You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/builds-create-imagestreamtag.adoc
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,19 +6,19 @@
6
6
[id="builds-create-imagestreamtag_{context}"]
7
7
= Creating an image stream tag for the Red Hat Universal Base Image
8
8
9
-
To use Red Hat subscriptions within a build, you create an image stream tag to reference the Universal Base Image (UBI).
9
+
To install {op-system-base-full} packages within a build, you can create an image stream tag to reference the Red Hat Universal Base Image (UBI).
10
10
11
-
To make the UBI available *in every project* in the cluster, you add the image stream tag to the `openshift` namespace. Otherwise, to make it available *in a specific project*, you add the image stream tag to that project.
11
+
To make the UBI available *in every project* in the cluster, add the image stream tag to the `openshift` namespace. Otherwise, to make it available *in a specific project*, add the image stream tag to that project.
12
12
13
-
The benefit of using image stream tags this way is that doing so grants access to the UBI based on the `registry.redhat.io` credentials in the install pull secret without exposing the pull secret to other users. This is more convenient than requiring each developer to install pull secrets with `registry.redhat.io` credentials in each project.
13
+
Image stream tags grant access to the UBI by using the `registry.redhat.io` credentials that are present in the install pull secret, without exposing the pull secret to other users. This method is more convenient than requiring each developer to install pull secrets with `registry.redhat.io` credentials in each project.
14
14
15
15
.Procedure
16
16
17
17
* To create an `ImageStreamTag` in the `openshift` namespace, so it is available to developers in all projects, enter:
18
18
+
19
19
[source,terminal]
20
20
----
21
-
$ oc tag --source=docker registry.redhat.io/ubi9/ubi:latest ubi:latest -n openshift
21
+
$ oc tag --source=docker registry.redhat.io/ubi9/ubi:latest ubi9:latest -n openshift
22
22
----
23
23
+
24
24
[TIP]
@@ -29,7 +29,7 @@ You can alternatively apply the following YAML to create an `ImageStreamTag` in
29
29
apiVersion: image.openshift.io/v1
30
30
kind: ImageStream
31
31
metadata:
32
-
name: ubi
32
+
name: ubi9
33
33
namespace: openshift
34
34
spec:
35
35
tags:
@@ -57,7 +57,7 @@ You can alternatively apply the following YAML to create an `ImageStreamTag` in
= Running entitled builds using SharedSecret objects
3
+
= Running builds using SharedSecret objects
4
4
5
-
You can configure and perform a build in one namespace that securely uses RHEL entitlements from a `Secret` object in another namespace.
5
+
You can use a `SharedSecret` object to securely access the entitlement keys of a cluster in builds.
6
6
7
-
You can still access RHEL entitlements from OpenShift Builds by creating a `Secret` object with your subscription credentials in the same namespace as your `Build` object. However, now, in {product-title} 4.10 and later, you can access your credentials and certificates from a `Secret` object in one of the {product-title} system namespaces. You run entitled builds with a CSI volume mount of a `SharedSecret` custom resource (CR) instance that references the `Secret` object.
7
+
The `SharedSecret` object allows you to share and synchronize secrets across namespaces.
8
8
9
-
This procedure relies on the newly introduced Shared Resources CSI Driver feature, which you can use to declare CSI Volume mounts in {product-title} Builds. It also relies on the {product-title} Insights Operator.
10
-
11
-
:FeatureName: Managing machines with the Cluster API
9
+
:FeatureName: Shared Resource CSI Driver
12
10
include::snippets/technology-preview.adoc[]
13
11
14
-
The Shared Resources CSI Driver feature also belongs to the `TechPreviewNoUpgrade` feature set, which is a subset of the current Technology Preview features. You can enable the `TechPreviewNoUpgrade` feature set on test clusters, where you can fully test them while leaving the features disabled on production clusters. Enabling this feature set cannot be undone and prevents minor version updates. This feature set is not recommended on production clusters. See "Enabling Technology Preview features using feature gates" in the following "Additional resources" section.
15
-
16
12
.Prerequisites
17
13
18
-
* You have enabled the `TechPreviewNoUpgrade` feature set by using the feature gates.
19
-
* You have a `SharedSecret` custom resource (CR) instance that references the `Secret` object where the Insights Operator stores the subscription credentials.
14
+
* You have enabled the `TechPreviewNoUpgrade` feature set by using the feature gates. For more information, see xref:../../nodes/clusters/nodes-cluster-enabling-features.adoc#nodes-cluster-enabling[Enabling features using feature gates].
