Sample: Liberty hello-world

Minimum-viable Open Liberty app with one ExternalSecret, Route, and OpenLibertyApplication CR — the smallest possible deploy that exercises the full overlay contract and AppSet flow.

Deploy in 5 commands

Prerequisites: tenant onboarding for apps-platform-liberty-hello-dev is complete (Vault role + namespace + ESO bridge + pull-secret label, per tenant onboarding). The Vault path secret/apps/platform/liberty-hello/dev/db-creds is seeded.

# 1. Clone the platform app monorepo (read-only).
git clone http://gitlab.sub.comptech-lab.com/divisions/platform/platform-apps-monorepo.git
cd platform-apps-monorepo

# 2. Confirm the sample is present and the AppSet has rendered an Application.
ls apps/team-platform/liberty-hello
oc -n openshift-gitops get application team-platform-liberty-hello-dev

# 3. Force an Argo sync (skip if AppSet has already synced).
argocd app sync team-platform-liberty-hello-dev

# 4. Wait for the Deployment to roll out.
oc -n apps-platform-liberty-hello-dev rollout status deploy/liberty-hello --timeout=120s

# 5. Hit the Route's /health endpoint.
ROUTE=$(oc -n apps-platform-liberty-hello-dev get route liberty-hello -o jsonpath='{.spec.host}')
curl -fsS "https://${ROUTE}/health" && echo "  OK"

Expected: a JSON {"status":"UP"} response with HTTP 200. Pod logs show Liberty starting, reading PGUSER and PGPASSWORD from the db-creds Secret.

What this sample demonstrates

The smallest possible delivery — no database, no mesh, no CI. The sample’s job is to prove the substrate works: a tenant overlay in GitLab becomes a running Pod with secret material delivered from Vault.

It exercises:

• The overlay contract (base/ + overlays/{dev,stg,prd}/).
• The AppSet directory discovery (auto-creates Argo Application/team-platform-liberty-hello-dev).
• The tenant Vault path (secret/apps/platform/liberty-hello/dev/db-creds).
• The per-tenant SecretStore/vault-apps and an ExternalSecret/db-creds.
• The cluster-wide app-registry-pull Secret + the default SA’s imagePullSecrets.
• The OpenLibertyApplication CR (the certified Red Hat Open Liberty operator from icr.io/appcafe/open-liberty-operator).
• An OpenShift Route with edge TLS termination.

Per issue #200 (DEV-OCP-5.1).

Repo layout

apps/team-platform/liberty-hello/
  base/
    kustomization.yaml
    openlibertyapplication.yaml         # the CR (replaces a raw Deployment)
    service.yaml
    route.yaml
    configmap-server-xml.yaml           # Liberty server.xml fragment
    externalsecret-db-creds.yaml        # Vault → Secret bridge
  overlays/
    dev/
      kustomization.yaml
    stg/
      kustomization.yaml
    prd/
      kustomization.yaml

Manifest highlights

base/openlibertyapplication.yaml

The Open Liberty operator’s CR replaces a raw Deployment — the operator reconciles a Deployment + Service + Route for you, plus reasonable defaults (probes, requests/limits, runAsNonRoot):

apiVersion: apps.openliberty.io/v1
kind: OpenLibertyApplication
metadata:
  name: liberty-hello
spec:
  applicationImage: app-registry.apps.sub.comptech-lab.com/team-platform/liberty-hello:placeholder
  applicationVersion: "REPLACED_BY_CI"
  replicas: 2
  service:
    port: 9080
    type: ClusterIP
  expose: true               # creates a Route
  route:
    termination: edge
  manageTLS: false           # Route handles TLS; pod does not
  envFrom:
    - secretRef:
        name: db-creds       # ESO-materialised
  probes:
    readiness:
      httpGet: { path: /health/ready, port: 9080 }
    liveness:
      httpGet: { path: /health/live, port: 9080 }
  resources:
    requests: { cpu: 200m, memory: 384Mi }
    limits:   { cpu: 500m, memory: 768Mi }
  securityContext:
    runAsNonRoot: true
    capabilities: { drop: [ALL] }
    allowPrivilegeEscalation: false

base/externalsecret-db-creds.yaml

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: db-creds
spec:
  refreshInterval: 1h
  secretStoreRef:
    kind: SecretStore           # tenant-scoped (per-namespace), not Cluster
    name: vault-apps
  target:
    name: db-creds
  data:
    - secretKey: PGUSER
      remoteRef:
        key: apps/platform/liberty-hello/dev/db-creds
        property: username
    - secretKey: PGPASSWORD
      remoteRef:
        key: apps/platform/liberty-hello/dev/db-creds
        property: password

overlays/dev/kustomization.yaml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

namespace: apps-platform-liberty-hello-dev

commonLabels:
  apps.platform/env: dev
  apps.platform/division: platform
  app.kubernetes.io/instance: liberty-hello-dev
  app.kubernetes.io/version: "REPLACED_BY_CI"

resources:
  - ../../base

images:
  - name: app-registry.apps.sub.comptech-lab.com/team-platform/liberty-hello
    newName: app-registry.apps.sub.comptech-lab.com/team-platform/liberty-hello
    digest: sha256:REPLACED_BY_CI

The full file set is in the platform-apps-monorepo. The above are the load-bearing pieces.

Smoke validation

NS=apps-platform-liberty-hello-dev

# 1. AppSet rendered the Application.
oc -n openshift-gitops get application team-platform-liberty-hello-dev \
  -o jsonpath='{.status.sync.status}{" "}{.status.health.status}{"\n"}'
# Expected: Synced Healthy

# 2. ExternalSecret resolved.
oc -n $NS get externalsecret db-creds \
  -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}{"\n"}'
# Expected: True

# 3. db-creds Secret was materialised by ESO.
oc -n $NS get secret db-creds -o jsonpath='{.type}{"\n"}'
# Expected: Opaque

# 4. OpenLibertyApplication reconciled to a Deployment.
oc -n $NS get openlibertyapplication liberty-hello \
  -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}{"\n"}'
# Expected: True

# 5. Deployment is rolled out.
oc -n $NS get deploy liberty-hello \
  -o jsonpath='{.status.readyReplicas}/{.status.replicas}{"\n"}'
# Expected: 2/2

# 6. Route serves /health.
ROUTE=$(oc -n $NS get route liberty-hello -o jsonpath='{.spec.host}')
curl -fsS "https://${ROUTE}/health"
# Expected: {"status":"UP","checks":[...]}

Failure modes

Adapting for your own app

References

• Issue #200 (DEV-OCP-5.1) — the closure for this sample.
• opp-full-plat/examples/liberty-hello/README.md — the per-sample README in the opp-full-plat repo.
• opp-full-plat/connection-details/app-repo-contract.md — the overlay contract.
• Red Hat Open Liberty operator docs — apps.openliberty.io/v1/OpenLibertyApplication.
• ADR 0014 — developer-readiness-platform-contract.