Migrate from Red Hat PAM to Apache KIE

Moving Red Hat PAM 7 projects to Apache KIE 10 means re-testing BPMN, DMN and rule assets, rebuilding KIE Server and Business Central workflows on a Kogito-based runtime, and running an incubating ASF project. This page sets out the sequence, the risks and what drives effort.

On this page

Migrate from Red Hat PAM to Apache KIE: what the move involves

Apache KIE 10 is the open-source lineage of jBPM and Drools, so a Red Hat PAM 7 estate that is past end of life can move there mostly by re-testing and re-packaging its assets rather than rewriting them. The platform or architecture team usually owns the work, often with an implementation partner for the runtime changes and the test effort. Start by inventorying every BPMN process, DMN model, rule package and work item handler, then decide which of them change at all. Models that run on the jBPM engine and rules that depend only on Drools are the lowest-risk candidates to test first. Work item handlers, custom Business Central extensions and anything that calls KIE Server APIs are where most of the change will sit.

The biggest structural change is the runtime. KIE Server and Business Central are not the target shape for most new deployments, and the Kogito-based runtime on Quarkus or Spring Boot replaces the packaged server model. Your team will need to decide how each process service is built, deployed, versioned and monitored in your own Kubernetes or VM estate. Confirm with the Apache KIE project which parts of the old tooling still apply, because the 10.2.0 release removed the classic BPMN and DMN editors and replaced the legacy GWT-based tooling with a new BPMN editor. Plan for authoring changes as well as runtime changes, since business analysts will work in a different editor.

Apache KIE is still in incubation at the Apache Software Foundation. The project's site states that incubation does not necessarily reflect the completeness or stability of the code, only that the ASF has not yet fully endorsed the project. That means your organization carries the support, patching and upgrade burden, through its own staff or a contracted partner, and should price that into the decision. Ask any partner to document how they will track upstream security fixes, which release line they will support, and how they will handle in-flight process instances during each upgrade. Run a pilot with production-like volumes and a rollback plan before committing a critical process to the new runtime.

Which Red Hat PAM capabilities map to Apache KIE, and which need rework

This table maps each Red Hat PAM 7 capability to its Apache KIE 10 equivalent and marks it clean, needs rework or gap. Read it as a first-pass inventory: clean rows still need a test run on your own assets, and rework rows usually decide the migration effort. Confirm every row against your exact PAM version, extensions and custom code before committing to a schedule.

CapabilityApache KIE 10 equivalentStatus and what to check
jBPM BPMN processesjBPM engine in Apache KIE, with the new BPMN editor from 10.2.0Needs rework: re-validate every model on the 10.x engine; the classic BPMN editor was removed in 10.2.0
Drools rules (DRL and decision tables)Drools in Apache KIE 10Clean for most rules: run your rule test suite; confirm any custom KIE extensions or non-standard functions
DMN decision modelsDMN runtime in Apache KIE; DMN 1.6 supported from 10.2.0Needs rework: the classic DMN editor was removed in 10.2.0, so models must be edited elsewhere or re-saved; confirm DMN 1.x version compatibility
Business Central authoringBusiness Central successor tooling under Apache KIE; new BPMN editor replaces legacy GWT toolingGap: confirm which authoring screens you use and whether a replacement exists for each; plan for authors to change tools
KIE Server deploymentKogito-based runtime on Quarkus or Spring Boot, packaged as your own serviceNeeds rework: the deployment model changes from a shared server to an application you build and operate
Work item handlersCustom service tasks or handlers in the Kogito-based runtimeNeeds rework: each handler must be re-implemented and tested against the new runtime API
Process management APIsREST and Java APIs in the Kogito-based runtimeGap: endpoints and payloads can differ; inventory every client call and confirm each one against the new API
Java runtime and frameworksJava 17 and Jakarta 10 from 10.0.0; Java 21, Quarkus 3.27.2 and Spring Boot 3.5.10 from 10.2.0Confirm: check your JDK, application server and library versions before upgrading
Running process instancesApache KIE 10 runtime with your persistence layerGap: in-flight instances need a drain or migration plan; confirm with the project's documentation for your version

