Red Hat Summit Red Hat SummitSupportKonsoleEntwicklerDemo startenKontakt

Dieser Inhalt ist in der von Ihnen ausgewählten Sprache nicht verfügbar.

Chapter 10. Using Red Hat subscriptions in builds

Use the following sections to install Red Hat subscription content within OpenShift Container Platform builds.

10.1. Creating an image stream tag for the Red Hat Universal Base Image
Link kopieren

To install Red Hat Enterprise Linux (RHEL) packages within a build, you can create an image stream tag to reference the Red Hat Universal Base Image (UBI).

To make the UBI available in every project in the cluster, add the image stream tag to the 

openshift
namespace. Otherwise, to make it available in a specific project, add the image stream tag to that project.

Image stream tags grant access to the UBI by using the 

registry.redhat.io
credentials that are present in the install pull secret, without exposing the pull secret to other users. This method is more convenient than requiring each developer to install pull secrets with 
registry.redhat.io
credentials in each project.

Procedure

  • To create an 

    ImageStreamTag
    in the 
    openshift
    namespace, so it is available to developers in all projects, enter: 

    $ oc tag --source=docker registry.redhat.io/ubi9/ubi:latest ubi9:latest -n openshift
    Tip

    You can alternatively apply the following YAML to create an 

    ImageStreamTag
    in the 
    openshift
    namespace: 

    apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: ubi9
  namespace: openshift
spec:
  tags:
  - from:
      kind: DockerImage
      name: registry.redhat.io/ubi9/ubi:latest
    name: latest
    referencePolicy:
      type: Source

  • To create an 

    ImageStreamTag
    in a single project, enter: 

    $ oc tag --source=docker registry.redhat.io/ubi9/ubi:latest ubi:latest
    Tip

    You can alternatively apply the following YAML to create an 

    ImageStreamTag
    in a single project: 

    apiVersion: image.openshift.io/v1
kind: ImageStream
metadata:
  name: ubi9
spec:
  tags:
  - from:
      kind: DockerImage
      name: registry.redhat.io/ubi9/ubi:latest
    name: latest
    referencePolicy:
      type: Source

10.2. Adding subscription entitlements as a build secret
Link kopieren

Builds that use Red Hat subscriptions to install content must include the entitlement keys as a build secret.

Prerequisites

You must have access to Red Hat Enterprise Linux (RHEL) package repositories through your subscription.

The entitlement secret to access these repositories is automatically created by the Insights Operator when your cluster is subscribed.

Important

You must be a cluster administrator or have permission to access secrets in the 

openshift-config-managed
project.

Procedure

  1. Copy the entitlement secret from the 

    openshift-config-managed
    namespace to the build’s namespace: 

    $ cat << EOF > secret-template.txt
kind: Secret
apiVersion: v1
metadata:
  name: etc-pki-entitlement
type: Opaque
data: {{ range \$key, \$value := .data }}
  {{ \$key }}: {{ \$value }} {{ end }}
EOF
$ oc get secret etc-pki-entitlement -n openshift-config-managed -o=go-template-file --template=secret-template.txt | oc apply -f -

  2. Add the etc-pki-entitlement secret as a build volume in the build configuration’s Docker strategy: 

    strategy:
  dockerStrategy:
    from:
      kind: ImageStreamTag
      name: ubi9:latest
    volumes:
    - name: etc-pki-entitlement
      mounts:
      - destinationPath: /etc/pki/entitlement
      source:
        type: Secret
        secret:
          secretName: etc-pki-entitlement

10.3. Running builds with Subscription Manager
Link kopieren

10.3.1. Docker builds using Subscription Manager
Link kopieren

Docker strategy builds can use 

yum
or 
dnf
to install additional Red Hat Enterprise Linux (RHEL) packages.

Prerequisites

The entitlement keys must be added as build strategy volumes.

