Create OAM domains

The OAM deployment scripts demonstrate the creation of an OAM domain home on an existing Kubernetes persistent volume (PV) and persistent volume claim (PVC). The scripts also generate the domain YAML file, which can then be used to start the Kubernetes artifacts of the corresponding domain.

Prerequisites

Before you begin, perform the following steps:

1. Review the Domain resource documentation.
2. Ensure that you have executed all the preliminary steps documented in Prepare your environment.
3. Ensure that the database is up and running.

Prepare to use the create domain script

The sample scripts for Oracle Access Management domain deployment are available at <weblogic-kubernetes-operator-project>/kubernetes/samples/scripts/create-access-domain.

1. Make a copy of the create-domain-inputs.yaml file:

   $ cd <work directory>/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv
   $ cp create-domain-inputs.yaml create-domain-inputs.yaml.orig   
   

   For example:

   $ cd /scratch/OAMDockerK8S/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv
   $ cp create-domain-inputs.yaml create-domain-inputs.yaml.orig
   

You must edit create-domain-inputs.yaml (or a copy of it) to provide the details for your domain. Please refer to the configuration parameters below to understand the information that you must provide in this file.

Edit configuration parameters

1. Edit the create-domain-inputs.yaml and modify the following parameters. Save the file when complete:

   domainUID: <domain_uid>
   domainHome: /u01/oracle/user_projects/domains/<domain_uid>
   image: <image_name>
   namespace: <domain_namespace>
   weblogicCredentialsSecretName: <kubernetes_domain_secret>
   persistentVolumeClaimName: <pvc_name>
   logHome: /u01/oracle/user_projects/domains/logs/<domain_uid>
   rcuSchemaPrefix: <rcu_prefix>
   rcuDatabaseURL: <rcu_db_host>:<rcu_db_port>/<rcu_db_service_name>
   rcuCredentialsSecret: <kubernetes_rcu_secret>   
   

   For example:

   domainUID: accessdomain
   domainHome: /u01/oracle/user_projects/domains/accessdomain
   image: oracle/oam:12.2.1.4.0
   namespace: oamns
   weblogicCredentialsSecretName: accessdomain-domain-credentials
   persistentVolumeClaimName: accessdomain-domain-pvc
   logHome: /u01/oracle/user_projects/domains/logs/accessdomain
   rcuSchemaPrefix: OAMK8S
   rcuDatabaseURL: mydatabasehost.example.com:1521/orcl.example.com
   rcuCredentialsSecret: accessdomain-rcu-credentials
   

A full list of parameters in the create-domain-inputs.yaml file are shown below:

Note that the names of the Kubernetes resources in the generated YAML files may be formed with the value of some of the properties specified in the create-inputs.yaml file. Those properties include the adminServerName, clusterName and managedServerNameBase. If those values contain any characters that are invalid in a Kubernetes service name, those characters are converted to valid values in the generated YAML files. For example, an uppercase letter is converted to a lowercase letter and an underscore ("_") is converted to a hyphen ("-").

The sample demonstrates how to create an OAM domain home and associated Kubernetes resources for a domain that has one cluster only. In addition, the sample provides the capability for users to supply their own scripts to create the domain home for other use cases. The generated domain YAML file could also be modified to cover more use cases.

Run the create domain script

1. Run the create domain script, specifying your inputs file and an output directory to store the generated artifacts:

   cd <work directory>/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv
   $ ./create-domain.sh -i create-domain-inputs.yaml -o /<path to output-directory>
   

   For example:

   $ cd /scratch/OAMDockerK8S/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv
   $ ./create-domain.sh -i create-domain-inputs.yaml -o output
   

   The output will look similar to the following:

