domains

certType

Defines the type of cert. This field is required, and must be one of: usrcerts or sharedcerts.

• A cert with type usrcerts will be available only to this domain.
• A cert with type sharedcerts will be available to all domains.

Note: The best practice for sharedcerts is to define them in the default domain, but this is not required.

secret

Defines the name of the Kubernetes or OpenShift Secret containing the crypto files. This field is required. This secret can contain any number of certificates, and must exist in the same namespace as the DataPowerService.

subPath

Defines a relative subdirectory path to place the cert files into. This field is optional, and only allowed if certType is usrcerts. The provided path must be a relative path, and will be appended to the domain's cert:/// directory path. If not included or left empty, the cert will be placed at the root of the domain's cert:/// directory.

Example

domains:
- name: "example"
  certs:
  - certType: "usrcerts"
    secret: "example-tls"
    subPath: "service/tls"

If the Secret example-tls contains tls.key and tls.crt files, they would be placed into the example domain's cert:/// directory as follows:

cert:///service/tls/tls.key
cert:///service/tls/tls.crt

Without the subPath definition, they would be placed here:

cert:///tls.key
cert:///tls.crt

For more examples, see Adding certs to a domain.

config

config is optional. If provided, each entry in the array must be the name of a ConfigMap that exists in the same namespace as the DataPowerService.

Each ConfigMap in the config array must contain DataPower configuration file(s), i.e. .cfg files.

kubectl create configmap example-config --from-file=/path/to/example.cfg

domains:
- name: "example"
  dpApp:
    config:
    - "example-config"

kubectl create configmap example-config \
  --from-file=/path/to/example-config-pt1.cfg \
  --from-file=/path/to/example-config-pt2.cfg \
  --from-file=/path/to/example-config-pt3.cfg

kubectl create configmap example-config-pt1 --from-file=/path/to/example-pt1.cfg
kubectl create configmap example-config-pt2 --from-file=/path/to/example-pt2.cfg
kubectl create configmap example-config-pt3 --from-file=/path/to/example-pt3.cfg

spec:
  domains:
  - name: "example"
    dpApp:
      config:
      - "example-config-pt1"
      - "example-config-pt2"
      - "example-config-pt3"

local

local is optional. If provided, each entry in the array must be the name of a ConfigMap that exists in the same namespace as the DataPowerService.

Each ConfigMap in the local array must contain one or more compressed tarball (.tar.gz) files. The contents of each tarball will be extracted and placed into the local:/// directory of the domain.

kubectl create configmap example-local --from-file=/path/to/example-local.tar.gz

Note: If the same file/path exists in more than one ConfigMap or tarball for the same domain, the resulting file will be overwritten by the last ConfigMap or tarball to provide that file.

spec:
  domains:
  - name: "example"
    dpApp:
      config:
      - "example-config"
      local:
      - "example-local"

passphrase

passphrase controls the domain-settings passphrase, and supports both user-provided and generated values.

Within the passphrase object are two properties:

• secret - user-provided Secret name, which must contain the passphrase
• generate - boolean, if true will generate a value for the passphrase

These properties are mutually exclusive, meaning that only one may be provided.

oc create secret generic default-passphrase --from-literal=passphrase=datapower

spec:
  domains:
  - name: default
    settings:
      passphrase:
        secret: default-passphrase

spec:
  domains:
  - name: default
    settings:
      passphrase:
        generate: true

status:
  generated:
  - context:
      domain: default
      path: domains[0].settings.passphrase
    kind: Secret
    name: default-passphrase

alias

alias is the name to use when creating the password-alias object in the DataPower configuration. This will be the alias that is used elsewhere in the DataPower configuration.

secret

If provided, secret must be the name of a Secret in the same namespace. The Secret must contain a literal password, with the value containing the password to use in the password-alias.

For example, the following creates a Secret named example-password with password datapower:

oc create secret generic example-password --from-literal=password=datapower

The below snippet shows how this Secret could be added to the default domain's passwordMap:

spec:
  domains:
  - name: default
    passwordMap:
    - alias: example
      secret: example-password

generated

If generated is true, then a cryptographically secure password will be generated and stored in a Secret for use in the password-alias object.

spec:
  domains:
  - name: default
    passwordMap:
    - alias: example
      generated: true

If you need to obtain the generated password value, you can retrieve it from the Secret using oc extract. The DataPowerService status object contains a list of generated resources as a reference. For example, using the above snippet, the status would show something like:

status:
  generated:
  - context:
      alias: example
      domain: default
      path: domains[0].passwordMap[0]
    kind: Secret
    name: default-example

For more details on this status object, see status.

Reference

For more details on the domain-settings and password map configuration, see the following IBM Documentation:

• Domain Settings commands
• passphrase
• Creating password aliases in the password map
• password-map

Example

Creating a Secret named default-passphrase with passphrase datapower:

oc create secret generic default-passphrase --from-literal=passphrase=datapower

Specifying this in a domains spec would look like:

domains:
- name: "default"
  passphraseSecret: "default-passphrase"
  dpApp:
    config:
    - "default-config"
    local:
    - "default-local"