Procedure

Use the following as an example Dockerfile to install content with the Subscription Manager: 

FROM registry.redhat.io/ubi9/ubi:latest
RUN rm -rf /etc/rhsm-host
1 

RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \
2 

    nss_wrapper \
    uid_wrapper -y && \
    yum clean all -y
RUN ln -s /run/secrets/rhsm /etc/rhsm-host
3
1
You must include the command to remove the /etc/rhsm-host directory and all its contents in your Dockerfile before executing any yum or dnf commands.
2
Use the Red Hat Package Browser to find the correct repositories for your installed packages.
3
You must restore the /etc/rhsm-host symbolic link to keep your image compatible with other Red Hat container images.

10.4. Running builds with Red Hat Satellite subscriptions
Link kopieren

10.4.1. Adding Red Hat Satellite configurations to builds
Link kopieren

Builds that use Red Hat Satellite to install content must provide appropriate configurations to obtain content from Satellite repositories.

Prerequisites

  • You must provide or create a 

    yum
    -compatible repository configuration file that downloads content from your Satellite instance.

    Sample repository configuration

    [test-<name>]
name=test-<number>
baseurl = https://satellite.../content/dist/rhel/server/7/7Server/x86_64/os
enabled=1
gpgcheck=0
sslverify=0
sslclientkey = /etc/pki/entitlement/...-key.pem
sslclientcert = /etc/pki/entitlement/....pem

Procedure

  1. Create a 

    ConfigMap
    containing the Satellite repository configuration file: 

    $ oc create configmap yum-repos-d --from-file /path/to/satellite.repo

  2. Add the Satellite repository configuration and entitlement key as a build volumes: 

    strategy:
  dockerStrategy:
    from:
      kind: ImageStreamTag
      name: ubi9:latest
    volumes:
    - name: yum-repos-d
      mounts:
      - destinationPath: /etc/yum.repos.d
      source:
        type: ConfigMap
        configMap:
          name: yum-repos-d
    - name: etc-pki-entitlement
      mounts:
      - destinationPath: /etc/pki/entitlement
      source:
        type: Secret
        secret:
          secretName: etc-pki-entitlement

10.4.2. Docker builds using Red Hat Satellite subscriptions
Link kopieren

Docker strategy builds can use Red Hat Satellite repositories to install subscription content.

Prerequisites

  • You have added the entitlement keys and Satellite repository configurations as build volumes.

Procedure

Use the following as an example Dockerfile to install content with Satellite: 

FROM registry.redhat.io/ubi9/ubi:latest
RUN rm -rf /etc/rhsm-host
1 

RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \
2 

    nss_wrapper \
    uid_wrapper -y && \
    yum clean all -y
RUN ln -s /run/secrets/rhsm /etc/rhsm-host
3
1
You must include the command to remove the /etc/rhsm-host directory and all its contents in your Dockerfile before executing any yum or dnf commands.
2
Contact your Satellite system administrator to find the correct repositories for the build’s installed packages.
3
You must restore the /etc/rhsm-host symbolic link to keep your image compatible with other Red Hat container images.

10.5. Running builds using SharedSecret objects
Link kopieren

You can use a 

SharedSecret
object to securely access the entitlement keys of a cluster in builds. The 
SharedSecret
object allows you to share and synchronize secrets across namespaces.

Important

The Shared Resource CSI Driver feature is now generally available in Builds for Red Hat OpenShift 1.1. To use this feature, ensure that you have installed Builds for Red Hat OpenShift 1.1 or later.

Red Hat logoGithubredditYoutubeTwitter

Lernen

Testen, kaufen und verkaufen

Communitys

Über Red Hat Dokumentation

Wir helfen Red Hat Benutzern, mit unseren Produkten und Diensten innovativ zu sein und ihre Ziele zu erreichen – mit Inhalten, denen sie vertrauen können. Entdecken Sie unsere neuesten Updates.

Mehr Inklusion in Open Source

Red Hat hat sich verpflichtet, problematische Sprache in unserem Code, unserer Dokumentation und unseren Web-Eigenschaften zu ersetzen. Weitere Einzelheiten finden Sie in Red Hat Blog.

Über Red Hat

Wir liefern gehärtete Lösungen, die es Unternehmen leichter machen, plattform- und umgebungsübergreifend zu arbeiten, vom zentralen Rechenzentrum bis zum Netzwerkrand.

Theme

© 2026 Red HatNach oben