20
15
* You must have permission to perform the following actions:
21
16
** Create build configs and start builds.
22
17
** Discover which `SharedSecret` CR instances are available by entering the `oc get sharedsecrets` command and getting a non-empty list back.
@@ -29,169 +24,105 @@ If neither of the last two prerequisites in this list are met, establish, or ask
29
24
30
25
.Procedure
31
26
32
-
. Grant the `builder` service account RBAC permissions to use the`SharedSecret`CR instance by using `oc apply` with YAML content:
27
+
. Use `oc apply`to create a`SharedSecret`object instance with the cluster's entitlement secret.
33
28
+
34
-
[NOTE]
29
+
[IMPORTANT]
35
30
====
36
-
Currently, `kubectl` and `oc`have hard-coded special case logic restricting the `use` verb to roles centered around pod security. Therefore, you cannot use `oc create role ...` to create the role needed for consuming `SharedSecret`CR instances.
31
+
You must have cluster administrator permissions to create `SharedSecret`objects.
37
32
====
38
33
+
39
34
.Example `oc apply -f` command with YAML `Role` object definition
40
35
[source,terminal]
41
36
----
42
37
$ oc apply -f - <<EOF
38
+
kind: SharedSecret
39
+
apiVersion: sharedresource.openshift.io/v1alpha1
40
+
metadata:
41
+
name: etc-pki-entitlement
42
+
spec:
43
+
secretRef:
44
+
name: etc-pki-entitlement
45
+
namespace: openshift-config-managed
46
+
EOF
47
+
----
48
+
49
+
. Create a role to grant the `builder` service account permission to access the `SharedSecret` object:
50
+
+
51
+
.Example `oc apply -f` command
52
+
[source,terminal]
53
+
----
54
+
$ oc apply -f - <<EOF
43
55
apiVersion: rbac.authorization.k8s.io/v1
44
56
kind: Role
45
57
metadata:
46
-
name: shared-resource-my-share
47
-
namespace: my-namespace
58
+
name: builder-etc-pki-entitlement
59
+
namespace: build-namespace
48
60
rules:
49
61
- apiGroups:
50
62
- sharedresource.openshift.io
51
63
resources:
52
64
- sharedsecrets
53
65
resourceNames:
54
-
- my-share
66
+
- etc-pki-entitlement
55
67
verbs:
56
68
- use
57
69
EOF
58
70
----
59
71
60
-
. Create the`RoleBinding`associated with the role by using the `oc` command:
72
+
. Create a`RoleBinding`object that grants the `builder` service account permission to access the `SharedSecret` object by running the following command:
. Create a `BuildConfig` object that accesses the RHEL entitlements.
80
+
. Add the entitlement secret to your `BuildConfig` object by using a CSI volume mount:
69
81
+
70
82
.Example YAML `BuildConfig` object definition
71
83
[source,yaml]
72
84
----
73
85
apiVersion: build.openshift.io/v1
74
86
kind: BuildConfig
75
87
metadata:
76
-
name: my-csi-bc
77
-
namespace: my-csi-app-namespace
88
+
name: uid-wrapper-rhel9
89
+
namespace: build-namespace
78
90
spec:
79
91
runPolicy: Serial
80
92
source:
81
93
dockerfile: |
82
94
FROM registry.redhat.io/ubi9/ubi:latest
83
-
RUN ls -la /etc/pki/entitlement
84
-
RUN rm /etc/rhsm-host
85
-
RUN yum repolist --disablerepo=*
86
-
RUN subscription-manager repos --enable rhocp-4.9-for-rhel-8-x86_64-rpms
87
-
RUN yum -y update
88
-
RUN yum install -y openshift-clients.x86_64
95
+
RUN rm -rf /etc/rhsm-host <1>
96
+
RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \ <2>
97
+
nss_wrapper \
98
+
uid_wrapper -y && \
99
+
yum clean all -y
100
+
RUN ln -s /run/secrets/rhsm /etc/rhsm-host <3>
89
101
strategy:
90
102
type: Docker
91
103
dockerStrategy:
92
104
volumes:
93
105
- mounts:
94
106
- destinationPath: "/etc/pki/entitlement"
95
-
name: my-csi-shared-secret
107
+
name: etc-pki-entitlement
96
108
source:
97
109
csi:
98
110
driver: csi.sharedresource.openshift.io
99
-
readOnly: true
111
+
readOnly: true <4>
100
112
volumeAttributes:
101
-
sharedSecret: my-share-bc
113
+
sharedSecret: etc-pki-entitlement <5>
102
114
type: CSI
103
115
----
104
-
105
-
. Start a build from the `BuildConfig` object and follow the logs with the `oc` command.