   Input parameters being used
   export version="create-weblogic-sample-domain-inputs-v1"
   export adminPort="7001"
   export adminServerName="AdminServer"
   export domainUID="accessdomain"
   export domainType="oam"
   export domainHome="/u01/oracle/user_projects/domains/accessdomain"
   export serverStartPolicy="IF_NEEDED"
   export clusterName="oam_cluster"
   export configuredManagedServerCount="5"
   export initialManagedServerReplicas="2"
   export managedServerNameBase="oam_server"
   export managedServerPort="14100"
   export image="oracle/oam:12.2.1.4.0"
   export imagePullPolicy="IfNotPresent"
   export productionModeEnabled="true"
   export weblogicCredentialsSecretName="accessdomain-domain-credentials"
   export includeServerOutInPodLog="true"
   export logHome="/u01/oracle/user_projects/domains/logs/accessdomain"
   export t3ChannelPort="30012"
   export exposeAdminT3Channel="false"
   export adminNodePort="30701"
   export exposeAdminNodePort="false"
   export namespace="oamns"
   javaOptions=-Dweblogic.StdoutDebugEnabled=false
   export persistentVolumeClaimName="accessdomain-domain-pvc"
   export domainPVMountPath="/u01/oracle/user_projects/domains"
   export createDomainScriptsMountPath="/u01/weblogic"
   export createDomainScriptName="create-domain-job.sh"
   export createDomainFilesDir="wlst"
   export rcuSchemaPrefix="OAMK8S"
   export rcuDatabaseURL="mydatabasehost.example.com:1521/orcl.example.com"
   export rcuCredentialsSecret="accessdomain-rcu-credentials"
   
   Generating output/weblogic-domains/accessdomain/create-domain-job.yaml
   Generating output/weblogic-domains/accessdomain/delete-domain-job.yaml
   Generating output/weblogic-domains/accessdomain/domain.yaml
   Checking to see if the secret accessdomain-domain-credentials exists in namespace oamns
   configmap/accessdomain-create-oam-infra-domain-job-cm created
   Checking the configmap accessdomain-create-oam-infra-domain-job-cm was created
   configmap/accessdomain-create-oam-infra-domain-job-cm labeled
   Checking if object type job with name accessdomain-create-oam-infra-domain-job exists
   No resources found in oamns namespace.
   Creating the domain by creating the job output/weblogic-domains/accessdomain/create-domain-job.yaml
   job.batch/accessdomain-create-oam-infra-domain-job created
   Waiting for the job to complete...
   status on iteration 1 of 20
   pod accessdomain-create-oam-infra-domain-job-vj69h status is Running
   status on iteration 2 of 20
   pod accessdomain-create-oam-infra-domain-job-vj69h status is Running
   status on iteration 3 of 20
   pod accessdomain-create-oam-infra-domain-job-vj69h status is Running
   status on iteration 4 of 20
   pod accessdomain-create-oam-infra-domain-job-vj69h status is Running
   status on iteration 5 of 20
   pod accessdomain-create-oam-infra-domain-job-vj69h status is Completed
   
   Domain accessdomain was created and will be started by the Oracle WebLogic Kubernetes Operator
    
   The following files were generated:
   output/weblogic-domains/accessdomain/create-domain-inputs.yaml
   output/weblogic-domains/accessdomain/create-domain-job.yaml
   output/weblogic-domains/accessdomain/domain.yaml
   
   Completed
   

   Note: If the domain creation fails, refer to the Troubleshooting section.

   The command creates a domain.yaml file required for domain creation.

2. Navigate to the /output/weblogic-domains/<domain_uid> directory:

   $ cd <work directory>/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv/output/weblogic-domains/<domain_uid>
   

   For example:

   $ cd /scratch/OAMDockerK8S/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv/output/weblogic-domains/accessdomain
   

   Edit the domain.yaml file, increase the min and max heap size save the file. Change the following value from:

   - name: USER_MEM_ARGS"
     value: "-Djava.security.egd=file:/dev/./urandom -Xms256m -Xmx1024m "
   

   to:

   - name: USER_MEM_ARGS"
     value: "-XX:+UseContainerSupport -Djava.security.egd=file:/dev/./urandom -Xms8192m -Xmx8192m"
   

   Add the following environment variable to the domain.yaml file for the Admin Server under “env” tag. This is needed for running the idmconfigtool from the AdminServer.

   - name: CLASSPATH
     value: "/u01/oracle/wlserver/server/lib/weblogic.jar"
   

   Sample below:

     adminServer:
     # serverStartState legal values are "RUNNING" or "ADMIN"
     # "RUNNING" means the listed server will be started up to "RUNNING" mode
     # "ADMIN" means the listed server will be start up to "ADMIN" mode
     serverStartState: "RUNNING"
     adminService:
       channels:
     # The Admin Server's NodePort
        - channelName: default
          nodePort: 30701
     # Uncomment to export the T3Channel as a service
        - channelName: T3Channel
     serverPod:
       # an (optional) list of environment variable to be set on the admin servers
       env:
       - name: USER_MEM_ARGS
         value: "-Djava.security.egd=file:/dev/./urandom -Xms512m -Xmx1024m "
       - name: CLASSPATH
         value: "/u01/oracle/wlserver/server/lib/weblogic.jar"
   

