<commit_before>[id='secrets-{secrettarget}-create-proc_{context}']
:conditional!:
ifeval::["{secrettarget}"=="kie"]
:secrettarget_verbose: {KIE_SERVER}
:appsecret_name: kieserver-app-secret
endif::[]

ifeval::["{secrettarget}"=="central"]
:secrettarget_verbose: {CENTRAL}
:appsecret_name: {CENTRAL_ONEWORD}-app-secret
ifdef::PAM[]
:conditional: {CENTRAL} or {CENTRAL} Monitoring
endif::PAM[]
ifdef::DM[]
:conditional: {CENTRAL}
endif::DM[]
endif::[]

ifeval::["{secrettarget}"=="smartrouter"]
:secrettarget_verbose: Smart Router
:appsecret_name: smartrouter-app-secret
:conditional: Smart Router
endif::[]

ifeval::["{secrettarget}"=="employeerostering"]
:secrettarget_verbose: the Employee Rostering application
:appsecret_name: optaweb-employee-rostering-app-secret
endif::[]
ifeval::["{secrettarget}"=="amq"]
:secrettarget_verbose: the AMQ broker connection
:appsecret_name: broker-app-secret
endif::[]

:CAN_AUTOCREATE!:
:OPENSHIFT4!:
ifeval::["{context}"=="openshift-operator"]
:CAN_AUTOCREATE:
:OPENSHIFT4:
endif::[]
ifeval::["{secrettarget}"=="amq"]
:CAN_AUTOCREATE!:
endif::[]

= Creating the secrets for {secrettarget_verbose}

ifeval::["{secrettarget}"=="kie"]
OpenShift uses objects called _secrets_ to hold sensitive information such as passwords or keystores. For more information about OpenShift secrets, see
ifdef::OPENSHIFT4[]
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/builds/creating-build-inputs#builds-secrets-overview_creating-build-inputs[What is a secret]
endif::OPENSHIFT4[]
ifndef::OPENSHIFT4[]
the https://access.redhat.com/documentation/en-us/openshift_container_platform/3.11/html/developer_guide/dev-guide-secrets[Secrets chapter]
endif::OPENSHIFT4[]
in the {OPENSHIFT} documentation.
endif::[]

ifeval::["{secrettarget}"=="amq"]
If you want to connect any {KIE_SERVER} to an AMQ broker and to use SSL for the AMQ broker connection, you must create an SSL certificate for the connection and provide it to your OpenShift environment as a secret.
endif::[]
ifeval::["{secrettarget}"!="amq"]
ifndef::CAN_AUTOCREATE[]
ifdef::conditional[]
If your environment includes {conditional}, you
endif::conditional[]
ifndef::conditional[]
You
endif::conditional[]
must create an SSL certificate for HTTP access to {secrettarget_verbose} and provide it to your OpenShift environment as a secret.
endif::CAN_AUTOCREATE[]
ifdef::CAN_AUTOCREATE[]
In order to provide HTTPS access, {secrettarget_verbose} uses an SSL certificate. The deployment can create a sample secret automatically. However, in production environments you must create an SSL certificate for {secrettarget_verbose} and provide it to your OpenShift environment as a secret.
endif::CAN_AUTOCREATE[]

ifeval::["{secrettarget}"=="central"]
Do not use the same certificate and keystore for {CENTRAL} and {KIE_SERVER}.
endif::[]
ifeval::["{secrettarget}"=="smartrouter"]
Do not use the same certificate and keystore for Smart Router as the ones used for {KIE_SERVER} or {CENTRAL}.
endif::[]
endif::[]


.Procedure
. Generate an SSL keystore with a private and public key for SSL encryption for {secrettarget_verbose}. For more information on how to create a keystore with self-signed or purchased SSL certificates, see https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.1/html-single/Security_Guide/index.html#Generate_a_SSL_Encryption_Key_and_Certificate[Generate a SSL Encryption Key and Certificate].
+
[NOTE]
====
In a production environment, generate a valid signed certificate that matches the expected URL for {secrettarget_verbose}.
====
+
. Save the keystore in a file named `keystore.jks`.
. Record the name of the certificate. The default value for this name in {PRODUCT} configuration is `jboss`.
. Record the password of the keystore file. The default value for this name in {PRODUCT} configuration is `mykeystorepass`.
. Use the `oc` command to generate a secret named `{appsecret_name}` from the new keystore file:
+
[subs="attributes,verbatim,macros"]
----<commit_msg>BXMSDOC-7447 Combine steps and reworded based on reader comment (#191) (#3590)<commit_after>[id='secrets-{secrettarget}-create-proc_{context}']
:conditional!:
ifeval::["{secrettarget}"=="kie"]
:secrettarget_verbose: {KIE_SERVER}
:appsecret_name: kieserver-app-secret
endif::[]

