisation.roleAccess.accessList.method The method of roleAccess List Type : string Default value : Not applicable authorisation.roleAccess.accessList.roles The roles of roleAccess List Type : string Default value : Not applicable applyToCrNames Apply this security config to the brokers defined by the named CRs in the current namespace. A value of * or empty string means applying to all brokers. Type : string Example : my-broker Default value : All brokers defined by CRs in the current namespace. 8.2. Application template parameters Configuration of the AMQ Broker on OpenShift Container Platform image is performed by specifying values of application template parameters. You can configure the following parameters: Table 8.1. Application template parameters Parameter Description AMQ_ADDRESSES Specifies the addresses available by default on the broker on its startup, in a comma-separated list. AMQ_ANYCAST_PREFIX Specifies the anycast prefix applied to the multiplexed protocol ports 61616 and 61617. AMQ_CLUSTERED Enables clustering. AMQ_CLUSTER_PASSWORD Specifies the password to use for clustering. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. AMQ_CLUSTER_USER Specifies the cluster user to use for clustering. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. AMQ_CREDENTIAL_SECRET Specifies the secret in which sensitive credentials such as broker user name/password, cluster user name/password, and truststore and keystore passwords are stored. AMQ_DATA_DIR Specifies the directory for the data. Used in StatefulSets. AMQ_DATA_DIR_LOGGING Specifies the directory for the data directory logging. AMQ_EXTRA_ARGS Specifies additional arguments to pass to artemis create . GLOBAL_MAX_SIZE Specifies the maximum amount of memory that message data can consume. If no value is specified, half of the system's memory is allocated. AMQ_KEYSTORE Specifies the SSL keystore file name. If no value is specified, a random password is generated but SSL will not be configured. AMQ_KEYSTORE_PASSWORD (Optional) Specifies the password used to decrypt the SSL keystore. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. AMQ_KEYSTORE_TRUSTSTORE_DIR Specifies the directory where the secrets are mounted. The default value is /etc/amq-secret-volume . AMQ_MAX_CONNECTIONS For SSL only, specifies the maximum number of connections that an acceptor will accept. AMQ_MULTICAST_PREFIX Specifies the multicast prefix applied to the multiplexed protocol ports 61616 and 61617. AMQ_NAME Specifies the name of the broker instance. The default value is amq-broker . AMQ_PASSWORD Specifies the password used for authentication to the broker. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. AMQ_PROTOCOL Specifies the messaging protocols used by the broker in a comma-separated list. Available options are amqp , mqtt , openwire , stomp , and hornetq . If none are specified, all protocols are available. Note that for integration of the image with Red Hat JBoss Enterprise Application Platform, the OpenWire protocol must be specified, while other protocols can be optionally specified as well. AMQ_QUEUES Specifies the queues available by default on the broker on its startup, in a comma-separated list. AMQ_REQUIRE_LOGIN If set to true , login is required. If not specified, or set to false , anonymous access is permitted. By default, the value of this parameter is not specified. AMQ_ROLE Specifies the name for the role created. The default value is amq . AMQ_TRUSTSTORE Specifies the SSL truststore file name. If no value is specified, a random password is generated but SSL will not be configured. AMQ_TRUSTSTORE_PASSWORD (Optional) Specifies the password used to decrypt the SSL truststore. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. AMQ_USER Specifies the user name used for authentication to the broker. The AMQ Broker application templates use the value of this parameter stored in the secret named in AMQ_CREDENTIAL_SECRET. APPLICATION_NAME Specifies the name of the application used internally within OpenShift. It is used in names of services, pods, and other objects within the application. IMAGE Specifies the image. Used in the persistence , persistent-ssl , and statefulset-clustered templates. IMAGE_STREAM_NAMESPACE Specifies the image stream name space. Used in the ssl and basic templates. OPENSHIFT_DNS_PING_SERVICE_PORT Specifies the port number for the OpenShift DNS ping service. PING_SVC_NAME Specifies the name of the OpenShift DNS ping service. The default value is USDAPPLICATION_NAME-ping if you have specified a value for APPLICATION_NAME . Otherwise, the default value is ping . If you specify a custom value for PING_SVC_NAME , this value overrides the default value. If you want to use templates to deploy multiple broker clusters in the same OpenShift project namespace, you must ensure that PING_SVC_NAME has a unique value for each deployment. VOLUME_CAPACITY Specifies the size of the persistent storage for database volumes. Note If you use broker.xml for a custom configuration, any values specified in that file for the following parameters will override values specified for the same parameters in the your application templates. AMQ_NAME AMQ_ROLE AMQ_CLUSTER_USER AMQ_CLUSTER_PASSWORD 8.3. Logging In addition to viewing the OpenShift logs, you can troubleshoot a running AMQ Broker on OpenShift Container Platform image by viewing the AMQ logs that are output to the container's console. Procedure At the command line, run the following command: Revised on 2022-05-19 14:41:05 UTC

Commands:
oc logs -f <pass:quotes[<pod-name>]> <pass:quotes[<container-name>]>