Search code examples
webspherewebsphere-liberty

Need advice on deploying on Liberty and managing sensitive user/passwords data *for db, mq etc.)

We are looking to move our dev+prod WebSphere full profile app to Liberty.

Currently, we build only once (using Ant scripts) and deploy the same package (i.e. EAR) to our functional, UAT and production environments.

Database and MQ connections (and related sensitive data like usernames and passwords) are directly set via the WAS admin console for each environment, so there is no such data in our EAR.

A few non sensitive settings that change per environment (mail server address etc), are kept in a file suffixed with the (e.g configuration_.properties). All these files are bundled within the EAR. Each WebSphere defines a JVM property to specify the environment they are running (prd, uat, fnc, lab etc). When the application starts, it reads the files that is associated with the environment. That works great.

Now with Liberty, the connection/MQ pools, LDAP users etc are defined in server.xml.

Questions:

  • how to manage the server.xml file(s) that replace the job done via the WAS console by the authorized admins?
  • how to define the database name/port/host/user/password needed for those access per environnment? keep one server.xml file per environnement?
  • is there a way to have a "base" server.xml file and "override" the database name/port/host/user/password etc at startup on runtime?
  • or maybe there are more clever strategies?

We don't know yet if we will run Liberty in a traditional ND/Cluster way or into a docker infrastructure (this is all very new to us..).

How do you handle this?

Thanks in advance.

Solution

  • You can do the same thing in Liberty, just using different methods.

    1) in your server.xml files, use variables wherever needed: ${this.style} for referencing system/bootstrap properties or server.xml defined variables, or ${env.ENV_VAR} for referencing Environment variables

    2) add in a per-environment server.env file, or use configDropins/overrides to define environment-specific server.xml snippets (this answers one of your questions: yes, you can have a base server.xml and use environment-specific overrides)

    More information here: http://www.ibm.com/support/knowledgecenter/SSD28V_8.5.5/com.ibm.websphere.wlp.core.doc/ae/cwlp_config.html?lang=en

    And here (specifically includes and dropins): http://www.ibm.com/support/knowledgecenter/SSD28V_8.5.5/com.ibm.websphere.wlp.core.doc/ae/twlp_setup_basics.html?lang=en