Moving from KIE Server and Business Central to a Kogito-based runtime on Quarkus or Spring Boot

The core change is in the deployment model. Red Hat PAM teams usually ran a shared KIE Server that loaded deployable units from Business Central, and the process and rule assets were pushed to it at runtime. In the Apache KIE line, the runtime is a service you build: processes, decisions and rules are compiled into a Kogito-based application that runs on Quarkus or Spring Boot and ships as its own artifact. Apache KIE 10.0.0 set Java 17 and Jakarta 10 as the baseline, so any application code, dependencies and base images must already support both before you start. Confirm the supported Quarkus and Spring Boot versions for each release you plan to adopt, because the KIE release posts name specific framework versions (10.2.0 moved to Quarkus 3.27.2 and Spring Boot 3.5.10) and those change between lines.

Build pipelines and packaging change most. Instead of uploading a KJAR to a central server, the pipeline compiles BPMN, DMN and rule resources with the application, runs the test suite, and produces a container image per service. Image builds, dependency scanning and promotion to each environment move into your CI system, which means the platform team owns the Maven repository, the base image and the runtime configuration keys. Two repository facts matter here. The Kogito Runtimes and Kogito Apps repositories are archived on GitHub, and their code now lives in apache/incubator-kie-drools, so pin your dependencies and documentation links to that location. The BPMN editor also changed in 10.2.0, so confirm which authoring tool your business analysts will use before you change the pipeline.

Responsibilities split between developers and operations. Developers own process models, decision tables, rule logic and the unit and integration tests that exercise them. Operations owns the container platform, scaling, health checks, secrets for data sources, and the decision of when a new image replaces a running one. Business Central no longer deploys to the runtime, so business-side changes must go through a Git commit and a pipeline run, and you should agree on who approves those merges. Plan for in-flight instances during each rollout, since a new image does not automatically carry the state of processes started on the old one. Ask the vendor for a written statement on upgrade and state-migration support for your target version before you commit to this model.

What data, process state and integrations you need to move

A PAM move touches four kinds of material: the definitions and rules you deploy, the process instances still running, the Java code that connects processes to other systems, and the audit trail. Each needs its own export path, owner and test, and none should be assumed to move just because the process model does.

Deployed process definitions and rule packages

Inventory every BPMN process, DMN decision model and Drools rule package deployed from Business Central or KIE Server, including the versions and the container or KJAR coordinates they are built from. Note which assets are authored in the classic editors, because Apache KIE 10.2.0 removed the classic BPMN and DMN editors and replaced the BPMN editor, so those models will need to be opened and re-saved in the new tooling. Confirm the export and import options for your exact PAM 7 version with Red Hat documentation, then run a test deployment before you count the model as migrated.

In-flight process instances and their store

Running instances hold state in the database that KIE Server or Business Central uses for persistence. Identify which instances are still active, which are waiting on timers, signals or human tasks, and which persistence store and schema they live in. The documented path is to let existing instances finish on PAM where possible, or to plan a drain window. Do not assume an automated instance migrator exists for your version. Confirm with Red Hat and prove any instance-level move in a test environment with a copy of production data.

Custom work item handlers and service integrations

jBPM work item handlers, custom task implementations and KIE Server REST clients are Java code that calls your own systems. Each one must be mapped to its equivalent on the Kogito-based runtime, typically a Quarkus or Spring Boot service with generated process code, and its credentials, endpoints and error handling must be reviewed. List every handler by name, the systems it calls and the owner who signs off. Treat this inventory as the input to your code change estimate, since it is usually the largest unknown in the move.

Audit and history data

Process audit logs, task history and any data your regulators or internal auditors rely on must be kept outside the runtime that you retire. Decide whether history stays in the legacy database as a read-only archive, is exported to a reporting store, or is replaced by new logging on the Apache KIE runtime. Confirm which audit tables your PAM version writes, how long your retention policy requires them, and whether the chosen export preserves timestamps and actor identities. Validate that the archive is readable before decommissioning anything.

