엣지 관리자

subscription-manager repos --enable rhacm-<2.x>-for-rhel-<version>-<arch>-rpms

subscription-manager repos --enable rhacm-<2.x>-for-rhel-<version>-<arch>-rpms

sudo dnf install flightctl

sudo dnf install flightctl

export RHEM_API_SERVER_URL=$(oc get route -n open-cluster-management flightctl-api-route -o json | jq -r .spec.host)

export RHEM_API_SERVER_URL=$(oc get route -n open-cluster-management flightctl-api-route -o json | jq -r .spec.host)

flightctl login --username=<your_user> --password=<your_password> https://$RHEM_API_SERVER_URL

flightctl login --username=<your_user> --password=<your_password> https://$RHEM_API_SERVER_URL

flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

enrollment-service:
  authentication:
    client-certificate-data: LS0tLS1CRUdJTiBD...
    client-key-data: LS0tLS1CRUdJTiBF...
  service:
    certificate-authority-data: LS0tLS1CRUdJTiBD...
    server: https://agent-api.flightctl.127.0.0.1.nip.io:7443
  enrollment-ui-endpoint: https://ui.flightctl.127.0.0.1.nip.io:8081

enrollment-service:
  authentication:
    client-certificate-data: LS0tLS1CRUdJTiBD...
    client-key-data: LS0tLS1CRUdJTiBF...
  service:
    certificate-authority-data: LS0tLS1CRUdJTiBD...
    server: https://agent-api.flightctl.127.0.0.1.nip.io:7443
  enrollment-ui-endpoint: https://ui.flightctl.127.0.0.1.nip.io:8081

{
  "auths": {
    "registry.example.com": {
      "auth": "base64-encoded-credentials"
    }
  }
}

{
  "auths": {
    "registry.example.com": {
      "auth": "base64-encoded-credentials"
    }
  }
}

FROM registry.redhat.io/rhel9/rhel-bootc:<required_os_version> 

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service && \
    systemctl mask bootc-fetch-apply-updates.timer 

FROM registry.redhat.io/rhel9/rhel-bootc:<required_os_version> 

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service && \
    systemctl mask bootc-fetch-apply-updates.timer 

OCI_REGISTRY=registry.redhat.io

OCI_REGISTRY=registry.redhat.io

OCI_IMAGE_REPO=${OCI_REGISTRY}/<your_org>/<your_image>

OCI_IMAGE_REPO=${OCI_REGISTRY}/<your_org>/<your_image>

OCI_IMAGE_TAG=v1

OCI_IMAGE_TAG=v1

sudo podman build -t ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG} .

sudo podman build -t ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG} .

skopeo generate-sigstore-key --output-prefix signingkey

skopeo generate-sigstore-key --output-prefix signingkey

sudo tee "/etc/containers/registries.d/${OCI_REGISTRY}.yaml" > /dev/null <<EOF
docker:
    ${OCI_REGISTRY}:
        use-sigstore-attachments: true
EOF

sudo tee "/etc/containers/registries.d/${OCI_REGISTRY}.yaml" > /dev/null <<EOF
docker:
    ${OCI_REGISTRY}:
        use-sigstore-attachments: true
EOF

sudo podman login ${OCI_REGISTRY}

sudo podman login ${OCI_REGISTRY}

sudo podman push \
    --sign-by-sigstore-private-key ./signingkey.private \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

sudo podman push \
    --sign-by-sigstore-private-key ./signingkey.private \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

mkdir -p output

mkdir -p output

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type iso \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type iso \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

FROM registry.redhat.io/rhel9/bootc-image-builder:latest

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service

RUN dnf -y install cloud-init open-vm-tools && \
    dnf -y clean all && \
    ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && \
    systemctl enable vmtoolsd.service

FROM registry.redhat.io/rhel9/bootc-image-builder:latest

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service

RUN dnf -y install cloud-init open-vm-tools && \
    dnf -y clean all && \
    ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && \
    systemctl enable vmtoolsd.service

RUN dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
    dnf -y install podman-compose && \
    dnf -y clean all && \
    systemctl enable podman.service

RUN dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm && \
    dnf -y install podman-compose && \
    dnf -y clean all && \
    systemctl enable podman.service

mkdir -p output

mkdir -p output

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type qcow2 \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type qcow2 \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

