2.10. 빌드에서 Red Hat 서브스크립션 사용

절차

1. 빌드 구성의 Docker 전략에 빌드 볼륨으로 etc-pki-entitlement 보안을 추가합니다.

   strategy:
     dockerStrategy:
       from:
         kind: ImageStreamTag
         name: ubi:latest
       volumes:
       - name: etc-pki-entitlement
         mounts:
         - destinationPath: /etc/pki/entitlement
         source:
           type: Secret
           secret:
             secretName: etc-pki-entitlement

절차

1. YAML 콘텐츠와 함께 oc apply 를 사용하여 SharedSecret CR 인스턴스를 사용하도록 빌더 서비스 계정 RBAC 권한을 부여합니다.

   참고

   현재 kubectl 및 oc 는 Pod 보안을 중심으로 하는 역할에 use 동사를 제한하는 특수 케이스 논리를 하드 코딩했습니다. 따라서 oc create role …​ 을 사용하여 SharedSecret CR 인스턴스를 사용하는 데 필요한 역할을 생성할 수 없습니다.

   YAML Role 오브젝트 정의를 사용하는 oc apply -f 명령의 예

   $ oc apply -f - <<EOF
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
     name: shared-resource-my-share
     namespace: my-namespace
   rules:
     - apiGroups:
         - sharedresource.openshift.io
       resources:
         - sharedsecrets
       resourceNames:
         - my-share
       verbs:
         - use
   EOF

2. oc 명령을 사용하여 역할과 연결된 RoleBinding 을 만듭니다.

   oc create rolebinding 명령 예

   $ oc create rolebinding shared-resource-my-share --role=shared-resource-my-share --serviceaccount=my-namespace:builder

3. RHEL 인타이틀먼트에 액세스하는 BuildConfig 오브젝트를 생성합니다.

   YAML BuildConfig 오브젝트 정의 예

   apiVersion: build.openshift.io/v1
   kind: BuildConfig
   metadata:
     name: my-csi-bc
     namespace: my-csi-app-namespace
   spec:
     runPolicy: Serial
     source:
       dockerfile: |
         FROM registry.redhat.io/ubi8/ubi:latest
         RUN ls -la /etc/pki/entitlement
         RUN rm /etc/rhsm-host
         RUN yum repolist --disablerepo=*
         RUN subscription-manager repos --enable rhocp-4.9-for-rhel-8-x86_64-rpms
         RUN yum -y update
         RUN yum install -y openshift-clients.x86_64
     strategy:
       type: Docker
       dockerStrategy:
         volumes:
           - mounts:
               - destinationPath: "/etc/pki/entitlement"
             name: my-csi-shared-secret
             source:
               csi:
                 driver: csi.sharedresource.openshift.io
                 readOnly: true
                 volumeAttributes:
                   sharedSecret: my-share-bc
               type: CSI

4. BuildConfig 오브젝트에서 빌드를 시작하고 oc 명령으로 로그를 따릅니다.

   oc start-build 명령 예

   $ oc start-build my-csi-bc -F

   예 2.1. oc start-build 명령의 출력 예

   참고

   다음 출력의 일부 섹션이 …​로 교체되었습니다.

   build.build.openshift.io/my-csi-bc-1 started
   Caching blobs under "/var/cache/blobs".
   
   Pulling image registry.redhat.io/ubi8/ubi:latest ...
   Trying to pull registry.redhat.io/ubi8/ubi:latest...
   Getting image source signatures
   Copying blob sha256:5dcbdc60ea6b60326f98e2b49d6ebcb7771df4b70c6297ddf2d7dede6692df6e
   Copying blob sha256:8671113e1c57d3106acaef2383f9bbfe1c45a26eacb03ec82786a494e15956c3
   Copying config sha256:b81e86a2cb9a001916dc4697d7ed4777a60f757f0b8dcc2c4d8df42f2f7edb3a
   Writing manifest to image destination
   Storing signatures
   Adding transient rw bind mount for /run/secrets/rhsm
   STEP 1/9: FROM registry.redhat.io/ubi8/ubi:latest
   STEP 2/9: RUN ls -la /etc/pki/entitlement
   total 360
   drwxrwxrwt. 2 root root 	80 Feb  3 20:28 .
   drwxr-xr-x. 10 root root	154 Jan 27 15:53 ..
   -rw-r--r--. 1 root root   3243 Feb  3 20:28 entitlement-key.pem
   -rw-r--r--. 1 root root 362540 Feb  3 20:28 entitlement.pem
   time="2022-02-03T20:28:32Z" level=warning msg="Adding metacopy option, configured globally"
   --> 1ef7c6d8c1a
   STEP 3/9: RUN rm /etc/rhsm-host
   time="2022-02-03T20:28:33Z" level=warning msg="Adding metacopy option, configured globally"
   --> b1c61f88b39
   STEP 4/9: RUN yum repolist --disablerepo=*
   Updating Subscription Management repositories.
   
   
   ...
   
   --> b067f1d63eb
   STEP 5/9: RUN subscription-manager repos --enable rhocp-4.9-for-rhel-8-x86_64-rpms
   Repository 'rhocp-4.9-for-rhel-8-x86_64-rpms' is enabled for this system.
   time="2022-02-03T20:28:40Z" level=warning msg="Adding metacopy option, configured globally"
   --> 03927607ebd
   STEP 6/9: RUN yum -y update
   Updating Subscription Management repositories.
   
   ...
   
   Upgraded:
     systemd-239-51.el8_5.3.x86_64      	systemd-libs-239-51.el8_5.3.x86_64
     systemd-pam-239-51.el8_5.3.x86_64
   Installed:
     diffutils-3.6-6.el8.x86_64           	libxkbcommon-0.9.1-1.el8.x86_64
     xkeyboard-config-2.28-1.el8.noarch
   
   Complete!
   time="2022-02-03T20:29:05Z" level=warning msg="Adding metacopy option, configured globally"
   --> db57e92ff63
   STEP 7/9: RUN yum install -y openshift-clients.x86_64
   Updating Subscription Management repositories.
   
   ...
   
   Installed:
     bash-completion-1:2.7-5.el8.noarch
     libpkgconf-1.4.2-1.el8.x86_64
     openshift-clients-4.9.0-202201211735.p0.g3f16530.assembly.stream.el8.x86_64
     pkgconf-1.4.2-1.el8.x86_64
     pkgconf-m4-1.4.2-1.el8.noarch
     pkgconf-pkg-config-1.4.2-1.el8.x86_64
   
   Complete!
   time="2022-02-03T20:29:19Z" level=warning msg="Adding metacopy option, configured globally"
   --> 609507b059e
   STEP 8/9: ENV "OPENSHIFT_BUILD_NAME"="my-csi-bc-1" "OPENSHIFT_BUILD_NAMESPACE"="my-csi-app-namespace"
   --> cab2da3efc4
   STEP 9/9: LABEL "io.openshift.build.name"="my-csi-bc-1" "io.openshift.build.namespace"="my-csi-app-namespace"
   COMMIT temp.builder.openshift.io/my-csi-app-namespace/my-csi-bc-1:edfe12ca
   --> 821b582320b
   Successfully tagged temp.builder.openshift.io/my-csi-app-namespace/my-csi-bc-1:edfe12ca
   821b582320b41f1d7bab4001395133f86fa9cc99cc0b2b64c5a53f2b6750db91
   Build complete, no image push requested