Chapter 4. Using Red Hat entitlements in pipelines

Procedure

1. Copy the etc-pki-entitlement secret from the openshift-config-managed namespace into the namespace of your pipeline by running the following command:

   $ oc get secret etc-pki-entitlement -n openshift-config-managed -o json | \
     jq 'del(.metadata.resourceVersion)' | jq 'del(.metadata.creationTimestamp)' | \
     jq 'del(.metadata.uid)' | jq 'del(.metadata.namespace)' | \
     oc -n <pipeline_namespace> create -f - 1

   1

   Replace <pipeline_namespace> with the namespace of your pipeline.

2. In your Buildah task definition, use the buildah cluster task or a copy of this cluster task and define the rhel-entitlement workspace, as in the following example.
3. In your task run or pipeline run that runs the Buildah task, assign the etc-pki-entitlement secret to the rhel-entitlement workspace, as in the following example.

Procedure

1. Create a SharedSecret custom resource (CR) for sharing the etc-pki-entitlement secret by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: sharedresource.openshift.io/v1alpha1
   kind: SharedSecret
   metadata:
     name: shared-rhel-entitlement
   spec:
     secretRef:
       name: etc-pki-entitlement
       namespace: openshift-config-managed
   EOF

2. Create an RBAC role that permits access to the shared secret by running the following command:

   $ oc apply -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: shared-resource-rhel-entitlement
     namespace: <pipeline_namespace> 1
   rules:
     - apiGroups:
         - sharedresource.openshift.io
       resources:
         - sharedsecrets
       resourceNames:
         - shared-rhel-entitlement
       verbs:
         - use
   EOF

   1

   Replace <pipeline_namespace> with the namespace of your pipeline.

3. Assign the role to the pipeline service account by running the following command:

   $ oc create rolebinding shared-resource-rhel-entitlement --role=shared-shared-resource-rhel-entitlement \
     --serviceaccount=<pipeline-namespace>:pipeline 1

   1

   Replace <pipeline-namespace> with the namespace of your pipeline.

   Note

   If you changed the default service account for OpenShift Pipelines or if you define a custom service account in the pipeline run or task run, assign the role to this account instead of the pipeline account.

4. In your Buildah task definition, use the buildah cluster task or a copy of this cluster task and define the rhel-entitlement workspace, as in the following example.
5. In your task run or pipeline run that runs the Buildah task, assign the shared secret to the rhel-entitlement workspace, as in the following example.