FROM registry.access.redhat.com/ubi9/ubi:latest AS builder
ADD --chown=107:107 output/qcow2/disk.qcow2 /disk/ 
RUN chmod 0440 /disk/* 
FROM scratch
COPY --from=builder /disk/* /disk/ 

FROM registry.access.redhat.com/ubi9/ubi:latest AS builder
ADD --chown=107:107 output/qcow2/disk.qcow2 /disk/ 

RUN chmod 0440 /disk/* 

FROM scratch
COPY --from=builder /disk/* /disk/ 

sudo chown -R $(whoami):$(whoami) "${PWD}/output"
OCI_DISK_IMAGE_REPO=${OCI_IMAGE_REPO}/diskimage-qcow2
sudo podman build -t ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} -f Containerfile.qcow2 .
sudo podman push --sign-by-sigstore-private-key ./signingkey.private ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}

sudo chown -R $(whoami):$(whoami) "${PWD}/output"
OCI_DISK_IMAGE_REPO=${OCI_IMAGE_REPO}/diskimage-qcow2
sudo podman build -t ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG} -f Containerfile.qcow2 .
sudo podman push --sign-by-sigstore-private-key ./signingkey.private ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}

FROM registry.redhat.io/rhel9/bootc-image-builder:latest

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service && \

RUN dnf -y install cloud-init open-vm-tools && \
    dnf -y clean all && \
    ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && \
    systemctl enable vmtoolsd.service

FROM registry.redhat.io/rhel9/bootc-image-builder:latest

RUN dnf config-manager --set-enabled rhacm-<2.x>-for-rhel-<version>-$(uname -m)-rpms && \
    dnf -y install flightctl-agent && \
    dnf -y clean all && \
    systemctl enable flightctl-agent.service && \

RUN dnf -y install cloud-init open-vm-tools && \
    dnf -y clean all && \
    ln -s ../cloud-init.target /usr/lib/systemd/system/default.target.wants && \
    systemctl enable vmtoolsd.service

mkdir -p output

mkdir -p output

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type vmdk \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

sudo podman run --rm -it --privileged --pull=newer \
    --security-opt label=type:unconfined_t \
    -v "${PWD}/output":/output \
    -v /var/lib/containers/storage:/var/lib/containers/storage \
    registry.redhat.io/rhel9/bootc-image-builder:latest \
    --type vmdk \
    ${OCI_IMAGE_REPO}:${OCI_IMAGE_TAG}

flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

cat <<EOF > cloud-config.yaml
#cloud-config
write_files:
- path: /etc/flightctl/config.yaml
  content: $(cat config.yaml | base64 -w0)
  encoding: b64
EOF

cat <<EOF > cloud-config.yaml
#cloud-config
write_files:
- path: /etc/flightctl/config.yaml
  content: $(cat config.yaml | base64 -w0)
  encoding: b64
EOF

oc create secret generic enrollment-secret --from-file=userdata=cloud-config.yaml

oc create secret generic enrollment-secret --from-file=userdata=cloud-config.yaml

cat <<EOF > my-bootc-vm.yaml
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: my-bootc-vm
spec:
  runStrategy: RerunOnFailure
  template:
    spec:
      domain:
        cpu:
          cores: 1
        memory:
          guest: 1024M
        devices:
          disks:
            - name: containerdisk
              disk:
                bus: virtio
            - name: cloudinitdisk
              disk:
                bus: virtio
      volumes:
        - name: containerdisk
          containerDisk:
            image: ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}
        - name: cloudinitdisk
          cloudInitConfigDrive:
            secretRef:
              name: enrollment-secret
EOF

cat <<EOF > my-bootc-vm.yaml
apiVersion: kubevirt.io/v1
kind: VirtualMachine
metadata:
  name: my-bootc-vm
spec:
  runStrategy: RerunOnFailure
  template:
    spec:
      domain:
        cpu:
          cores: 1
        memory:
          guest: 1024M
        devices:
          disks:
            - name: containerdisk
              disk:
                bus: virtio
            - name: cloudinitdisk
              disk:
                bus: virtio
      volumes:
        - name: containerdisk
          containerDisk:
            image: ${OCI_DISK_IMAGE_REPO}:${OCI_IMAGE_TAG}
        - name: cloudinitdisk
          cloudInitConfigDrive:
            secretRef:
              name: enrollment-secret
EOF

oc apply -f my-bootc-vm.yaml

oc apply -f my-bootc-vm.yaml

flightctl get enrollmentrequests --field-selector="status.approval.approved != true"

flightctl get enrollmentrequests --field-selector="status.approval.approved != true"