3. If required, you can add the optional parameter maxClusterConcurrentStartup to the spec section of the domain.yaml. This parameter specifies the number of managed servers to be started in sequence per cluster. For example if you updated the initialManagedServerReplicas to 4 in create-domain-inputs.yaml and only had 2 nodes, then setting maxClusterConcurrentStartup: 1 will start one managed server at a time on each node, rather than starting them all at once. This can be useful to take the strain off individual nodes at startup. Below is an example with the parameter added:

   apiVersion: "weblogic.oracle/v8"
   kind: Domain
   metadata:
     name: accessdomain
     namespace: oamns
     labels:
       weblogic.domainUID: accessdomain
   spec:
     # The WebLogic Domain Home
     domainHome: /u01/oracle/user_projects/domains/accessdomain
     maxClusterConcurrentStartup: 1
   
     # The domain home source type
     # Set to PersistentVolume for domain-in-pv, Image for domain-in-image, or FromModel for model-in-image
     domainHomeSourceType: PersistentVolume
   
     # The WebLogic Server Docker image that the Operator uses to start the domain
     image: "oracle/oam:12.2.1.4.0"
     ....
   

4. Create the Kubernetes resource using the following command:

   $ kubectl apply -f <work directory>/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv/output/weblogic-domains/accessdomain/domain.yaml
   

   For example:

   $ kubectl apply -f /scratch/OAMDockerK8S/weblogic-kubernetes-operator/kubernetes/samples/scripts/create-access-domain/domain-home-on-pv/output/weblogic-domains/accessdomain/domain.yaml
   

   The output will look similar to the following:

   domain.weblogic.oracle/accessdomain created
   

Verify the domain

1. Verify the domain, servers pods and services are created and in the READY state with a status of 1/1, by running the following command:

   $ kubectl get all,domains -n <domain_namespace>
   

   For example:

   $ kubectl get all,domains -n oamns
   

   The output will look similar to the following:

   NAME                                                READY   STATUS      RESTARTS   AGE
   pod/accessdomain-adminserver                         1/1     Running     0          17m
   pod/accessdomain-create-oam-infra-domain-job-vj69h   0/1     Completed   0          42m
   pod/accessdomain-oam-policy-mgr1                     1/1     Running     0          9m7s
   pod/accessdomain-oam-server1                         1/1     Running     0          9m7s
   pod/accessdomain-oam-server2                         1/1     Running     0          9m7s
   pod/helper                                          1/1     Running     0          23h
   
   NAME                                         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)     AGE
   service/accessdomain-adminserver              ClusterIP   None             <none>        7001/TCP    17m
   service/accessdomain-cluster-oam-cluster      ClusterIP   10.110.50.168     <none>        14100/TCP   9m8s
   service/accessdomain-cluster-policy-cluster   ClusterIP   10.102.32.247      <none>        15100/TCP   9m8s
   service/accessdomain-oam-policy-mgr1          ClusterIP   None             <none>        15100/TCP   9m8s
   service/accessdomain-oam-policy-mgr2          ClusterIP   10.104.147.108    <none>        15100/TCP   9m8s
   service/accessdomain-oam-policy-mgr3          ClusterIP   10.108.233.86    <none>        15100/TCP   9m8s
   service/accessdomain-oam-policy-mgr4          ClusterIP   10.105.15.228     <none>        15100/TCP   9m7s
   service/accessdomain-oam-policy-mgr5          ClusterIP   10.99.66.92    <none>        15100/TCP   9m8s
   service/accessdomain-oam-server1              ClusterIP   None             <none>        14100/TCP   9m8s
   service/accessdomain-oam-server2              ClusterIP   None             <none>        14100/TCP   9m8s
   service/accessdomain-oam-server3              ClusterIP   10.111.231.33    <none>        14100/TCP   9m8s
   service/accessdomain-oam-server4              ClusterIP   10.110.10.183     <none>        14100/TCP   9m7s
   service/accessdomain-oam-server5              ClusterIP   10.103.192.174   <none>        14100/TCP   9m8s
   
   NAME                                                COMPLETIONS   DURATION   AGE
   job.batch/accessdomain-create-oam-infra-domain-job   1/1           2m14s      42m
   
   NAME                                 AGE
   domain.weblogic.oracle/accessdomain   25m
   

   Note: It will take several minutes before all the services listed above show. When a pod has a STATUS of 0/1 the pod is started but the OAM server associated with it is currently starting. While the pods are starting you can check the startup status in the pod logs, by running the following command:

   $ kubectl logs accessdomain-adminserver -n oamns
   $ kubectl logs accessdomain-oam-policy-mgr1 -n oamns
   $ kubectl logs accessdomain-oam-server1 -n oamns
   etc..
   

