Skip to content

Commit fa33ef3

Browse files
JSticklerJStickler
authored
Merge pull request #40993 from rolfedh/RHDEVDOCS-3631
RHDEVDOCS-3631 Verify that builds work with RHEL subscriptions
2 parents e2f2120 + 252247c commit fa33ef3

File tree

2 files changed

+213
-0
lines changed

2 files changed

+213
-0
lines changed

‎cicd/builds/running-entitled-builds.adoc‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,16 @@ include::modules/builds-source-input-satellite-config.adoc[leveloffset=+2]
2222

2323
include::modules/builds-strategy-docker-entitled-satellite.adoc[leveloffset=+2]
2424

25+
// Beginning of "Running entitled builds with SharedSecret objects" section
26+
27+
include::modules/builds-running-entitled-builds-with-sharedsecret-objects.adoc[leveloffset=+1]
28+
29+
// End of "Running entitled builds with SharedSecret objects" section
30+
2531
[role="_additional-resources"]
2632
== Additional resources
2733

34+
* xref:../../support/remote_health_monitoring/insights-operator-simple-access.adoc#insights-operator-simple-access[Importing simple content access certificates with Insights Operator]
35+
* xref:../../nodes/clusters/nodes-cluster-enabling-features.adoc[Enabling features using feature gates]
2836
* xref:../../openshift_images/image-streams-manage.adoc#image-streams-managing[Managing image streams]
2937
* xref:../../cicd/builds/build-strategies.adoc#build-strategies[build strategy]