Credentials, users and roles

Business Central and KIE Server rely on their own user, role and group configuration, which often maps to LDAP, Keycloak or an application realm. The new runtime will authenticate through whatever your Quarkus or Spring Boot services use, so task assignment, process admin rights and API access need to be re-mapped deliberately. List every role that appears in process definitions or task assignments and confirm the mapping with the team that owns the identity provider before cutover.

The migration sequence from inventory to decommission

The sequence moves Red Hat PAM 7 workloads to Apache KIE in five gated stages, so each asset is proven on the new runtime before traffic or in-flight work moves. Every stage closes with a written artifact that the next stage depends on.

  1. Build the asset and dependency inventory

    Start by listing every BPMN process, DMN decision table, Drools rule package, work item handler, custom Java class, form and external integration that runs on PAM 7. Record which Business Central spaces and KIE Server containers host each asset, which systems call them, and how many process instances are active. Assign each item a migration owner and a test owner. The output is an asset register that also shows the database, JVM, identity and monitoring dependencies behind each container. The step is done when the business owners have signed off that the register is complete.

  2. Pilot one representative process and one rule package

    Choose one BPMN process with human tasks, timers and service calls, and one Drools rule package with a DMN decision table that the process depends on. Rebuild them on the Apache KIE 10 line, replacing work item handlers with the equivalent service integrations, and run them on the target runtime, Quarkus or Spring Boot. Compare outputs with production results for the same inputs and log every difference. The output is a test evidence pack covering inputs, expected and actual outputs, and the changes made to the assets. Confirm the exact KIE 10 release and the editor behavior against the current release notes before you start, since the BPMN editor changed in 10.2.0.

  3. Run both platforms in parallel

    Send the same test inputs, and where policy allows a copy of live inputs, to both PAM 7 and the Apache KIE runtime. Compare decisions, task routing, timer behavior, error handling and data written to downstream systems. Treat each mismatch as a defect to fix or a documented, approved change in behavior. Include failure cases such as partial outages and malformed messages, not only the happy path. The output is a reconciliation report listing every asset, the number of comparisons, the open differences and the owner of each. The step is done when open differences are closed or formally accepted.

  4. Cut over in controlled waves with an instance drain

    Move new process starts to Apache KIE one asset group at a time, and let PAM 7 finish the instances it already holds. Track in-flight instances per asset until the count reaches zero or until the remaining cases are migrated by a tested, scripted method approved by the process owners. Keep PAM 7 running and able to accept traffic during the window so you can reverse direction. The output is a cutover log per wave and a rollback plan that names the trigger conditions, the person who decides, and the steps to reroute traffic. Verify that monitoring and alerts cover both runtimes during the drain.

  5. Decommission Business Central and KIE Server

    After the drain completes and no instances or audit queries depend on PAM 7, stop the Business Central and KIE Server components in that order. Archive the final database snapshots, asset repositories, configuration files and audit logs under the retention rules your compliance team requires, and confirm with your auditors which records they will need to see. Revoke service accounts, firewall rules and certificates tied to the old platform. The output is a decommission record that lists each removed component, where its archive is stored, and who approved the removal. Ask Red Hat or your support contract holder which final data and license obligations apply before you retire the subscription.

Running both platforms in parallel and cutting over

This pattern routes new process starts to Apache KIE while instances already running on PAM finish on the old platform. It fits processes with short lifespans, processes whose state you can safely restart, and new business flows with no existing instances. Both platforms stay live until the last PAM instance completes, so the old environment remains the fallback.

  • Routing point: Decide where starts are switched, such as an API gateway, a calling service's configuration, or a feature flag, and confirm each caller can target either platform.
  • Instance ownership: Record which platform owns each instance so support staff know where to look for a given case.
  • Parity testing: Replay representative start payloads against both engines and compare outcomes, including DMN decision results and human task assignments.
  • Rollback: Revert the routing point so new starts return to PAM. Instances already on Apache KIE continue there, so rollback covers only new work.
  • Retirement: Keep PAM read-only for audit and history queries until your retention rules allow removal.

Before switching, confirm with your environment owners how long your slowest process runs and whether the Apache KIE runtime you deploy matches your tested version.

What drives migration cost and duration

This table lists the factors that move the effort of a Red Hat PAM 7 to Apache KIE 10 migration, why each one matters, and how to keep it under control. Use it to scope your own estate before asking for a quote, since most of the cost sits in custom code, test coverage and the skills your team has available.

