Using Red Hat subscriptions in builds

Use the following sections to run entitled builds on OKD.

Creating an image stream tag for the Red Hat Universal Base Image

To use Red Hat subscriptions within a build, you create an image stream tag to reference the Universal Base Image (UBI).

To make the UBI available in every project in the cluster, you add the image stream tag to the openshift namespace. Otherwise, to make it available in a specific project, you add the image stream tag to that project.

The benefit of using image stream tags this way is that doing so grants access to the UBI based on the registry.redhat.io credentials in the install pull secret without exposing the pull secret to other users. This is more convenient than requiring each developer to install pull secrets with registry.redhat.io credentials in each project.

Procedure

  • To create an ImageStreamTag in the openshift namespace, so it is available to developers in all projects, enter:

    1. $ oc tag --source=docker registry.redhat.io/ubi7/ubi:latest ubi:latest -n openshift

  • To create an ImageStreamTag in a single project, enter:

    1. $ oc tag --source=docker registry.redhat.io/ubi7/ubi:latest ubi:latest

Adding subscription entitlements as a build secret

Builds that use Red Hat subscriptions to install content must include the entitlement keys as a build secret.

Prerequisites

You must have access to Red Hat entitlements through your subscription, and the entitlements must have separate public and private key files.

Procedure

  1. Create a secret containing your entitlements, ensuring that there are separate files containing the public and private keys:

    1. $  oc create secret generic etc-pki-entitlement --from-file /path/to/entitlement/{ID}.pem \
    2. > --from-file /path/to/entitlement/{ID}-key.pem ...

  2. Add the secret as a build input in the build configuration:

    1. source:
    2.   secrets:
    3.   - secret:
    4.       name: etc-pki-entitlement
    5.     destinationDir: etc-pki-entitlement

Running builds with Subscription Manager

Docker builds using Subscription Manager

Docker strategy builds can use the Subscription Manager to install subscription content.

Prerequisites

The entitlement keys, subscription manager configuration, and subscription manager certificate authority must be added as build inputs.

Procedure

Use the following as an example Dockerfile to install content with the Subscription Manager:

  1. FROM registry.redhat.io/rhel7:latest
  2. USER root
  3. # Copy entitlements
  4. COPY ./etc-pki-entitlement /etc/pki/entitlement
  5. # Copy subscription manager configurations
  6. COPY ./rhsm-conf /etc/rhsm
  7. COPY ./rhsm-ca /etc/rhsm/ca
  8. # Delete /etc/rhsm-host to use entitlements from the build container
  9. RUN rm /etc/rhsm-host && \
  10.     # Initialize /etc/yum.repos.d/redhat.repo
  11.     # See https://access.redhat.com/solutions/1443553
  12.     yum repolist --disablerepo=* && \
  13.     subscription-manager repos --enable <enabled-repo> && \
  14.     yum -y update && \
  15.     yum -y install <rpms> && \
  16.     # Remove entitlements and Subscription Manager configs
  17.     rm -rf /etc/pki/entitlement && \
  18.     rm -rf /etc/rhsm
  19. # OpenShift requires images to run as non-root by default
  20. USER 1001
  21. ENTRYPOINT ["/bin/bash"]

Running builds with Red Hat Satellite subscriptions

Adding Red Hat Satellite configurations to builds

Builds that use Red Hat Satellite to install content must provide appropriate configurations to obtain content from Satellite repositories.

Prerequisites

  • You must provide or create a yum-compatible repository configuration file that downloads content from your Satellite instance.

    Sample repository configuration

    1. [test-<name>]
    2.  name=test-<number>
    3.  baseurl = https://satellite.../content/dist/rhel/server/7/7Server/x86_64/os
    4.  enabled=1
    5.  gpgcheck=0
    6.  sslverify=0
    7.  sslclientkey = /etc/pki/entitlement/...-key.pem
    8.  sslclientcert = /etc/pki/entitlement/....pem

Procedure

  1. Create a ConfigMap containing the Satellite repository configuration file:

    1. $ oc create configmap yum-repos-d --from-file /path/to/satellite.repo

  2. Add the Satellite repository configuration to the BuildConfig:

    1. source:
    2.     configMaps:
    3.     - configMap:
    4.         name: yum-repos-d
    5.       destinationDir: yum.repos.d

Docker builds using Red Hat Satellite subscriptions

Docker strategy builds can use Red Hat Satellite repositories to install subscription content.

Prerequisites

  • The entitlement keys and Satellite repository configurations must be added as build inputs.

Procedure

Use the following as an example Dockerfile to install content with Satellite:

  1. FROM registry.redhat.io/rhel7:latest
  2. USER root
  3. # Copy entitlements
  4. COPY ./etc-pki-entitlement /etc/pki/entitlement
  5. # Copy repository configuration
  6. COPY ./yum.repos.d /etc/yum.repos.d
  7. # Delete /etc/rhsm-host to use entitlements from the build container
  8. RUN sed -i".org" -e "s#^enabled=1#enabled=0#g" /etc/yum/pluginconf.d/subscription-manager.conf (1)
  9. #RUN cat /etc/yum/pluginconf.d/subscription-manager.conf
  10. RUN yum clean all
  11. #RUN yum-config-manager
  12. RUN rm /etc/rhsm-host && \
  13.     # yum repository info provided by Satellite
  14.     yum -y update && \
  15.     yum -y install <rpms> && \
  16.     # Remove entitlements
  17.     rm -rf /etc/pki/entitlement
  18. # OpenShift requires images to run as non-root by default
  19. USER 1001
  20. ENTRYPOINT ["/bin/bash"]
1If adding Satellite configurations to builds using enabled=1 fails, add RUN sed -i”.org” -e “s#^enabled=1#enabled=0#g” /etc/yum/pluginconf.d/subscription-manager.conf to the Dockerfile.

Additional resources