NAME           APPROVAL  APPROVER  APPROVED LABELS
<device_name>  Pending   <none>    <none>

NAME           APPROVAL  APPROVER  APPROVED LABELS
<device_name>  Pending   <none>    <none>

flightctl approve -l region=eu-west-1 -l site=factory-berlin enrollmentrequest/54shovu028bvj6stkovjcvovjgo0r48618khdd5huhdjfn6raskg

flightctl approve -l region=eu-west-1 -l site=factory-berlin enrollmentrequest/54shovu028bvj6stkovjcvovjgo0r48618khdd5huhdjfn6raskg

NAME           APPROVAL  APPROVER  APPROVED LABELS
<device_name>  Approved  user      region=eu-west-1,site=factory-berlin

NAME           APPROVAL  APPROVER  APPROVED LABELS
<device_name>  Approved  user      region=eu-west-1,site=factory-berlin

flightctl get devices

flightctl get devices

NAME           ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN
<device_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago

NAME           ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN
<device_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago

flightctl get device/<device_name> -o yaml

flightctl get device/<device_name> -o yaml

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  name: <device_name>
  labels: 
    region: eu-west-1
    site: factory-berlin
spec:
  os:
    image: quay.io/flightctl/rhel:9.5 
  config:
  - name: my-os-configuration 
    configType: GitConfigProviderSpec
    gitRef:
      path: /configuration
      repository: my-configuration-repo
      targetRevision: production
status:
  os:
    image: quay.io/flightctl/rhel:9.5 
  config:
    renderedVersion: "1" 
  applications:
    data: {} 
    summary:
      status: Unknown 
  resources: 
    cpu: Healthy
    disk: Healthy
    memory: Healthy
  systemInfo: 
    architecture: amd64
    bootID: 037750f7-f293-4c5b-b06e-481eef4e883f
    operatingSystem: linux
  summary:
    info: ""
    status: Online 
  updated:
    status: UpToDate 
  lastSeen: "2024-08-28T11:45:34.812851905Z" 
[...]

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  name: <device_name>
  labels: 

    region: eu-west-1
    site: factory-berlin
spec:
  os:
    image: quay.io/flightctl/rhel:9.5 

  config:
  - name: my-os-configuration 

    configType: GitConfigProviderSpec
    gitRef:
      path: /configuration
      repository: my-configuration-repo
      targetRevision: production
status:
  os:
    image: quay.io/flightctl/rhel:9.5 

  config:
    renderedVersion: "1" 

  applications:
    data: {} 

    summary:
      status: Unknown 

  resources: 

    cpu: Healthy
    disk: Healthy
    memory: Healthy
  systemInfo: 

    architecture: amd64
    bootID: 037750f7-f293-4c5b-b06e-481eef4e883f
    operatingSystem: linux
  summary:
    info: ""
    status: Online 

  updated:
    status: UpToDate 

  lastSeen: "2024-08-28T11:45:34.812851905Z" 

[...]

flightctl get devices -o wide

flightctl get devices -o wide

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago  region=eu-west-1,site=factory-berlin
<device2_name>  <none>   <none>  Online  Up-to-date  <none>        1 minute ago   region=eu-west-1,site=factory-madrid

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago  region=eu-west-1,site=factory-berlin
<device2_name>  <none>   <none>  Online  Up-to-date  <none>        1 minute ago   region=eu-west-1,site=factory-madrid

flightctl get devices -l site=factory-berlin -o wide

flightctl get devices -l site=factory-berlin -o wide

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago  region=eu-west-1,site=factory-berlin

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 seconds ago  region=eu-west-1,site=factory-berlin

flightctl get device/<device1_name> -o yaml > my_device.yaml

flightctl get device/<device1_name> -o yaml > my_device.yaml

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  labels:
    some_key: some_value
    some_other_key: some_other_value
  name: <device1_name>
spec:
[...]