DriverWhy it moves effortHow to keep it down
Number of processes and rule packagesEvery BPMN model, DMN decision and DRL package must be opened in the new tooling, re-validated and re-tested, so effort scales with the inventory.Inventory assets first, retire unused processes, and group rule packages by owning team to batch the review.
Custom Java in work item handlersHandlers written against PAM work item interfaces must be rewritten as service tasks or Java delegates for the Kogito-based runtime, which is the largest source of code change.Count handlers early, isolate business logic from framework calls, and keep handlers small so the rewrite is mechanical.
Long-running and in-flight instancesInstances started on the old runtime must either finish there, be migrated, or be drained, and each choice needs cutover planning and sign-off.Ask for a count of active instances by process, set a drain window, and decide per process whether migration tooling is needed.
Number of integrationsREST, messaging and database connectors are rebuilt or re-tested against the new Quarkus or Spring Boot runtime, and each external contract adds test and coordination work.List every system a process calls or is called by, and reuse existing API contracts and test doubles.
Test coverageWithout automated tests on current behavior, teams must prove equivalence by hand, which often costs more than the code changes themselves.Capture expected outputs from production-like inputs before changing anything, and automate those checks in CI.
Business Central authoring by business usersIf analysts edit processes and rules in Business Central, the new authoring path (including the BPMN editor introduced in 10.2.0) needs training and a decision on who owns models after migration.Decide the authoring toolchain early, run a short pilot with business owners, and document the approval workflow for changes.
Internal skills in Quarkus or Spring BootTeams that already run Java services on these frameworks move faster, while teams without them need training or outside help to operate the new runtime.Confirm the framework choice against existing platform standards, and ask any partner to name the engineers who will do the work.

What usually goes wrong and how to prevent it

Most failed moves from Red Hat PAM to Apache KIE come from planning assumptions, not from the engine itself. The six risks below cover support, tooling, runtime state, decision behavior, custom code and recovery, and each one has a prevention step you can put in the migration plan before work starts.

Treating an incubating project as a vendor product

Apache KIE is still in incubation at the Apache Software Foundation, and the project notes that incubation does not necessarily reflect how complete or stable the code is. Red Hat PAM came with a commercial support contract, so teams often assume the same safety net exists. Before cutover, name who fixes a production defect in Drools, jBPM or the Kogito-based runtime, under what terms, and how quickly. Write that support plan down and get it signed off by the service owner.

Underestimating editor changes after 10.2.0

Apache KIE 10.2.0 replaced the legacy GWT-based tooling with a new BPMN editor and removed the classic BPMN and DMN editors. Analysts who learned Business Central on PAM will find their working habits no longer match the tooling. Inventory every role that edits models, then test whether each person can open, change and save an existing BPMN and DMN asset in the new editor. Budget time for retraining and for rewriting any internal style guides that reference old screens.

Assuming in-flight instances move with definitions

Deploying a new process definition does not move running process instances onto it. Instances started on the PAM runtime keep their old model and variables, and their state may not map cleanly to the new engine. Classify running instances by process, age and business criticality, and decide per class whether to let them finish on PAM, migrate them, or cancel and restart them. Test the chosen path on a copy of production data before you commit to it.

Dropping DMN behavior differences

DMN decision tables and FEEL expressions can return different results when the engine version, hit policy handling or type coercion changes. Apache KIE 10.2.0 added DMN 1.6 support, so a model that loads cleanly may still evaluate differently than it did under PAM. Build a regression set from production decisions, including boundary values, nulls and empty lists, and run the same inputs through both engines. Sign off only on matching outputs, and record every intentional difference.

Missing custom handler dependencies

Work item handlers, custom Java classes and Drools rule functions often sit in PAM-specific modules or depend on libraries that the new runtime does not bring along. These dependencies rarely appear in the BPMN file, so a model can deploy and then fail at the first call to a missing handler. Scan every project for custom handlers, global variables and imported packages, then map each to a replacement service task, REST call or Quarkus or Spring Boot bean. Confirm that the Quarkus or Spring Boot build packages each one and test every path in the integration suite.

