Chapter 6. Configuring the image builder worker for subscription-managed RPM content

Set your Red Hat Edge Manager project namespace:

$ export NAMESPACE=<project_name>

Replace <project_name> with the namespace where Red Hat Edge Manager is installed.

Copy the entitlement secret into that namespace:

$ oc get secret etc-pki-entitlement -n openshift-config-managed -o yaml | \
  sed "s/namespace: openshift-config-managed/namespace: ${NAMESPACE}/" | \
  oc apply -f -

Create a secret that contains the sanitized repository definition:

$ oc create secret generic rhel-yum-repos -n ${NAMESPACE} \
  --from-file=redhat.repo=/tmp/redhat.repo

Create a secret from the Subscription Manager configuration directory. Run this command on a system where /etc/rhsm/ is available (typically a subscribed Red Hat Enterprise Linux host with oc configured for the cluster), or copy /etc/rhsm/ to your workstation and adjust the path in the command:

$ oc create secret generic rhel-rhsm -n ${NAMESPACE} --from-file=/etc/rhsm/

Create a secret that contains the Subscription Manager CA certificates:

$ oc create secret generic rhel-rhsm-ca -n ${NAMESPACE} --from-file=/etc/rhsm/ca/

Add the following values to your Red Hat Edge Manager Helm release. In the Red Hat OpenShift Container Platform web console, navigate to Helm Releases, locate your release, select Upgrade, and edit the YAML values. Merge the example fields with your existing configuration.

imageBuilderWorker:
  entitlementCertsSecretName: "etc-pki-entitlement"
  yumReposSecretName: "rhel-yum-repos"
  rhsmSecretName: "rhel-rhsm"
  rhsmCaSecretName: "rhel-rhsm-ca"
  rpmRepoAdd: false
  rpmRepoEnable: "edge-manager-1.1-for-rhel-9-x86_64-rpms"

Replace rpmRepoEnable with your enabled repository identifier if it differs.

Create the secrets in the same namespace as your Red Hat Edge Manager release. Replace <project_name> with that namespace.

$ kubectl create secret generic rhel-entitlement -n <project_name> \
  --from-file=/etc/pki/entitlement/

$ kubectl create secret generic rhel-yum-repos -n <project_name> \
  --from-file=redhat.repo=/tmp/redhat.repo

$ kubectl create secret generic rhel-rhsm -n <project_name> \
  --from-file=/etc/rhsm/

$ kubectl create secret generic rhel-rhsm-ca -n <project_name> \
  --from-file=/etc/rhsm/ca/

Update your Helm values for Red Hat Edge Manager to include the following imageBuilderWorker settings (merge with your existing values):

imageBuilderWorker:
  entitlementCertsSecretName: "rhel-entitlement"
  yumReposSecretName: "rhel-yum-repos"
  rhsmSecretName: "rhel-rhsm"
  rhsmCaSecretName: "rhel-rhsm-ca"
  rpmRepoAdd: false
  rpmRepoEnable: "edge-manager-1.1-for-rhel-9-x86_64-rpms"

Edit the image builder worker container unit file. The path can vary by package version; a typical path is /usr/share/containers/systemd/flightctl-imagebuilder-worker.container. In the [Container] section, add read-only volume mounts:

Volume=/etc/pki/entitlement:/etc/pki/entitlement:ro,z
Volume=/etc/yum.repos.d:/etc/yum.repos.d:ro,z
Volume=/etc/rhsm/:/etc/rhsm/:ro,z

Edit /etc/flightctl/service-config.yaml and set the following under imagebuilderWorker (adjust the path if your installation differs):

imagebuilderWorker:
  rpmRepoAdd: false
  rpmRepoEnable: "edge-manager-1.1-for-rhel-9-x86_64-rpms"

Reload systemd and restart the worker:

$ sudo systemctl daemon-reload
$ sudo systemctl restart flightctl-imagebuilder-worker.service