Chapter 4. Operating system images for using with the Red Hat Edge Manager

Procedure

1. Enable the subscription manager for the repository appropriate for your system by running the following command:

   sudo subscription-manager repos --enable ansible-automation-platform-2.5-for-rhel-9-x86_64-rpms

   Copy to Clipboard Toggle word wrap

   For a full list of available repositories for the Red Hat Edge Manager, see the Additional resources section.

2. Install the flightctl CLI with your package manager by running the following command:

   sudo dnf install flightctl

   Copy to Clipboard Toggle word wrap

Procedure

1. Log in to the flightctl CLI by following the steps in Logging into the Red Hat Edge Manager through the CLI.

   Note

   The CLI uses the certificate authority pool of the host to verify the identity of the Red Hat Edge Manager service. The verification can lead to a TLS verification error when using self-signed certificates, if you do not add your certificate authority certificate to the pool. You can bypass the server verification by adding the --insecure-skip-tls-verify flag to your command.

2. Get the enrollment credentials in the format of an agent configuration file by running the following command:

   flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

   Copy to Clipboard Toggle word wrap
   Note
   • The --expiration=365d option specifies that the credentials are valid for a year.
   • The --output=embedded option specifies that the output is an agent configuration file with the enrollment credentials embedded.

   The returned config.yaml contains the URLs of the Red Hat Edge Manager service, the certificate authority bundle, and the enrollment client certificate and key for the agent. See the following example:

   enrollment-service:
     authentication:
       client-certificate-data: LS0tLS1CRUdJTiBD...
       client-key-data: LS0tLS1CRUdJTiBF...
     service:
       certificate-authority-data: LS0tLS1CRUdJTiBD...
       server: https://agent-api.flightctl.127.0.0.1.nip.io:7443
     enrollment-ui-endpoint: https://ui.flightctl.127.0.0.1.nip.io:8081

   Copy to Clipboard Toggle word wrap

Procedure

1. Depending on the kind of container image you use, place the pull secret in one or both of the following system paths on the device:

   • Operating system images use the /etc/ostree/auth.json path.

   • Application container images use the /root/.config/containers/auth.json path.

     Important

     The pull secret must exist on the device before the secret can be consumed.

2. Ensure that the pull secrets use the following format:

   {
     "auths": {
       "registry.example.com": {
         "auth": "base64-encoded-credentials"
       }
     }
   }

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a Containerfile file with the following content to build a RHEL 9-based operating system image that includes the Red Hat Edge Manager agent and configuration:

   FROM registry.redhat.io/rhel9/rhel-bootc:<required_os_version> 

   1

   
   RUN dnf --enablerepo ansible-automation-platform-2.5-for-rhel-9-x86_64-rpms -y install flightctl-agent-0.7.2-1.el9fc  && \
       dnf -y clean all && \
       systemctl enable flightctl-agent.service && \
       systemctl mask bootc-fetch-apply-updates.timer  

   2

   Copy to Clipboard Toggle word wrap

   1

   The base image that is referenced in FROM is a bootable container (bootc) image that already has a Linux kernel, which allows you to reuse existing standard container build tools and workflows.

   2

   Disables the default automatic updates. The updates are managed by the Red Hat Edge Manager.

   Important

   If your device relies on containers from a private repository, you must place the device pull secret in the /etc/ostree/auth.json path. The pull secret must exist on the device before the secret can be consumed.

   • Optional: To enable podman-compose application support, add the following section to the Containerfile file:

     RUN dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
         dnf -y install podman-compose && \
         dnf -y clean all && \
         systemctl enable podman.service

     Copy to Clipboard Toggle word wrap

   • Optional: If you created the config.yaml for early binding, add the following section to the Containerfile:

     ADD config.yaml /etc/flightctl/

     Copy to Clipboard Toggle word wrap

   For more information, see Optional: Requesting an enrollment certificate for early binding.

2. Define the Open Container Initiative (OCI) registry by running the following command:

   OCI_REGISTRY=registry.redhat.io

   Copy to Clipboard Toggle word wrap

3. Define the image repository that you have permissions to write to by running the following command:

   OCI_IMAGE_REPO=${OCI_REGISTRY}/<your_org>/<your_image>

   Copy to Clipboard Toggle word wrap

4. Define the image tag by running the following command:

   OCI_IMAGE_TAG=v1

   Copy to Clipboard Toggle word wrap

5. Build the operating system image for your target platform:

   sudo podman build -t ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG} .

   Copy to Clipboard Toggle word wrap

Procedure

1. Generate a Sigstore key pair named signingkey.pub and signingkey.private:

   skopeo generate-sigstore-key --output-prefix signingkey

   Copy to Clipboard Toggle word wrap

2. Configure container tools such as Podman and Skopeo to upload Sigstore signatures together with your signed image to your OCI registry:

   sudo tee "/etc/containers/registries.d/${OCI_REGISTRY}.yaml" > /dev/null <<EOF
   docker:
       ${OCI_REGISTRY}:
           use-sigstore-attachments: true
   EOF

   Copy to Clipboard Toggle word wrap

3. Log in to your OCI registry by running the following command:

   sudo podman login ${OCI_REGISTRY}

   Copy to Clipboard Toggle word wrap

4. Sign and publish the operating system image by running the following command:

   sudo podman push \
       --sign-by-sigstore-private-key ./signingkey.private \
       ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a directory called output by running the following command:

   mkdir -p output

   Copy to Clipboard Toggle word wrap

2. Use bootc-image-builder to generate an operating system disk image of type iso from your operating system image by running the following command:

   sudo podman run --rm -it --privileged --pull=newer \
       --security-opt label=type:unconfined_t \
       -v "${PWD}/output":/output \
       -v /var/lib/containers/storage:/var/lib/containers/storage \
       registry.redhat.io/rhel9/bootc-image-builder:latest \
       --type iso \
       ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

   Copy to Clipboard Toggle word wrap

Procedure

1. Change the owner of the directory where the ISO disk image is located from root to your current user by running the following command:

   sudo chown -R $(whoami):$(whoami) "${PWD}/output"

   Copy to Clipboard Toggle word wrap

2. Define the OCI_DISK_IMAGE_REPO environmental variable to be the same repository as your bootc image with /diskimage-iso appended by running the following command:

   OCI_DISK_IMAGE_REPO=${OCI_IMAGE_REPO}/diskimage-iso

   Copy to Clipboard Toggle word wrap

3. Create a manifest list by running the following command:

   sudo podman manifest create \
       ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}

   Copy to Clipboard Toggle word wrap

4. Add the ISO disk image to the manifest list as an OCI artifact by running the following command:

   sudo podman manifest add \
       --artifact --artifact-type application/vnd.diskimage.iso \
       --arch=amd64 --os=linux \
       ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} \
       "${PWD}/output/bootiso/install.iso"

   Copy to Clipboard Toggle word wrap

5. Sign the manifest list with your private Sigstore key and push the image to the registry by running the following command:

   sudo podman manifest push --all \
        --sign-by-sigstore-private-key ./signingkey.private \
       ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} \
       docker://${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}

   Copy to Clipboard Toggle word wrap