Skipping a rollback path

A cutover without a tested return path leaves the team stuck if a defect appears after running instances have moved or new orders have started on the new runtime. Keep the PAM environment, its database and its deployed KIE Server artifacts intact until the cutover window closes. Document the exact trigger for rollback, the owner who decides it, and the steps to route new process starts back to PAM. Rehearse that rollback in a non-production environment before the production date is fixed.

How the migration differs by starting point

A small estate has a handful of BPMN processes, few or no custom work item handlers, and limited rule usage. The migration scope is mostly about re-validating models and rebuilding the deployment pipeline on Apache KIE's current runtime, not about rewriting logic. Because the asset count is low, a single engineer or a small team can usually inventory every process and decide on each one individually. The main risk is assuming a small estate is a simple one: a single process that calls an unlisted handler or depends on a Business Central form can still block a cutover.

  • Inventory: list every BPMN, DMN and rule asset, and every work item handler, with its owner and last execution date.
  • Editor change: the BPMN editor in Apache KIE 10.2.0 replaces the legacy GWT-based tooling, so confirm that models edited in Business Central still open and save cleanly.
  • Runtime choice: decide between Quarkus and Spring Boot early, since it affects packaging and the deployment pipeline.
  • Retire the old stack: plan a single cutover date with the old KIE Server still available for rollback.
  • Test coverage: run each process path with representative input data and compare outputs with production records.

Before cutover, ask your team to confirm that every asset in the inventory has a passing test and a named owner.

Questions teams ask before migrating from Red Hat PAM to Apache KIE

What does a migration from Red Hat PAM to Apache KIE cost?

The cost is mostly people time, and it splits into one-time work and recurring work. One-time costs cover assessing your jBPM processes, Drools rules and DMN models, rewriting work item handlers, changing the runtime to Quarkus or Spring Boot, building CI/CD and testing, and cutover. Recurring costs cover running the platform, patching, upgrades and any support you buy. Apache KIE itself is Apache License 2.0 software, so there is no license fee to pay, but you pay for the engineers who do the work, for infrastructure, and for whatever support model you choose. The main cost drivers are how many processes and rules you run, how much custom Java sits inside them, and how many environments you operate. Ask any implementation partner for a fixed-scope quote built from an inventory of your assets, not from a per-seat estimate.

How long does a Red Hat PAM to Apache KIE migration take?

No supplied source gives a duration, so treat any timeline as something to build from your own inventory. The main drivers are the number of BPMN processes, DMN decision models and Drools rule packages, how many of them depend on custom work item handlers or Business Central assets, how many in-flight process instances must finish or be migrated, and how many environments need to be rebuilt. A team with a small, well-documented estate will finish far sooner than one with years of undocumented rules. Start with a discovery phase that counts assets and dependencies, then plan a parallel run in a non-production environment. Ask for the timeline in a written scope with named deliverables.

What does the migration need from our internal team?

Your team needs people who know the business process and the rules, people who can read and change Java, and people who run your container and CI/CD platform. Business analysts must confirm that each BPMN model and decision table still produces the outcomes the business expects. Developers must move custom work item handlers to the new runtime and update tests. Platform engineers must build the Quarkus or Spring Boot images, deployment manifests, observability and backup routines that replace KIE Server and Business Central. Someone must own the decision on what happens to in-flight process instances. Plan for a named technical owner who can sign off each phase, since most delays come from unclear ownership rather than from code.

Can our own team migrate from Red Hat PAM to Apache KIE without a partner?

Yes, a capable team can do it, but the question is whether your team has the spare capacity and the skills in the gaps. The work is open and documented, and Apache KIE has a public release history, so there is no license barrier. The risks are skills and continuity: you need people who know jBPM, Drools and the Kogito runtime, and you need them to stay on the project through cutover and beyond. A useful test is whether two or three engineers can each explain the full path from a BPMN model to a running service in your environment. If not, a fixed-scope engagement that includes knowledge transfer and runbooks can cover the gap. Either way, document decisions as you go.

How do we run production on an incubating Apache project?