   The default domain created by the script has the following characteristics:

   • An Administration Server named AdminServer listening on port 7001.
   • A configured OAM cluster named oam_cluster of size 5.
   • A configured Policy Manager cluster named policy_cluster of size 5.
   • Two started OAM managed Servers, named oam_server1 and oam_server2, listening on port 14100.
   • One started Policy Manager managed server named oam-policy-mgr1, listening on port 15100.
   • Log files that are located in <persistent_volume>/logs/<domainUID>.

2. Run the following command to describe the domain:

   $ kubectl describe domain <domain_uid> -n <domain_namespace>
   

   For example:

   $ kubectl describe domain accessdomain -n oamns
   

   The output will look similar to the following:

   Name:         accessdomain
   Namespace:    oamns
   Labels:       weblogic.domainUID=accessdomain
   Annotations:  API Version:  weblogic.oracle/v8
   Kind:         Domain
   Metadata:
     Creation Timestamp:  2020-09-24T14:00:34Z
     Generation:          1
     Managed Fields:
       API Version:  weblogic.oracle/v8
       Fields Type:  FieldsV1
       fieldsV1:
         f:metadata:
           f:annotations:
             .:
             f:kubectl.kubernetes.io/last-applied-configuration:
           f:labels:
             .:
             f:weblogic.domainUID:
       Manager:      kubectl
       Operation:    Update
       Time:         2020-09-24T14:00:34Z
       API Version:  weblogic.oracle/v8
       Fields Type:  FieldsV1
       fieldsV1:
         f:status:
           .:
           f:clusters:
           f:conditions:
           f:servers:
           f:startTime:
       Manager:         OpenAPI-Generator
       Operation:       Update
       Time:            2020-09-24T14:12:51Z
     Resource Version:  244336
     Self Link:         /apis/weblogic.oracle/v8/namespaces/oamns/domains/accessdomain
     UID:               0edf8266-4419-45f1-bd50-e26ac41340e5
   Spec:
     Admin Server:
       Server Pod:
         Env:
           Name:            USER_MEM_ARGS
           Value:           -XX:+UseContainerSupport -Djava.security.egd=file:/dev/./urandom -Xms8192m -Xmx8192m
           Name:            CLASSPATH
           Value:           /u01/oracle/wlserver/server/lib/weblogic.jar
       Server Start State:  RUNNING
     Clusters:
       Cluster Name:  policy_cluster
       Replicas:      1
       Server Pod:
         Affinity:
           Pod Anti Affinity:
             Preferred During Scheduling Ignored During Execution:
               Pod Affinity Term:
                 Label Selector:
                    Match Expressions:
                     Key:       weblogic.clusterName
                     Operator:  In
                     Values:
                       $(CLUSTER_NAME)
                 Topology Key:  kubernetes.io/hostname
               Weight:          100
       Server Service:
         Precreate Service:  true
       Server Start State:   RUNNING
       Cluster Name:         oam_cluster
       Replicas:             2
       Server Pod:
         Affinity:
           Pod Anti Affinity:
             Preferred During Scheduling Ignored During Execution:
               Pod Affinity Term:
                 Label Selector:
                   Match Expressions:
                     Key:       weblogic.clusterName
                     Operator:  In
                     Values:
                       $(CLUSTER_NAME)
                  Topology Key:  kubernetes.io/hostname
                Weight:          100
        Server Service:
          Precreate Service:          true
        Server Start State:           RUNNING
     Data Home:
     Domain Home:                    /u01/oracle/user_projects/domains/accessdomain
     Domain Home Source Type:        PersistentVolume
     Http Access Log In Log Home:    true
     Image:                          oracle/oam:12.2.1.4.0
     Image Pull Policy:              IfNotPresent
     Include Server Out In Pod Log:  true
     Log Home:                       /u01/oracle/user_projects/domains/logs/accessdomain
     Log Home Enabled:               true
     Server Pod:
       Env:
         Name:   JAVA_OPTIONS
         Value:  -Dweblogic.StdoutDebugEnabled=false
         Name:   USER_MEM_ARGS
         Value:  -Djava.security.egd=file:/dev/./urandom -Xms256m -Xmx1024m
       Volume Mounts:
         Mount Path:  /u01/oracle/user_projects/domains
         Name:        weblogic-domain-storage-volume
       Volumes:
         Name:  weblogic-domain-storage-volume
         Persistent Volume Claim:
            Claim Name:     accessdomain-domain-pvc
      Server Start Policy:  IF_NEEDED
      Web Logic Credentials Secret:
       Name:  accessdomain-domain-credentials
    Status:
      Clusters:
       Cluster Name:      oam_cluster
       Maximum Replicas:  5
       Minimum Replicas:  0
       Ready Replicas:    2
       Replicas:          2
       Replicas Goal:     2
       Cluster Name:      policy_cluster
       Maximum Replicas:  5
       Minimum Replicas:  0
       Ready Replicas:    1
       Replicas:          1
       Replicas Goal:     1
     Conditions:
       Last Transition Time:  2020-09-24T14:12:02.037Z
       Reason:                ServersReady
       Status:                True
       Type:                  Available
     Servers:
       Desired State:  RUNNING
       Health:
         Activation Time:  2020-09-24T14:09:01.164Z
         Overall Health:   ok
         Subsystems:
           Subsystem Name:  ServerRuntime
           Symptoms:
       Node Name:      10.250.111.112
       Server Name:    AdminServer
       State:          RUNNING
       Cluster Name:   oam_cluster
       Desired State:  RUNNING
       Health:
         Activation Time:  2020-09-24T14:11:06.015Z
         Overall Health:   ok
         Subsystems:
           Subsystem Name:  ServerRuntime
           Symptoms:
       Node Name:      10.250.111.111
       Server Name:    oam_server1
       State:          RUNNING
       Cluster Name:   oam_cluster
       Desired State:  RUNNING
       Health:
         Activation Time:  2020-09-24T14:11:35.454Z
         Overall Health:   ok
         Subsystems:
           Subsystem Name:  ServerRuntime
           Symptoms:
       Node Name:      10.250.111.112
       Server Name:    oam_server2
       State:          RUNNING
       Cluster Name:   oam_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_server3
       Cluster Name:   oam_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_server4
       Cluster Name:   oam_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_server5
       Cluster Name:   policy_cluster
       Desired State:  RUNNING
       Health:
          Activation Time:  2020-09-24T14:11:54.938Z
         Overall Health:   ok
         Subsystems:
           Subsystem Name:  ServerRuntime
           Symptoms:
       Node Name:      10.250.111.112
       Server Name:    oam_policy_mgr1
       State:          RUNNING
       Cluster Name:   policy_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_policy_mgr2
       Cluster Name:   policy_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_policy_mgr3
       Cluster Name:   policy_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_policy_mgr4
       Cluster Name:   policy_cluster
       Desired State:  SHUTDOWN
       Server Name:    oam_policy_mgr5
      Start Time:       2020-09-24T14:00:34.395Z
   Events:             <none>
   

