Chapter 10. Using Red Hat subscriptions in builds

Procedure

1. Copy the entitlement secret from the openshift-config-managed namespace to the build’s namespace:

   $ cat << EOF > secret-template.txt
   kind: Secret
   apiVersion: v1
   metadata:
     name: etc-pki-entitlement
   type: Opaque
   data: {{ range \$key, \$value := .data }}
     {{ \$key }}: {{ \$value }} {{ end }}
   EOF
   $ oc get secret etc-pki-entitlement -n openshift-config-managed -o=go-template-file --template=secret-template.txt | oc apply -f -

2. Add the etc-pki-entitlement secret as a build volume in the build configuration’s Docker strategy:

   strategy:
     dockerStrategy:
       from:
         kind: ImageStreamTag
         name: ubi9:latest
       volumes:
       - name: etc-pki-entitlement
         mounts:
         - destinationPath: /etc/pki/entitlement
         source:
           type: Secret
           secret:
             secretName: etc-pki-entitlement

Procedure

1. Use oc apply to create a SharedSecret object instance with the cluster’s entitlement secret.

   Important

   You must have cluster administrator permissions to create SharedSecret objects.

   Example oc apply -f command with YAML Role object definition

   $ oc apply -f - <<EOF
   kind: SharedSecret
   apiVersion: sharedresource.openshift.io/v1alpha1
   metadata:
     name: etc-pki-entitlement
   spec:
     secretRef:
       name: etc-pki-entitlement
       namespace: openshift-config-managed
   EOF

2. Create a role to grant the builder service account permission to access the SharedSecret object:

   Example oc apply -f command

   $ oc apply -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: builder-etc-pki-entitlement
     namespace: build-namespace
   rules:
     - apiGroups:
         - sharedresource.openshift.io
       resources:
         - sharedsecrets
       resourceNames:
         - etc-pki-entitlement
       verbs:
         - use
   EOF

3. Create a RoleBinding object that grants the builder service account permission to access the SharedSecret object by running the following command:

   Example oc create rolebinding command

   $ oc create rolebinding builder-etc-pki-entitlement --role=builder-etc-pki-entitlement --serviceaccount=build-namespace:builder

4. Add the entitlement secret to your BuildConfig object by using a CSI volume mount:

   Example YAML BuildConfig object definition

   apiVersion: build.openshift.io/v1
   kind: BuildConfig
   metadata:
     name: uid-wrapper-rhel9
     namespace: build-namespace
   spec:
     runPolicy: Serial
     source:
       dockerfile: |
         FROM registry.redhat.io/ubi9/ubi:latest
         RUN rm -rf /etc/rhsm-host 1
         RUN yum --enablerepo=codeready-builder-for-rhel-9-x86_64-rpms install \ 2
             nss_wrapper \
             uid_wrapper -y && \
             yum clean all -y
         RUN ln -s /run/secrets/rhsm /etc/rhsm-host 3
     strategy:
       type: Docker
       dockerStrategy:
         volumes:
           - mounts:
               - destinationPath: "/etc/pki/entitlement"
             name: etc-pki-entitlement
             source:
               csi:
                 driver: csi.sharedresource.openshift.io
                 readOnly: true 4
                 volumeAttributes:
                   sharedSecret: etc-pki-entitlement 5
               type: CSI

   1

   You must include the command to remove the /etc/rhsm-host directory and all its contents in the Dockerfile before executing any yum or dnf commands.

   2

   Use the Red Hat Package Browser to find the correct repositories for your installed packages.

   3

   You must restore the /etc/rhsm-host symbolic link to keep your image compatible with other Red Hat container images.

   4

   You must set readOnly to true to mount the shared resource in the build.

   5

   Reference the name of the SharedSecret object to include it in the build.

5. Start a build from the BuildConfig object and follow the logs using the oc command.

   $ oc start-build uid-wrapper-rhel9 -n build-namespace -F