‎modules/builds-running-entitled-builds-with-sharedsecret-objects.adoc‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
// Used in cicd/builds/running-entitled-builds.adoc
2+
3+
[id="builds-running-entitled-builds-with-sharedsecret-objects_{context}"]
4+
= Running entitled builds using SharedSecret objects
5+
6+
[role="_abstract"]
7+
You can configure and perform a build in one namespace that securely uses RHEL entitlements from a `Secret` object in another namespace.
8+
9+
You can still access RHEL entitlements from OpenShift Builds by creating a `Secret` object with your subscription credentials in the same namespace as your `Build` object. However, now, in {product-title} 4.10 and later, you can access your credentials and certificates from a `Secret` object in one of the {product-title} system namespaces. You run entitled builds with a CSI volume mount of a `SharedSecret` custom resource (CR) instance that references the `Secret` object.
10+
11+
This procedure relies on the newly introduced Shared Resources CSI Driver feature, which you can use to declare CSI Volume mounts in {product-title} Builds. It also relies on the {product-title} Insights Operator.
12+
13+
[IMPORTANT]
14+
====
15+
[subs="attributes+"]
16+
The Shared Resources CSI Driver and The Build CSI Volumes are both Technology Preview features, which are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.
17+
18+
For more information about the support scope of Red Hat Technology Preview
19+
features, see https://access.redhat.com/support/offerings/techpreview/.
20+
21+
The Shared Resources CSI Driver and the Build CSI Volumes features also belong to the `TechPreviewNoUpgrade` feature set, which is a subset of the current Technology Preview features. You can enable the `TechPreviewNoUpgrade` feature set on test clusters, where you can fully test them while leaving the features disabled on production clusters. Enabling this feature set cannot be undone and prevents updates. This feature set is not recommended on production clusters. See "Enabling Technology Preview features using feature gates" in the following "Additional resources" section.
22+
====
23+
24+
.Prerequisites
25+
26+
* You have enabled the `TechPreviewNoUpgrade` feature set by using the feature gates.
27+
* You have a `SharedSecret` custom resource (CR) instance that references the `Secret` object where the Insights Operator stores the subscription credentials.
28+
* You must have permission to perform the following actions:
29+
** Create build configs and start builds.
30+
** Discover which `SharedSecret` CR instances are available by entering the `oc get sharedsecrets` command and getting a non-empty list back.
31+
** Determine if the `builder` service account available to you in your namespace is allowed to use the given `SharedSecret` CR instance. In other words, you can run `oc adm policy who-can use <identifier of specific SharedSecret>` to see if the `builder` service account in your namespace is listed.
32+
33+
[NOTE]
34+
====
35+
If neither of the last two prerequisites in this list are met, establish, or ask someone to establish, the necessary role-based access control (RBAC) so that you can discover `SharedSecret` CR instances and enable service accounts to use `SharedSecret` CR instances.
36+
====
37+
38+
.Procedure
39+
40+
. Grant the `builder` service account RBAC permissions to use the `SharedSecret` CR instance by using `oc apply` with YAML content:
41+
+
42+
[NOTE]
43+
====
44+
Currently, `kubectl` and `oc` have hard-coded special case logic restricting the `use` verb to roles centered around pod security. Therefore, you cannot use `oc create role ...` to create the role needed for consuming `SharedSecret` CR instances.
45+
====
46+
+
47+
.Example `oc apply -f` command with YAML `Role` object definition
48+
[source,terminal]
49+
----
50+
$ oc apply -f - <<EOF
51+
apiVersion: rbac.authorization.k8s.io/v1
52+
kind: Role
53+
metadata:
54+
name: shared-resource-my-share
55+
namespace: my-namespace
56+
rules:
57+
- apiGroups:
58+
- sharedresource.openshift.io
59+
resources:
60+
- sharedsecrets
61+
resourceNames:
62+
- my-share
63+
verbs:
64+
- use
65+
EOF
66+
----
67+
68+
. Create the `RoleBinding` associated with the role by using the `oc` command:
69+
+
70+
.Example `oc create rolebinding` command
71+
[source,terminal]
72+
----
73+
$ oc create rolebinding shared-resource-my-share --role=shared-resource-my-share --serviceaccount=my-namespace:builder
74+
----
75+
76+
. Create a `BuildConfig` object that accesses the RHEL entitlements.
77+
+
78+
.Example YAML `BuildConfig` object definition
