Preparing the redhat.repo file for a Kubernetes secret

Copy link

Before you create the rhel-yum-repos secret, prepare a copy of /etc/yum.repos.d/redhat.repo from a subscribed Red Hat Enterprise Linux host. The file contains entitlement certificate paths such as /etc/pki/entitlement/1234567890-key.pem. After you mount secrets into the worker pod, those paths must use the generic file names that the pod expects.

1. On a subscribed Red Hat Enterprise Linux host, copy the repository definition file:

   $ cp /etc/yum.repos.d/redhat.repo /tmp/redhat.repo

2. Replace the host-specific entitlement paths with generic paths:

   $ sed -i \
     -e 's|/etc/pki/entitlement/[0-9]*-key.pem|/etc/pki/entitlement/entitlement-key.pem|g' \
     -e 's|/etc/pki/entitlement/[0-9]*.pem|/etc/pki/entitlement/entitlement.pem|g' \
     /tmp/redhat.repo

3. Keep /tmp/redhat.repo for the secret creation steps in the following sections.

Configuring on Red Hat OpenShift Container Platform

Copy link

On clusters where Red Hat Enterprise Linux entitlements are in use, OpenShift exposes entitlement data in the etc-pki-entitlement secret in the openshift-config-managed namespace.

• The OpenShift CLI (oc) is installed and you are authenticated to the cluster.
• You prepared /tmp/redhat.repo as described in Preparing the redhat.repo file for a Kubernetes secret in the Additional resources section.
  1. Set your Red Hat Edge Manager project namespace:

     $ export NAMESPACE=<project_name>

     Replace <project_name> with the namespace where Red Hat Edge Manager is installed.

  2. Copy the entitlement secret into that namespace:

     $ oc get secret etc-pki-entitlement -n openshift-config-managed -o yaml | \
       sed "s/namespace: openshift-config-managed/namespace: ${NAMESPACE}/" | \
       oc apply -f -

  3. Create a secret that contains the sanitized repository definition:

     $ oc create secret generic rhel-yum-repos -n ${NAMESPACE} \
       --from-file=redhat.repo=/tmp/redhat.repo

  4. Create a secret from the Subscription Manager configuration directory. Run this command on a system where /etc/rhsm/ is available, typically a subscribed Red Hat Enterprise Linux host with oc configured for the cluster. Alternatively, copy /etc/rhsm/ to your workstation and adjust the path:

     $ oc create secret generic rhel-rhsm -n ${NAMESPACE} --from-file=/etc/rhsm/

  5. Create a secret that contains the Subscription Manager CA certificates:

     $ oc create secret generic rhel-rhsm-ca -n ${NAMESPACE} --from-file=/etc/rhsm/ca/

  6. Add the following values to your Red Hat Edge Manager Helm release. In the Red Hat OpenShift Container Platform web console, navigate to Helm Releases, locate your release, select Upgrade, and edit the YAML values. Merge the example fields with your existing configuration.

     imageBuilderWorker values for Red Hat OpenShift Container Platform

     imageBuilderWorker:
       entitlementCertsSecretName: "etc-pki-entitlement"
       yumReposSecretName: "rhel-yum-repos"
       rhsmSecretName: "rhel-rhsm"
       rhsmCaSecretName: "rhel-rhsm-ca"
       rpmRepoAdd: false
       rpmRepoEnable: "edge-manager-1.3-for-rhel-9-x86_64-rpms"

     Replace rpmRepoEnable with your enabled repository identifier if it differs.

     Note
     • Setting rpmRepoAdd to false prevents adding an external repository URL because repository definitions come from mounted secrets.
     • rpmRepoEnable sets the repository that dnf uses when it installs the agent RPM (--enablerepo).
  7. Complete the upgrade so that the chart is redeployed. In the console, click Upgrade. If you use the CLI or GitOps, apply the equivalent change.

Configuring on other Kubernetes distributions

Copy link

• The Kubernetes CLI (kubectl) is installed and configured for the cluster where Red Hat Edge Manager runs.
• You prepared /tmp/redhat.repo as described in Preparing the redhat.repo file for a Kubernetes secret in the Additional resources section.
• You can run commands on a subscribed Red Hat Enterprise Linux host (or equivalent) to read /etc/pki/entitlement/ and /etc/rhsm/.
  1. Create the secrets in the same namespace as your Red Hat Edge Manager release. Replace <project_name> with that namespace.

     $ kubectl create secret generic rhel-entitlement -n <project_name> \
       --from-file=/etc/pki/entitlement/
     
     $ kubectl create secret generic rhel-yum-repos -n <project_name> \
       --from-file=redhat.repo=/tmp/redhat.repo
     
     $ kubectl create secret generic rhel-rhsm -n <project_name> \
       --from-file=/etc/rhsm/
     
     $ kubectl create secret generic rhel-rhsm-ca -n <project_name> \
       --from-file=/etc/rhsm/ca/

  2. Update your Helm values for Red Hat Edge Manager to include the following imageBuilderWorker settings (merge with your existing values):

     imageBuilderWorker values for Kubernetes

     imageBuilderWorker:
       entitlementCertsSecretName: "rhel-entitlement"
       yumReposSecretName: "rhel-yum-repos"
       rhsmSecretName: "rhel-rhsm"
       rhsmCaSecretName: "rhel-rhsm-ca"
       rpmRepoAdd: false
       rpmRepoEnable: "edge-manager-1.3-for-rhel-9-x86_64-rpms"

  3. Redeploy or upgrade the Helm release so the image builder worker uses the new configuration.

Helm parameters for subscription-managed repositories

Copy link

The following Helm values control how the image builder worker accesses RPM content. Defaults apply when you use the public repository; set the values below when you use subscription-managed repositories.

Troubleshooting

Copy link

If image builds fail with a package or subscription error, use the following checks:

• Package not found: Confirm network access to Red Hat CDN or your mirrors. Verify that rpmRepoEnable matches a repository that is enabled for your entitlement.
• Subscription or entitlement errors: Verify that each secret exists in the release namespace and that the entitlement key paths in redhat.repo match the sanitized names.
• Worker logs: Run kubectl logs deployment/flightctl-imagebuilder-worker -n <project_name>.
• Build fails with an RLIMIT_NOFILE error: The host’s open-file-descriptor limit is lower than the build container requires. See Troubleshooting image builds that fail with an RLIMIT_NOFILE error in the Additional resources section.
• Unauthorized registry errors for builder service images: If builds fail when pulling podman, bootc-image-builder, or syft from an authenticated mirror, mount auth.json at /root/.config/containers/auth.json in the worker. The global.imagePullSecretName value authenticates the worker pod image only. Configure registry authentication for builder service images as described in Additional resources.