You can include an operating system-level host configuration in the image to provide maximum consistency and repeatability.

To update the configuration, you create a new operating system image and update devices with the new image.

However, updating devices with a new image can be impractical in the following cases:

• The configuration is missing in the image.
• The configuration needs to be specific to a device.
• The configuration needs to be updatable at runtime without updating the operating system image and rebooting.

For these cases, you can declare a set of configuration files that is present on the file system of the device. The Red Hat Edge Manager agent applies updates to the configuration files while ensuring that either all files are successfully updated in the file system, or rolled back to their pre-update state. If the user updates both an operating system and configuration set of a device at the same time, the Red Hat Edge Manager agent updates the operating system first, then applies the specified set of configuration files.

You can also specify a list of configuration sets that the Red Hat Edge Manager agent applies in sequence. In case of a conflict, the last applied configuration set is valid.

Configuration providers

You can provide configuration from multiple sources, called configuration providers, in Red Hat Edge Manager. The Red Hat Edge Manager currently supports the following configuration providers: A repository used by a provider must be configured once and can then be used for multiple devices or fleets.

Git Config Provider

Fetches device configuration files from a Git repository.

Kubernetes Secret Provider

Fetches a secret from a Kubernetes cluster and writes the content to the file system of the device.

HTTP Config Provider

Fetches device configuration files from an HTTP(S) endpoint.

Inline Config Provider

Allows you to specify device configuration files inline in the device manifest without querying external systems.

Read more about the configuration providers in the following sections:

• Configuration from a Git repository
• Secrets from a Kubernetes cluster
• Configuration from an HTTP server
• Configuration inline in the device specification

Configuration from a Git repository

You can store device configuration in a Git repository such as GitHub or GitLab. You can then add a Git Config Provider so that the Red Hat Edge Manager synchronizes the configuration from the repository to the file system of the device.

The Git Config Provider takes the following parameters:

The Repository resource defines the Git repository, the protocol and access credentials that the Red Hat Edge Manager must use. After the repository is configured, you can use it for individual devices or device fleets.

When a fleet or device references a Git repository, Red Hat Edge Manager can detect new commits on the configured branch or tag and roll out updates automatically. See Automatic synchronization of external configuration in the Additional resources section.

Secrets from a Kubernetes cluster

The Red Hat Edge Manager can query only the Kubernetes cluster that the Red Hat Edge Manager is running on for a Kubernetes secret. The content of that secret can be written to a path on the device file system.

The Kubernetes Secret Provider takes the following parameters:

To apply a Kubernetes secret to a device, add a config entry with secretRef to the device specification and apply it with the CLI (or API):

The following example shows a device spec with secretRef:

spec:
  config:
    - name: my-secret
      secretRef:
        name: my-secret-name
        namespace: my-secret-namespace
        mountPath: /etc/my-secret

Run flightctl apply -f <file>.yaml to apply the device or fleet manifest.

The Red Hat Edge Manager worker needs permission to read secrets from the cluster. You can either allow cluster-wide access at install time or grant namespace-scoped access with RBAC (least-privilege):

• Cluster-wide access: Set global.worker.clusterLevelSecretAccess to true in the Helm values when installing Red Hat Edge Manager on OpenShift Container Platform. See Installing Red Hat Edge Manager on OpenShift Container Platform in the Additional resources section.
• Namespace-scoped access: Create a Role and RoleBinding in the namespace where the secrets are stored so the flightctl-worker service account can get secrets in that namespace only. For details, see the OpenShift Container Platform RBAC documentation.

To detect secret rotation automatically, label secrets for synchronization and configure periodic service RBAC as described in Configuring synchronization in the Additional resources section.

The following example shows a Role and RoleBinding for flightctl-worker secret access:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: <secret_namespace>
  name: flightctl-worker-secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: <secret_namespace>
  name: flightctl-worker-secret-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: flightctl-worker-secret-reader
subjects:
- kind: ServiceAccount
  name: flightctl-worker
  namespace: <worker_namespace>

Apply the manifest with oc apply -f <file>.yaml.

Configuration from an HTTP server

The Red Hat Edge Manager can query an HTTP server for configuration. The HTTP server can serve static or dynamically generated configuration for a device.

The HTTP Config Provider takes the following parameters:

The Repository resource specifies the HTTP server for the Red Hat Edge Manager to connect to, and the protocol and access credentials to use. After the repository is configured, you can use it for multiple devices or device fleets.

When content at the referenced URL changes, Red Hat Edge Manager can detect the change and roll out updates to fleets and devices. See Automatic synchronization of external configuration in the Additional resources section.

Configuration inline in the device specification

You can specify configuration inline in a device specification. When you use the inline device specification, the Red Hat Edge Manager does not need to connect to external systems to fetch the configuration.

The Inline Config Provider takes a list of file specifications, where each file specification takes the following parameters:

For more information about device lifecycle hooks and the default rules used by the Red Hat Edge Manager agent, see Device lifecycle hooks in the Additional resources section.