ifeval::["{secrettarget}"=="central"]
:secrettarget_verbose: {CENTRAL}
:appsecret_name: {CENTRAL_ONEWORD}-app-secret
ifdef::PAM[]
:conditional: {CENTRAL} or {CENTRAL} Monitoring
endif::PAM[]
ifdef::DM[]
:conditional: {CENTRAL}
endif::DM[]
endif::[]

ifeval::["{secrettarget}"=="smartrouter"]
:secrettarget_verbose: Smart Router
:appsecret_name: smartrouter-app-secret
:conditional: Smart Router
endif::[]

ifeval::["{secrettarget}"=="employeerostering"]
:secrettarget_verbose: the Employee Rostering application
:appsecret_name: optaweb-employee-rostering-app-secret
endif::[]
ifeval::["{secrettarget}"=="amq"]
:secrettarget_verbose: the AMQ broker connection
:appsecret_name: broker-app-secret
endif::[]

:CAN_AUTOCREATE!:
:OPENSHIFT4!:
ifeval::["{context}"=="openshift-operator"]
:CAN_AUTOCREATE:
:OPENSHIFT4:
endif::[]
ifeval::["{secrettarget}"=="amq"]
:CAN_AUTOCREATE!:
endif::[]

= Creating the secrets for {secrettarget_verbose}

ifeval::["{secrettarget}"=="kie"]
OpenShift uses objects called _secrets_ to hold sensitive information such as passwords or keystores. For more information about OpenShift secrets, see
ifdef::OPENSHIFT4[]
https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/builds/creating-build-inputs#builds-secrets-overview_creating-build-inputs[What is a secret]
endif::OPENSHIFT4[]
ifndef::OPENSHIFT4[]
the https://access.redhat.com/documentation/en-us/openshift_container_platform/3.11/html/developer_guide/dev-guide-secrets[Secrets chapter]
endif::OPENSHIFT4[]
in the {OPENSHIFT} documentation.
endif::[]

ifeval::["{secrettarget}"=="amq"]
If you want to connect any {KIE_SERVER} to an AMQ broker and to use SSL for the AMQ broker connection, you must create an SSL certificate for the connection and provide it to your OpenShift environment as a secret.
endif::[]
ifeval::["{secrettarget}"!="amq"]
ifndef::CAN_AUTOCREATE[]
ifdef::conditional[]
If your environment includes {conditional}, you
endif::conditional[]
ifndef::conditional[]
You
endif::conditional[]
must create an SSL certificate for HTTP access to {secrettarget_verbose} and provide it to your OpenShift environment as a secret.
endif::CAN_AUTOCREATE[]
ifdef::CAN_AUTOCREATE[]
In order to provide HTTPS access, {secrettarget_verbose} uses an SSL certificate. The deployment can create a sample secret automatically. However, in production environments you must create an SSL certificate for {secrettarget_verbose} and provide it to your OpenShift environment as a secret.
endif::CAN_AUTOCREATE[]

ifeval::["{secrettarget}"=="central"]
Do not use the same certificate and keystore for {CENTRAL} and {KIE_SERVER}.
endif::[]
ifeval::["{secrettarget}"=="smartrouter"]
Do not use the same certificate and keystore for Smart Router as the ones used for {KIE_SERVER} or {CENTRAL}.
endif::[]
endif::[]


.Procedure
. Generate an SSL keystore named `keystore.jks` with a private and public key for SSL encryption for {KIE_SERVER}. For more information on how to create a keystore with self-signed or purchased SSL certificates, see https://access.redhat.com/documentation/en-US/JBoss_Enterprise_Application_Platform/6.1/html-single/Security_Guide/index.html#Generate_a_SSL_Encryption_Key_and_Certificate[Generate a SSL Encryption Key and Certificate].
+
[NOTE]
====
In a production environment, generate a valid signed certificate that matches the expected URL for {secrettarget_verbose}.
====
+
. Record the name of the certificate. The default value for this name in {PRODUCT} configuration is `jboss`.
. Record the password of the keystore file. The default value for this name in {PRODUCT} configuration is `mykeystorepass`.
. Use the `oc` command to generate a secret named `{appsecret_name}` from the new keystore file:
+
[subs="attributes,verbatim,macros"]
----
{'fraction_non_alphanumeric': 0.12367185569557697, 'fraction_numerical': 0.004571287373362985, 'mean_word_length': 7.251783893985729, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5565617', 'n_tokens_mistral': 2606, 'n_tokens_neox': 2493, 'n_words': 752}