   In the Status section of the output, the available servers and clusters are listed.

3. Run the following command to see the pods running the servers and which nodes they are running on:

   $ kubectl get pods -n <domain_namespace> -o wide
   

   For example:

   $ kubectl get pods -n oamns -o wide
   

   The output will look similar to the following:

   NAME                                            READY   STATUS      RESTARTS   AGE     IP            NODE             NOMINATED NODE   READINESS GATES
   accessdomain-adminserver                         1/1     Running     0          26m     10.244.1.7   10.250.111.112   <none>           <none>
   accessdomain-create-oam-infra-domain-job-vj69h   0/1     Completed   0          5h55m   10.244.1.5   10.250.111.112   <none>           <none>
   accessdomain-oam-policy-mgr1                     1/1     Running     0          18m     10.244.1.9   10.250.111.112   <none>           <none>
   accessdomain-oam-server1                         1/1     Running     0          18m     10.244.2.3   10.250.111.111   <none>           <none>
   accessdomain-oam-server2                         1/1     Running     0          18m     10.244.1.8   10.250.111.112   <none>           <none>
   helper                                          1/1     Running     0          22h     10.244.1.4   10.250.111.112   <none>           <none>
   

   You are now ready to configure an Ingress to direct traffic for your OAM domain as per Configure an Ingress for an OAM domain.