Skip to content

Commit 2462007

Browse files
committed
RHOAIENG-21668: chore(gha): mount Red Hat subscription in GitHub Actions
Here's how this is supposed to work. On a subscribed machine, podman mounts the secrets directory into the container as a volume. ``` $ cat /usr/share/containers/mounts.conf /usr/share/rhel/secrets:/run/secrets ``` Furthermore, there may be ``/run/secrets/etc-pki-entitlement` and ``/run/secrets/rhsm`. The approach that actually worked for me is https://access.redhat.com/solutions/5558771 First, `subscription-manager` detects a container and behaves differently there. So, run `subscription-manager` with `SMDEV_CONTAINER_OFF=1` to subscribe container as if it was a physical machine. Then, look into `/etc/pki/entitlement` for certificates as suggested in https://grep.be/blog//en/work/The_future_of_the_eID_on_RHEL/ ``` podman run --platform=linux/amd64 -v/Users/jdanek/IdeaProjects/notebooks/ci/secrets/run/secrets:/mnt --rm -it registry.access.redhat.com/ubi9/ubi 1 subscription-manager register --username 3 cp -R /etc/pki/entitlement /mnt/etc-pki-entitlement 5 cp -R /etc/rhsm /mnt/rhsm 7 cp /etc/yum.repos.d/redhat.repo /mnt/redhat.repo ``` Finally, copy out and store the certificates as CI secrets for reuse in jobs.
1 parent 2dd49c8 commit 2462007

File tree

1 file changed

+5
-0
lines changed

1 file changed

+5
-0
lines changed

ci/cached-builds/mounts.conf

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# /usr/share/containers/mounts.conf
2+
# https://github.com/containers/common/issues/1735
3+
4+
/etc/pki/consumer:/etc/pki/consumer
5+
/etc/pki/entitlement:/etc/pki/entitlement

0 commit comments

Comments
 (0)