OpenShift template: replication parameters are never passed, the Secret is unused and malformed, and nothing tests it

[vharseko]

Problem

The OpenShift template (opendj-openshift-template.yaml) has not changed since 2019. The release workflows still attach it to every release, but nothing tests it. Reading it against the current image:

1. The replication parameters do nothing. run.sh starts replicate.sh only when both MASTER_SERVER and OPENDJ_REPLICATION_TYPE are set. The template declares OPENDJ_REPLICATION_TYPE and OPENDJ_REPLICATION_GROUP_ID as parameters, but never passes them to the container. It also sets MYHOSTNAME to the service name, which on a headless Service resolves to every pod rather than to the pod itself.
2. The Secret is not used, and it is malformed. The root password is passed to the container as a plain value: rather than through secretKeyRef. The Secret's labels sit next to metadata instead of inside it. kubeconform -strict rejects it: Secret opendj is invalid: ... additional properties 'labels' not allowed.
3. The Service has two selector keys. The first one (name: ...) matches no pod, and the Service selects pods only because most parsers keep the last duplicate key. A strict YAML parser rejects the file. The template.openshift.io/expose-uri annotation refers to a port named opendj, but the ports are named 1389-tcp/1636-tcp/4444-tcp, so the exposed URI has no port.
4. An untagged image with imagePullPolicy: Always. Every pod restart can pull a newer release, which run.sh then upgrades the data to (upgrade -n) without anybody deciding to.
5. No probes and no resources. Probes are needed because OpenShift ignores the image HEALTHCHECK (Report the OpenDJ container healthy only once its bootstrap has succeeded #898). Resources are {}.
6. terminationGracePeriodSeconds: 1800. Together with Docker image: a freshly bootstrapped container ignores SIGTERM and is killed without stopping the server #1085, deleting a pod in its first lifetime takes 30 minutes before it is killed.
7. It does not run under the default restricted-v2 SCC (Docker image: does not start under an arbitrary UID in group 0, so OpenShift needs anyuid #1088).
8. The README does not work as written. It names a file opendj-template.yml, which does not exist, and suggests oc update, which is not an oc command (oc replace / oc apply). The template's own text still says TODO: add urls.

Expected

Either fix the template, or replace it with the Helm chart from discussion #1079 (Helm works on OpenShift too) and stop attaching it to releases. Until then, it should not advertise replication it does not set up.