Install CIB seven EE on Kubernetes using Helm

The Helm chart cibseven-ee installs CIB seven Enterprise Edition on Kubernetes and OpenShift. It deploys one of two distributions of the Enterprise Edition Docker images:

• run4: CIB seven Run based on Spring Boot 4,
• wildfly: CIB seven on the WildFly application server.

Both contain the process engine, the REST API and the CIB seven webclient. This guide describes chart version 0.0.2, which deploys CIB seven 2.2.4-ee by default.

What the Chart Installs

A release of the chart consists of the following Kubernetes objects. Their names start with <release>-cibseven-ee, for example cibseven-cibseven-ee for the release cibseven. If the release name already contains cibseven-ee, the release name is used as it is.

The chart does not install a database, an ingress controller, certificates or the license key.

Prerequisites

• A Kubernetes or OpenShift cluster, kubectl (or oc) and Helm 3.
• Your credentials for artifacts.cibseven.org. They give access to the Helm repository and to the Enterprise Edition images.
• A database that the pods can reach. The chart defaults to PostgreSQL. Check the Supported Environments and the database section of the configuration guide.
• For access from outside the cluster: an ingress controller or the OpenShift router, and a TLS certificate. Open the webclient over HTTPS, otherwise licensed features show “License Required”, see HTTPS and Service Workers.
• Your CIB seven license key.

Access the Helm Repository and the Images

Add the Helm Repository

The chart is published in the Helm repository https://artifacts.cibseven.org/repository/helm-ee/. Add it with your credentials. The option --password-stdin reads the password from standard input, so it does not appear in the shell history or the process list:

printf '%s' "$CIBSEVEN_PASSWORD" | helm repo add cibseven-ee https://artifacts.cibseven.org/repository/helm-ee/ \
  --username "$CIBSEVEN_USER" --password-stdin
helm repo update
helm search repo cibseven-ee/cibseven-ee --versions

The chart package contains three example values files. Download and unpack it to use them as a starting point:

helm pull cibseven-ee/cibseven-ee --version 0.0.2 --untar
ls cibseven-ee/values-*.yaml

helm show values cibseven-ee/cibseven-ee --version 0.0.2 prints all values with their descriptions, helm show readme the chart README.

Create the Image Pull Secret

The images are published as artifacts.cibseven.org/docker-ee/cibseven:<distribution>-<version>-ee, for example run4-2.2.4-ee or wildfly-2.2.4-ee. Kubernetes needs your credentials to pull them. Create an image pull secret in the namespace of the release:

kubectl create namespace cibseven
kubectl create secret docker-registry cibseven-registry -n cibseven \
  --docker-server=artifacts.cibseven.org \
  --docker-username="$CIBSEVEN_USER" --docker-password="$CIBSEVEN_PASSWORD"

Reference the registry and the secret in your values:

image:
  repository: artifacts.cibseven.org/docker-ee
imagePullSecrets:
  - name: cibseven-registry

By default the image tag follows image.distribution and the CIB seven version of the chart (<distribution>-2.2.4-ee for chart 0.0.2). Set image.tag only to deploy another version, see Upgrade.

Quick Start

The following examples install CIB seven for a first evaluation, without an Ingress, and open it through a port forwarding. They assume:

• the namespace cibseven with the image pull secret cibseven-registry (see above),
• an empty PostgreSQL database cibseven at postgres.example.svc:5432 with the user cibseven; replace host, database, user and password with your own.

Both distributions need a JWT secret for the webclient: a base64 string of at least 155 characters. Generate one with:

openssl rand -base64 120 | tr -d '\n'

For a production setup, continue with Configure the Helm Chart and, for WildFly, Configure the WildFly Distribution.

Run4

Create my-values.yaml:

image:
  repository: artifacts.cibseven.org/docker-ee
  distribution: run4
imagePullSecrets:
  - name: cibseven-registry

global:
  authentication:
    # base64, at least 155 characters
    jwtSecret: "<generated JWT secret>"

application:
  camunda:
    bpm:
      admin-user:
        # letters and digits only
        id: cibsevenadmin
        # at least 10 characters with lower case, upper case, digit and special character
        password: "<admin password>"
        firstName: Admin
      database:
        # let the engine create the tables in the empty database
        schema-update: "true"
  spring:
    datasource:
      url: jdbc:postgresql://postgres.example.svc:5432/cibseven
      username: cibseven
      password: "<database password>"

Install the chart and wait until the pod is ready:

helm install cibseven cibseven-ee/cibseven-ee --version 0.0.2 -n cibseven -f my-values.yaml
kubectl -n cibseven rollout status deployment/cibseven-cibseven-ee --timeout=10m
kubectl -n cibseven port-forward svc/cibseven-cibseven-ee 8080:8080

Open http://localhost:8080/webapp/ and log in with the user from application.camunda.bpm.admin-user.

WildFly

Create my-values.yaml:

image:
  repository: artifacts.cibseven.org/docker-ee
  distribution: wildfly
imagePullSecrets:
  - name: cibseven-registry

global:
  authentication:
    # base64, at least 155 characters
    jwtSecret: "<generated JWT secret>"

# WildFly reads only the datasource from application.*
application:
  spring:
    datasource:
      url: jdbc:postgresql://postgres.example.svc:5432/cibseven
      username: cibseven
      password: "<database password>"

configmaps:
  env:
    # wait for the database before WildFly starts
    WAIT_FOR: postgres.example.svc:5432

# WildFly needs more memory and ephemeral storage than run4
resources:
  enabled: true
  limits:
    memory: 2Gi
    ephemeral-storage: 2Gi
  requests:
    cpu: 500m
    memory: 1Gi
    ephemeral-storage: 1Gi

Install the chart in the same way as for run4. WildFly takes about half a minute to start, longer with small CPU requests. The engine creates the tables in the empty database on the first start.

The WildFly distribution starts without any user. Create the first administrator once through the port forwarding:

kubectl -n cibseven port-forward svc/cibseven-cibseven-ee 8080:8080

Open http://localhost:8080/camunda/app/admin/default/setup/ and create the user. The password policy is active, so the password needs at least 10 characters with lower case, upper case, digit and special character. Then log in at http://localhost:8080/webapp/.

For an evaluation without a database, set wildfly.datasource.fromApplication: false. The image then uses its built-in H2 database. The chart does not mount a persistent volume, so the data does not survive a new pod. Do not use this in production.

Check the Installation

# pods and their state
kubectl -n cibseven get pods
# notes of the release, including warnings about the configuration
helm -n cibseven status cibseven
# WildFly: what the chart applied at startup
kubectl -n cibseven logs deployment/cibseven-cibseven-ee | grep 'cibseven-ee chart:'

Then enter your license key in the webclient, see License Key.

Choose the Distribution

Select the distribution with image.distribution. The chart supports run4 and wildfly.

Next Steps

The following pages describe the configuration and the operation of the chart in detail: