[{"_1":2,"_165":-5,"_166":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_133":-5,"_134":11,"_135":17,"_136":11,"_137":-5,"_138":139},"canonicalUrl","https://hub.docker.com/r/tadayosi/hawtio-online/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","tadayosi","reponame","hawtio-online","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2020-09-01T01:05:22.963243Z","description","","is_private","last_updated","2022-10-12T19:29:31.287613Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",17435,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Hawtio Online\n\nAn Hawtio console that eases the discovery and management of _hawtio-enabled_ ^[1](#f1) applications deployed on OpenShift.\n\n

\n \n

\n\n## Table of Contents\n\n * [Deployment](#deployment)\n * [OpenShift 4](#openshift-4)\n * [Manual steps](#manual-steps)\n * [RBAC](#rbac)\n * [Configuration](#configuration)\n * [Roles](#roles)\n * [ACL](#acl)\n * [Authorization](#authorization)\n * [Development](#development)\n * [Tools](#tools)\n * [Build](#build)\n * [Install](#install)\n * [Cluster mode](#cluster-mode)\n * [Namespace mode](#namespace-mode)\n * [Run](#run)\n * [Cluster mode](#cluster-mode-1)\n * [Namespace mode](#namespace-mode-1)\n * [Disable Jolokia authentication for deployments (dev only)](#disable-jolokia-authentication-for-deployments-dev-only)\n\n## Deployment\n\nYou can run the following instructions to deploy the Hawtio Online console on your OpenShift cluster.\nYou may want to read how to [get started with the CLI](https://docs.openshift.com/container-platform/latest/cli_reference/openshift_cli/getting-started-cli.html) for more information about the `oc` client tool.\n\nThere exist different OpenShift templates to choose from, depending on the following characteristics:\n\n| Template | Descripton |\n| -------- | ---------- |\n| [deployment-cluster.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-cluster.yml) | Use an OAuth client that requires the `cluster-admin` role to be created. The Hawtio Online console can discover and connect to _hawtio-enabled_ ^[1](#f1) applications deployed across multiple namespaces / projects. |\n| [deployment-cluster-os4.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-cluster-os4.yml) | Same as `deployment-cluster.yml`, to be used for OpenShift 4. By default, this requires the generation of a client certificate, signed with the [service signing certificate][service-signing-certificate] authority, prior to the deployment. See the [OpenShift 4](#openshift-4) section for more information. |\n| [deployment-namespace.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-namespace.yml) | Use a service account as OAuth client, which only requires `admin` role in a project to be created. This restricts the Hawtio Online console access to this single project, and as such acts as a single tenant deployment. |\n| [deployment-namespace-os4.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-namespace-os4.yml) | Same as `deployment-namespace.yml`, to be used for OpenShift 4. By default, this requires the generation of a client certificate, signed with the [service signing certificate][service-signing-certificate] authority, prior to the deployment. See the [OpenShift 4](#openshift-4) section for more information. |\n| [deployment-namespace-rbac.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-namespace-rbac.yml) | Same as `deployment-namespace-os4.yml`, with configurable RBAC for Jolokia requests authorization. See the [RBAC](#rbac) section for more information. |\n| [deployment-cluster-rbac.yml](https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-cluster-rbac.yml) | Same as `deployment-cluster-os4.yml`, with configurable RBAC for Jolokia requests authorization. See the [RBAC](#rbac) section for more information. |\n\n[service-signing-certificate]: https://docs.openshift.com/container-platform/latest/security/certificates/service-serving-certificate.html\n\nTo deploy the Hawtio Online console, execute the following command:\n\n```sh\n$ oc new-app -f https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-namespace.yml \\\n -p ROUTE_HOSTNAME=\n```\n\nNote that the `ROUTE_HOSTNAME` parameter can be omitted when using the `deployment-namespace` template.\nIn that case, OpenShift automatically generates one for you.\n\nYou can obtain more information about the template parameters, by executing the following command:\n\n```sh\n$ oc process --parameters -f https://raw.githubusercontent.com/hawtio/hawtio-online/master/deployment-namespace.yml\nNAME DESCRIPTION GENERATOR VALUE\nROUTE_HOSTNAME The externally-reachable host name that routes to the Hawtio Online service\n```\n\nYou can obtain the status of your deployment, by running:\n\n```sh\n$ oc status\nIn project hawtio on server https://192.168.64.12:8443\n\nhttps://hawtio-online-hawtio.192.168.64.12.nip.io (redirects) (svc/hawtio-online)\n dc/hawtio-online deploys istag/hawtio-online:latest \n deployment #1 deployed 2 minutes ago - 1 pod\n```\n\nOpen the route URL displayed above from your Web browser to access the Hawtio Online console.\n\n## OpenShift 4\n\nTo secure the communication between Hawtio Online and the Jolokia agents, a client certificate must be generated and mounted into the Hawtio Online pod with a secret, to be used for TLS client authentication. This client certificate must be signed using the [service signing certificate][service-signing-certificate] authority private key.\n\nPrior to the deployment, run the following script to generate and set up a client certificate for Hawtio Online:\n\n```sh\n$ ./scripts/generate-certificate.sh\n```\n\nOr if you have Yarn intalled, this will also do the same thing:\n\n```sh\n$ yarn generate-certificate\n```\n\n### Manual steps\n\nInstead of running the script, you can choose to perform everything manually. Here are the steps to be performed:\n\n1. First, retrieve the service signing certificate authority keys, by executing the following commmands as a _cluster-admin_ user:\n ```sh\n # The CA certificate\n $ oc get secrets/signing-key -n openshift-service-ca -o \"jsonpath={.data['tls\\.crt']}\" | base64 --decode > ca.crt\n # The CA private key\n $ oc get secrets/signing-key -n openshift-service-ca -o \"jsonpath={.data['tls\\.key']}\" | base64 --decode > ca.key\n ```\n\n2. Then, generate the client certificate, as documented in [Kubernetes certificates administration](https://kubernetes.io/docs/concepts/cluster-administration/certificates/), using either `easyrsa`, `openssl`, or `cfssl`, e.g., using `openssl`:\n ```sh\n # Generate the private key\n $ openssl genrsa -out server.key 2048\n # Write the CSR config file\n $ cat <> csr.conf\n [ req ]\n default_bits = 2048\n prompt = no\n default_md = sha256\n distinguished_name = dn\n \n [ dn ]\n CN = hawtio-online.hawtio.svc\n \n [ v3_ext ]\n authorityKeyIdentifier=keyid,issuer:always\n keyUsage=keyEncipherment,dataEncipherment,digitalSignature\n extendedKeyUsage=serverAuth,clientAuth\n EOT\n # Generate the CSR\n $ openssl req -new -key server.key -out server.csr -config csr.conf\n # Issue the signed certificate\n $ openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000 -extensions v3_ext -extfile csr.conf\n ```\n\n3. Finally, you can create the secret to be mounted in Hawtio Online, from the generated certificate:\n ```sh\n $ oc create secret tls hawtio-online-tls-proxying --cert server.crt --key server.key\n ```\n\nNote that `CN=hawtio-online.hawtio.svc` must be trusted by the Jolokia agents, for which client certification authentication is enabled. See the `clientPrincipal` parameter from the [Jolokia agent configuration options](https://jolokia.org/reference/html/agents.html#agent-jvm-config).\n\nYou can then proceed with the [deployment](#deployment).\n\n## RBAC\n\n### Configuration\n\nThe `deployment-cluster-rbac.yml` and `deployment-namespace-rbac.yml` templates create a _ConfigMap_, that contains the configuration file used to define the roles allowed for MBean operations.