Questo contenuto non è disponibile nella lingua selezionata.
Chapter 5. Using Red Hat entitlements in pipelines
If you have Red Hat Enterprise Linux (RHEL) entitlements, you can use these entitlements to build container images in your pipelines.
The Insight Operator automatically manages your entitlements after you import them into this operator from Simple Common Access (SCA). This operator provides a secret named etc-pki-entitlement
in the openshift-config-managed
namespace.
You can use Red Hat entitlements in your pipelines in one of the following two ways:
- Manually copy the secret into the namespace of the pipeline. This method is least complex if you have a limited number of pipeline namespaces.
- Use the Shared Resources Container Storage Interface (CSI) Driver Operator to share the secret between namespaces automatically.
5.1. Prerequisites
-
You logged on to your OpenShift Container Platform cluster using the
oc
command line tool. You enabled the Insights Operator feature on your OpenShift Container Platform cluster. If you want to use the Shared Resources CSI Driver operator to share the secret between namespaces, you must also enable the Shared Resources CSI driver. For information about enabling features, including the Insights Operator and Shared Resources CSI Driver, see Enabling features using feature gates.
NoteAfter you enable the Insights Operator, you must wait for some time to ensure that the cluster updates all the nodes with this operator. You can monitor the status of all nodes by entering the following command:
$ oc get nodes -w
To verify that the Insights Operator is active, check that the
insights-operator
pod is running in theopenshift-insights
namespace by entering the following command:$ oc get pods -n openshift-insights
You configured the importing of your Red Hat entitlements into the Insights Operator. For information about importing the entitlements, see Importing simple content access entitlements with Insights Operator.
NoteTo verify that the Insights Operator made your entitlements available, is active, check that the
etc-pki-entitlement
secret is present in theopenshift-config-managed
namespace by entering the following command:$ oc get secret etc-pki-entitlement -n openshift-config-managed
5.2. Using Red Hat entitlements by manually copying the etc-pki-entitlement secret
You can copy the etc-pki-entitlement
secret from the openshift-config-managed
namespace into the namespace of your pipeline. You can then configure your pipeline to use this secret for the Buildah task.
Prerequisites
-
You installed the
jq
package on your system. This package is available in Red Hat Enterprise Linux (RHEL).
Procedure
Copy the
etc-pki-entitlement
secret from theopenshift-config-managed
namespace into the namespace of your pipeline by running the following command:$ oc get secret etc-pki-entitlement -n openshift-config-managed -o json | \ jq 'del(.metadata.resourceVersion)' | jq 'del(.metadata.creationTimestamp)' | \ jq 'del(.metadata.uid)' | jq 'del(.metadata.namespace)' | \ oc -n <pipeline_namespace> create -f - 1
- 1
- Replace
<pipeline_namespace>
with the namespace of your pipeline.
-
In your Buildah task definition, use the
buildah
task provided in theopenshift-pipelines
namespace or a copy of this task and define therhel-entitlement
workspace, as shown in the following example. -
In your task run or pipeline run that runs the Buildah task, assign the
etc-pki-entitlement
secret to therhel-entitlement
workspace, as in the following example.
Example pipeline run definition, including the pipeline and task definitions, that uses Red Hat entitlements
apiVersion: tekton.dev/v1 kind: PipelineRun metadata: name: buildah-pr-test spec: workspaces: - name: shared-workspace volumeClaimTemplate: spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi - name: dockerconfig secret: secretName: regred - name: rhel-entitlement 1 secret: secretName: etc-pki-entitlement pipelineSpec: workspaces: - name: shared-workspace - name: dockerconfig - name: rhel-entitlement 2 tasks: # ... - name: buildah taskRef: resolver: cluster params: - name: kind value: task - name: name value: buildah - name: namespace value: openshift-pipelines workspaces: - name: source workspace: shared-workspace - name: dockerconfig workspace: dockerconfig - name: rhel-entitlement 3 workspace: rhel-entitlement params: - name: IMAGE value: <image_where_you_want_to_push>