Apache KIE is still in incubation at the Apache Software Foundation. The KIE site states that incubation does not necessarily reflect the completeness or stability of the code, only that the ASF has not yet fully endorsed the project. In practice, this means you own more of the risk: there is no vendor commitment to patch timelines or support SLAs unless you buy them elsewhere. Mitigate this by pinning versions, reading each release post, running your own regression suite for every BPMN, DMN and rule asset, keeping a tested upgrade path, and monitoring the project's issue tracker and mailing lists. Decide early who will triage security advisories and approve upgrades. Confirm with any support provider exactly which versions and components they will cover.

Which BPMN, DMN and rule assets move cleanly to Apache KIE?

Assets that use standard BPMN 2.0 and DMN models with few vendor extensions usually move with the least work, because the modeling standard is shared. Apache KIE 10.2.0 added DMN 1.6 support and Java 21 support, and it replaced the classic BPMN and DMN editors with a new BPMN editor, so you should test models in the new editor before relying on them. Drools rules that are plain Java-compatible rule files and DRL usually need the least change, but any rules that depend on older Drools behavior, custom functions or Business Central-only artifacts need individual testing. Assets with custom work item handlers, Java-heavy scripts, or dependencies on KIE Server APIs need the most attention. Test the highest-value and most-used assets first.

What does cutover look like, and what happens to running process instances?

A safe cutover runs old and new platforms side by side for a defined period, with traffic moved in stages and a rollback path kept until the new platform proves stable. Decide first what happens to in-flight process instances: you can let them finish on the old runtime, or you can migrate their state, which needs a tested, scripted approach and a rehearsal in a non-production environment. Confirm that audit logs, task histories and any monitoring used for regulatory evidence are preserved or archived in a readable form. Define go and no-go criteria in writing, rehearse the switch at least once, and keep the old environment in read-only mode for an agreed retention window.

How should we handle security and audit evidence during the move?

Treat the new runtime as a new system for security purposes. Rebuild images from pinned versions, scan dependencies, restrict access to the process and rule management interfaces that Business Central used to provide, and set up authentication and role mapping for task users. Keep audit trails for process changes, rule changes and deployments, because regulators and internal auditors will ask how each decision was made. Document controls so an assessor can trace them, and ask your compliance team which evidence they will need. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors and certification bodies issue the audit reports and attestations.

How DeployOpen scopes, runs and supports the migration

DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and that includes moving Red Hat PAM 7 processes and rules to Apache KIE. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

  • We inventory your jBPM BPMN models, Drools rules, DMN decision tables and work item handlers before agreeing on a scope.
  • The written scope lists which assets move, which are retired, and which run in parallel during cutover.
  • We confirm with you which in-flight process instances must finish on PAM 7 and which can be migrated or drained.
  • Scope also records your target runtime, Quarkus or Spring Boot, and the Java version your platform team supports.

How we build

  • We rebuild the runtime on Apache KIE 10 and re-validate each BPMN and DMN asset against the new engine and editor.
  • Work item handlers are replaced with equivalent service integrations, and each replacement is tested against its original behavior.
  • We set up the build, container images, configuration and secrets handling in your own cloud accounts or data centers.
  • Security testing of the migrated APIs and process endpoints runs before any production traffic moves across.

How we hand over

  • Deliverables include the migration inventory, test evidence, architecture notes and runbooks for deploying and rolling back.
  • Your team receives documentation for the Kogito-based runtime, including how KIE Server and Business Central functions map to it.
  • We document the incubating status of Apache KIE and the upgrade path your team should expect to follow.
  • Knowledge transfer sessions cover operating the platform, with your staff confirming they can run it independently.

How we support

  • Ongoing support, upgrades and continuous testing are available as a retainer after handover.
  • A retainer can cover tracking new Apache KIE releases, such as the 10.x line, and testing them before you adopt them.
  • Ask in the quote what response arrangements apply, since these depend on the agreed scope and retainer terms.
  • We prepare control evidence for your compliance assessments, while independent auditors issue any formal opinion.

Talk to our team.

Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.

  • 30-minute call: free, with no obligation.
  • NDA on request: we can sign before you share details.
  • Clear next steps: a scope and plan after the call.