\nThis _ConfigMap_ is mounted into the Hawtio Online container, and the `HAWTIO_ONLINE_RBAC_ACL` environment variable is used to pass the configuration file path to the server.\nIf that environment variable is not set, RBAC support is disabled, and only users granted the `update` verb on the pod resources are authorized to call MBeans operations.\n\n### Roles\n\nFor the time being, only the `viewer` and `admin` roles are supported.\nOnce the current invocation is authenticated, these roles are inferred from the permissions the user impersonating the request is granted for the pod hosting the operation being invoked.\n\nA user that's granted the `update` verb on the pod resource is bound to the `admin` role, i.e.:\n\n```sh\n$ oc auth can-i update pods/ --as \nyes\n```\n\nElse, a user granted the `get` verb on the pod resource is bound the `viewer` role, i.e.:\n\n```sh\n$ oc auth can-i get pods/ --as \nyes\n```\n\nOtherwise the user is not bound any roles, i.e.:\n\n```sh\n$ oc auth can-i get pods/ --as \nno\n```\n\n### ACL\n\nThe ACL definition for JMX operations works as follows:\n\nBased on the _ObjectName_ of the JMX MBean, a key composed with the _ObjectName_ domain, optionally followed by the `type` attribute, can be declared, using the convention `.`.\nFor example, the `java.lang.Threading` key for the MBean with the _ObjectName_ `java.lang:type=Threading` can be declared.\nA more generic key with the domain only can be declared (e.g. `java.lang`).\nA `default` top-level key can also be declared.\nA key can either be an unordered or ordered map, whose keys can either be string or regexp, and whose values can either be string or array of strings, that represent roles that are allowed to invoke the MBean member.\n\nThe default ACL definition can be found in the `hawtio-rbac` _ConfigMap_ from the `deployment-cluster-rbac.yml` and `deployment-namespace-rbac.yml` templates.\n\n### Authorization\n\nThe system looks for allowed roles using the following process:\n\nThe most specific key is tried first. E.g. for the above example, the `java.lang.Threading` key is looked up first.\nIf the most specific key does not exist, the domain-only key is looked up, otherwise, the `default` key is looked up.\nUsing the matching key, the system looks up its map value for:\n\n1. An exact match for the operation invocation, using the operation signature, and the invocation arguments, e.g.:\n\n `uninstall(java.lang.String)[0]: [] # no roles can perform this operation`\n\n2. A regexp match for the operation invocation, using the operation signature, and the invocation arguments, e.g.:\n\n `/update\$java\\.lang\\.String,java\\.lang\\.String\$\\[[1-4]?[0-9],.*\\]/: admin`\n\n Note that, if the value is an ordered map, the iteration order is guaranteed, and the first matching regexp key is selected;\n\n3. An exact match for the operation invocation, using the operation signature, without the invocation arguments, e.g.:\n\n `delete(java.lang.String): admin`\n\n4. An exact match for the operation invocation, using the operation name, e.g.:\n\n `dumpStatsAsXml: admin, viewer`\n\nIf the key matches the operation invocation, it is used and the process will not look for any other keys. So the most specific key always takes precedence.\nIts value is used to match the role that impersonates the request, against the roles that are allowed to invoke the operation.\nIf the current key does not match, the less specific key is looked up and matched following the steps 1 to 4 above, up until the `default` key.\nOtherwise, the operation invocation is denied.\n\n## Development\n\n### Tools\n\nYou must have the following tools installed:\n\n* [Node.js](http://nodejs.org)\n* [Yarn](https://yarnpkg.com) (version `1.5.1` or higher)\n* [gulp](http://gulpjs.com/) (version `4.x`)\n\n### Build\n\n```\n$ yarn install\n```\n\n### Install\n\nIn order to authenticate and obtain OAuth access tokens for the Hawtio console be authorized to watch for _hawtio-enabled_ ^[1](#f1) applications deployed in your cluster, you have to create an OAuth client that matches localhost development URLs.