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  labels:
    some_key: some_value
    some_other_key: some_other_value
  name: <device1_name>
spec:
[...]

flightctl apply -f my_device.yaml

flightctl apply -f my_device.yaml

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 minutes ago  some_key=some_value,some_other_key=some_other_value
<device2_name>  <none>   <none>  Online  Up-to-date  <none>        4 minutes ago  region=eu-west-1,site=factory-madrid

NAME            ALIAS    OWNER   SYSTEM  UPDATED     APPLICATIONS  LAST SEEN      LABELS
<device1_name>  <none>   <none>  Online  Up-to-date  <none>        3 minutes ago  some_key=some_value,some_other_key=some_other_value
<device2_name>  <none>   <none>  Online  Up-to-date  <none>        4 minutes ago  region=eu-west-1,site=factory-madrid

flightctl get device/<device_name> -o yaml > my_device.yaml

flightctl get device/<device_name> -o yaml > my_device.yaml

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  name: <device_name>
spec:
[...]
  os:
    image: quay.io/flightctl/rhel:9.5
[...]

apiVersion: flightctl.io/v1alpha1
kind: Device
metadata:
  name: <device_name>
spec:
[...]
  os:
    image: quay.io/flightctl/rhel:9.5
[...]

flightctl apply -f <device_name>.yaml

flightctl apply -f <device_name>.yaml

apiVersion: flightctl.io/v1alpha1
kind: Fleet
metadata:
 name: fleet-acm
spec:
 selector:
  matchLabels:
   fleet: acm
 template:
  spec:
   os:
    image: <your os image>
config:
   - name: acm-crd
    httpRef:
     filePath: /var/local/acm-import/crd.yaml
     repository: acm-registration
     suffix: /agent-registration/crds/v1

apiVersion: flightctl.io/v1alpha1
kind: Fleet
metadata:
 name: fleet-acm
spec:
 selector:
  matchLabels:
   fleet: acm
 template:
  spec:
   os:
    image: <your os image>
config:
   - name: acm-crd
    httpRef:
     filePath: /var/local/acm-import/crd.yaml
     repository: acm-registration
     suffix: /agent-registration/crds/v1

- name: acm-import
    httpRef:
     filePath: /var/local/acm-import/import.yaml
     repository: acm-registration
     suffix: /agent-registration/manifests/{{.metadata.name}}

- name: acm-import
    httpRef:
     filePath: /var/local/acm-import/import.yaml
     repository: acm-registration
     suffix: /agent-registration/manifests/{{.metadata.name}}

- name: pull-secret
    inline:
    - path: "/etc/crio/openshift-pull-secret"
     content: "{\"auths\":{...}}"

- name: pull-secret
    inline:
    - path: "/etc/crio/openshift-pull-secret"
     content: "{\"auths\":{...}}"

- name: apply-acm-manifests
    inline:
    - path: "/etc/flightctl/hooks.d/afterupdating/50-acm-registration.yaml"
     content: |
      - if:
       - path: /var/local/acm-import/crd.yaml
        op: [created]
       run: kubectl apply -f /var/local/acm-import/crd.yaml
       envVars:
        KUBECONFIG: /var/lib/microshift/resources/kubeadmin/kubeconfig
      - if:
       - path: /var/local/acm-import/import.yaml
        op: [created]
       run: kubectl apply -f /var/local/acm-import/import.yaml
       envVars:
        KUBECONFIG: /var/lib/microshift/resources/kubeadmin/kubeconfig

- name: apply-acm-manifests
    inline:
    - path: "/etc/flightctl/hooks.d/afterupdating/50-acm-registration.yaml"
     content: |
      - if:
       - path: /var/local/acm-import/crd.yaml
        op: [created]
       run: kubectl apply -f /var/local/acm-import/crd.yaml
       envVars:
        KUBECONFIG: /var/lib/microshift/resources/kubeadmin/kubeconfig
      - if:
       - path: /var/local/acm-import/import.yaml
        op: [created]
       run: kubectl apply -f /var/local/acm-import/import.yaml
       envVars:
        KUBECONFIG: /var/lib/microshift/resources/kubeadmin/kubeconfig