106
116
+
107
-
.Example oc start-build command
108
-
[source,terminal]
109
-
----
110
-
$ oc start-build my-csi-bc -F
111
-
----
117
+
<1> You must include the command to remove the `/etc/rhsm-host` directory and all its contents in the Dockerfile before executing any `yum` or `dnf` commands.
118
+
<2> Use the link:https://access.redhat.com/downloads/content/package-browser[Red Hat Package Browser] to find the correct repositories for your installed packages.
119
+
<3> You must restore the `/etc/rhsm-host` symbolic link to keep your image compatible with other Red Hat container images.
120
+
<4> You must set `readOnly` to `true` to mount the shared resource in the build.
121
+
<5> Reference the name of the `SharedSecret` object to include it in the build.
122
+
123
+
. Start a build from the `BuildConfig` object and follow the logs using the `oc` command.
112
124
+
113
-
.Example output from the oc start-build command
114
-
[%collapsible]
115
-
====
116
-
[NOTE]
117
-
=====
118
-
Some sections of the following output have been replaced with `...`
Copy file name to clipboardExpand all lines: modules/builds-source-secrets-entitlements.adoc
+20-8Lines changed: 20 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,20 +10,32 @@ Builds that use Red Hat subscriptions to install content must include the entitl
10
10
11
11
.Prerequisites
12
12
13
-
You must have access to Red Hat entitlements through your subscription. The entitlement secret is automatically created by the Insights Operator.
13
+
You must have access to {op-system-base-full} package repositories through your subscription.
14
14
15
+
The entitlement secret to access these repositories is automatically created by the Insights Operator when your cluster is subscribed.
15
16
16
-
[TIP]
17
+
[IMPORTANT]
17
18
====
18
-
When you perform an Entitlement Build using {op-system-base-full} 7, you must have the following instructions in your Dockerfile before you run any `yum` commands:
19
+
You must be a cluster administrator or have permission to access secrets in the `openshift-config-managed` project.
20
+
====
21
+
22
+
.Procedure
19
23
24
+
. Copy the entitlement secret from the `openshift-config-managed` namespace to the build's namespace:
Copy file name to clipboardExpand all lines: modules/builds-strategy-docker-entitled-satellite.adoc
+9-2Lines changed: 9 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,13 @@ Use the following as an example Dockerfile to install content with Satellite:
18
18
[source,terminal]
19
19
----
20
20
FROM registry.redhat.io/ubi9/ubi:latest
21
-
RUN dnf search kernel-devel --showduplicates && \
22
-
dnf install -y kernel-devel
21
+
RUN rm -rf /etc/rhsm-host <1>
22
+
RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \ <2>
23
+
nss_wrapper \
24
+
uid_wrapper -y && \
25
+
yum clean all -y
26
+
RUN ln -s /run/secrets/rhsm /etc/rhsm-host <3>
23
27
----
28
+
<1> You must include the command to remove the `/etc/rhsm-host` directory and all its contents in your Dockerfile before executing any `yum` or `dnf` commands.
29
+
<2> Contact your Satellite system administrator to find the correct repositories for the build's installed packages.
30
+
<3> You must restore the `/etc/rhsm-host` symbolic link to keep your image compatible with other Red Hat container images.
Docker strategy builds can use the Subscription Manager to install subscription content.
9
+
Docker strategy builds can use `yum` or `dnf` to install additional {op-system-base-full} packages.
10
10
11
11
.Prerequisites
12
12
@@ -19,6 +19,13 @@ Use the following as an example Dockerfile to install content with the Subscript
19
19
[source,terminal]
20
20
----
21
21
FROM registry.redhat.io/ubi9/ubi:latest
22
-
RUN dnf search kernel-devel --showduplicates && \
23
-
dnf install -y kernel-devel
22
+
RUN rm -rf /etc/rhsm-host <1>
23
+
RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \ <2>
24
+
nss_wrapper \
25
+
uid_wrapper -y && \
26
+
yum clean all -y
27
+
RUN ln -s /run/secrets/rhsm /etc/rhsm-host <3>
24
28
----
29
+
<1> You must include the command to remove the `/etc/rhsm-host` directory and all its contents in your Dockerfile before executing any `yum` or `dnf` commands.
30
+
<2> Use the link:https://access.redhat.com/downloads/content/package-browser[Red Hat Package Browser] to find the correct repositories for your installed packages.
31
+
<3> You must restore the `/etc/rhsm-host` symbolic link to keep your image compatible with other Red Hat container images.
0 commit comments