\n\n##### Cluster mode\n\n```sh\n$ oc create -f oauthclient.yml\n```\n\nSee [OAuth Clients](https://docs.openshift.com/container-platform/latest/authentication/configuring-oauth-clients.html#oauth-default-clients_configuring-oauth-clients) for more information.\n\n##### Namespace mode\n\n```sh\n$ oc create -f serviceaccount.yml\n```\n\nSee [Service Accounts as OAuth Clients](https://docs.openshift.com/container-platform/latest/authentication/using-service-accounts-as-oauth-client.html) for more information.\n\n### Run\n\n##### Cluster mode\n\n```\n$ yarn start --master=`oc whoami --show-server` --mode=cluster\n```\n\n##### Namespace mode\n\n```\n$ yarn start --master=`oc whoami --show-server` --mode=namespace --namespace=`oc project -q`\n```\n\nYou can access the console at .\n\n### Disable Jolokia authentication for deployments (dev only)\n\nIn order for a local hawtio-online to detect the hawtio-enabled applications, each application container needs to be configured with the following environment variables:\n\n```\nAB_JOLOKIA_AUTH_OPENSHIFT=false\nAB_JOLOKIA_PASSWORD_RANDOM=false\nAB_JOLOKIA_OPTS=useSslClientAuthentication=false,protocol=https\n```\n\nThe following script lets you apply the above environment variables to all the deployments with a label `provider=fabric8` in a batch:\n\n```sh\n$ ./scripts/disable-jolokia-auth.sh\n```\n\n---\n\n1. Containers with a configured port named `jolokia` and that exposes the [Jolokia](https://jolokia.org) API.\n","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",3215738680,"orgData","recentTags",[86,123],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_96":97,"_45":112,"_113":89,"_114":28,"_115":51,"_52":116,"_117":118,"_119":103,"_120":112,"_121":61,"_122":17},"content_type","creator",25489,"digest","sha256:b2a96dbdd3482681a448356f3d17b1ae450a2343744fdf1caf491287791583e8","full_size",89209040,"id",115427182,"images",[98],{"_99":100,"_90":91,"_101":43,"_102":103,"_104":105,"_106":107,"_108":43,"_109":-5,"_110":93,"_58":61,"_111":-5},"architecture","amd64","features","last_pulled","2026-09-13T07:26:03.886165435Z","last_pushed","2022-10-12T19:29:32Z","os","linux","os_features","os_version","size","variant","2022-10-12T19:29:31.132501Z","last_updater","last_updater_username","media_type","latest","repository",9742742,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_87":39,"_88":89,"_92":124,"_94":125,"_96":126,"_45":131,"_113":89,"_114":28,"_115":51,"_52":132,"_117":118,"_119":129,"_120":131,"_121":61,"_122":17},90399574,126537527,[127],{"_99":100,"_90":128,"_101":43,"_102":129,"_104":130,"_106":107,"_108":43,"_109":-5,"_110":124,"_58":61,"_111":-5},"sha256:8eaee98f82447af5480fd324c5542640ad13c51d72d7dbc9cc819cb05bb63473","2026-09-13T07:26:03.556359974Z","2022-06-14T10:59:57Z","2022-06-14T10:59:56.300234Z","dev","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":142,"_149":150,"_138":163,"_164":11},{"_35":143,"_37":144,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":145,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":146,"_74":11,"_75":148,"_80":28,"_81":82},[],[39],[51],{"_70":11,"_71":147},[73],{"_77":17,"_78":11,"_79":11},"tags",{"_151":152,"_153":-5,"_154":-5,"_155":156},"count",2,"next","previous","results",[157,160],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_96":158,"_45":112,"_113":89,"_114":28,"_115":51,"_52":116,"_117":118,"_119":103,"_120":112,"_121":61,"_122":17},[159],{"_99":100,"_90":91,"_101":43,"_102":103,"_104":105,"_106":107,"_108":43,"_109":-5,"_110":93,"_58":61,"_111":-5},{"_87":39,"_88":89,"_92":124,"_94":125,"_96":161,"_45":131,"_113":89,"_114":28,"_115":51,"_52":132,"_117":118,"_119":129,"_120":131,"_121":61,"_122":17},[162],{"_99":100,"_90":128,"_101":43,"_102":129,"_104":130,"_106":107,"_108":43,"_109":-5,"_110":124,"_58":61,"_111":-5},[],"canDeleteTags","actionData","errors"]

tadayosi/hawtio-online

Tags for tadayosi/hawtio-online