79+
[source,yaml]
80+
----
81+
apiVersion: build.openshift.io/v1
82+
kind: BuildConfig
83+
metadata:
84+
name: my-csi-bc
85+
namespace: my-csi-app-namespace
86+
spec:
87+
runPolicy: Serial
88+
source:
89+
dockerfile: |
90+
FROM registry.redhat.io/ubi8/ubi:latest
91+
RUN ls -la /etc/pki/entitlement
92+
RUN rm /etc/rhsm-host
93+
RUN yum repolist --disablerepo=*
94+
RUN subscription-manager repos --enable rhocp-4.9-for-rhel-8-x86_64-rpms
95+
RUN yum -y update
96+
RUN yum install -y openshift-clients.x86_64
97+
strategy:
98+
type: Docker
99+
dockerStrategy:
100+
volumes:
101+
- mounts:
102+
- destinationPath: "/etc/pki/entitlement"
103+
name: my-csi-shared-secret
104+
source:
105+
csi:
106+
driver: csi.sharedresource.openshift.io
107+
readOnly: true
108+
volumeAttributes:
109+
sharedSecret: my-share-bc
110+
type: CSI
111+
----
112+
113+
. Start a build from the `BuildConfig` object and follow the logs with the `oc` command.
114+
+
115+
.Example oc start-build command
116+
[source,terminal]
117+
----
118+
$ oc start-build my-csi-bc -F
119+
----
120+
+
121+
.Example output from the oc start-build command
122+
[%collapsible]
123+
====
124+
[NOTE]
125+
=====
126+
Some sections of the following output have been replaced with `...`
127+
=====
128+
[source,terminal]
129+
----
130+
build.build.openshift.io/my-csi-bc-1 started
131+
Caching blobs under "/var/cache/blobs".
132+
133+
Pulling image registry.redhat.io/ubi8/ubi:latest ...
134+
Trying to pull registry.redhat.io/ubi8/ubi:latest...
135+
Getting image source signatures
136+
Copying blob sha256:5dcbdc60ea6b60326f98e2b49d6ebcb7771df4b70c6297ddf2d7dede6692df6e
137+
Copying blob sha256:8671113e1c57d3106acaef2383f9bbfe1c45a26eacb03ec82786a494e15956c3
138+
Copying config sha256:b81e86a2cb9a001916dc4697d7ed4777a60f757f0b8dcc2c4d8df42f2f7edb3a
139+
Writing manifest to image destination
140+
Storing signatures
141+
Adding transient rw bind mount for /run/secrets/rhsm
142+
STEP 1/9: FROM registry.redhat.io/ubi8/ubi:latest
143+
STEP 2/9: RUN ls -la /etc/pki/entitlement
144+
total 360
145+
drwxrwxrwt. 2 root root 80 Feb 3 20:28 .
146+
drwxr-xr-x. 10 root root 154 Jan 27 15:53 ..
147+
-rw-r--r--. 1 root root 3243 Feb 3 20:28 entitlement-key.pem
148+
-rw-r--r--. 1 root root 362540 Feb 3 20:28 entitlement.pem
149+
time="2022-02-03T20:28:32Z" level=warning msg="Adding metacopy option, configured globally"
150+
--> 1ef7c6d8c1a
151+
STEP 3/9: RUN rm /etc/rhsm-host
152+
time="2022-02-03T20:28:33Z" level=warning msg="Adding metacopy option, configured globally"
153+
--> b1c61f88b39
154+
STEP 4/9: RUN yum repolist --disablerepo=*
155+
Updating Subscription Management repositories.
156+
157+
158+
...
159+
160+
--> b067f1d63eb
161+
STEP 5/9: RUN subscription-manager repos --enable rhocp-4.9-for-rhel-8-x86_64-rpms
162+
Repository 'rhocp-4.9-for-rhel-8-x86_64-rpms' is enabled for this system.
163+
time="2022-02-03T20:28:40Z" level=warning msg="Adding metacopy option, configured globally"
164+
--> 03927607ebd
165+
STEP 6/9: RUN yum -y update
166+
Updating Subscription Management repositories.
167+
168+
...
169+
170+
Upgraded:
171+
systemd-239-51.el8_5.3.x86_64 systemd-libs-239-51.el8_5.3.x86_64
172+
systemd-pam-239-51.el8_5.3.x86_64
173+
Installed:
174+
diffutils-3.6-6.el8.x86_64 libxkbcommon-0.9.1-1.el8.x86_64
175+
xkeyboard-config-2.28-1.el8.noarch
176+
177+
Complete!
178+
time="2022-02-03T20:29:05Z" level=warning msg="Adding metacopy option, configured globally"
179+
--> db57e92ff63
180+
STEP 7/9: RUN yum install -y openshift-clients.x86_64
181+
Updating Subscription Management repositories.
182+
183+
...
184+
185+
Installed:
186+
bash-completion-1:2.7-5.el8.noarch
187+
libpkgconf-1.4.2-1.el8.x86_64
188+
openshift-clients-4.9.0-202201211735.p0.g3f16530.assembly.stream.el8.x86_64
189+
pkgconf-1.4.2-1.el8.x86_64
190+
pkgconf-m4-1.4.2-1.el8.noarch
191+
pkgconf-pkg-config-1.4.2-1.el8.x86_64
192+
193+
Complete!
194+
time="2022-02-03T20:29:19Z" level=warning msg="Adding metacopy option, configured globally"
195+
--> 609507b059e
196+
STEP 8/9: ENV "OPENSHIFT_BUILD_NAME"="my-csi-bc-1" "OPENSHIFT_BUILD_NAMESPACE"="my-csi-app-namespace"
197+
--> cab2da3efc4
198+
STEP 9/9: LABEL "io.openshift.build.name"="my-csi-bc-1" "io.openshift.build.namespace"="my-csi-app-namespace"
199+
COMMIT temp.builder.openshift.io/my-csi-app-namespace/my-csi-bc-1:edfe12ca
200+
--> 821b582320b
201+
Successfully tagged temp.builder.openshift.io/my-csi-app-namespace/my-csi-bc-1:edfe12ca
202+
821b582320b41f1d7bab4001395133f86fa9cc99cc0b2b64c5a53f2b6750db91
203+
Build complete, no image push requested
204+
----
205+
====

0 commit comments

Comments
 (0)