Optional: Requesting an enrollment certificate for early binding

Request enrollment credentials from the Red Hat Edge Manager service so you can embed an agent configuration in the operating system image for early binding.

Procedure

  1. To include an agent configuration in the image, complete the following steps. You can add optional settings to the agent config.yaml, such as system-info, system-info-custom, label-from-systeminfo, and default-labels, so that devices report system information and receive labels at enrollment. For examples, see Reporting system information from the agent and Device alias and enrollment labels in the Additional resources section.
    • For Red Hat Edge Manager on OpenShift Container Platform:
      • Get the Red Hat Edge Manager API interface server. Run the following command. Replace <namespace> with the OpenShift Container Platform project where you installed Red Hat Edge Manager (for example, open-cluster-management if your deployment uses that project, or the dedicated namespace you created for Red Hat Edge Manager). 
        export RHEM_API_SERVER_URL=$(oc get route -n <namespace> flightctl-api-route -o json | jq -r .spec.host)
      • Log in to your OpenShift Container Platform cluster by running the following command: 
        oc login
      • Authenticate with the Red Hat Edge Manager service by using the flightctl CLI. Run the following command to use your OpenShift Container Platform token: 
        flightctl login https://$RHEM_API_SERVER_URL -k --token=$(oc whoami -t)

        Alternatively, run the following command to log in by using the web browser:

        flightctl login https://$RHEM_API_SERVER_URL -k --web
    • For Red Hat Edge Manager on Red Hat Enterprise Linux:
      • Get the Red Hat Edge Manager API interface server. Run the following command: 
        export RHEM_API_SERVER_URL=<dns_name>
      • Authenticate with the Red Hat Edge Manager service by using the flightctl CLI. Run the following command: 
        flightctl login --username=<your_user> --password=<your_password> https://<dns_name>
      Note

      For Red Hat Edge Manager on OpenShift Container Platform, the -k flag skips TLS verification of the API server when the server certificate is not trusted by your host.

      For Red Hat Edge Manager on Red Hat Enterprise Linux, the CLI uses the certificate authority pool of the host to verify the identity of the Red Hat Edge Manager service. If you use self-signed certificates and do not add your certificate authority certificate to the pool, TLS verification fails. You can bypass server verification by adding the --insecure-skip-tls-verify flag to your command.

      On standalone Red Hat Enterprise Linux deployments, the user API is available on port 443 (the same endpoint as the web UI). If you upgraded from a release that used port 3443, use https://<dns_name>:3443 until you reconfigure your clients. For port planning, see Network ports for Red Hat Edge Manager in the Additional resources section.

  2. Obtain the enrollment credentials in the format of an agent configuration file by running the following command: 
    flightctl certificate request --signer=enrollment --expiration=365d --output=embedded > config.yaml

    where:

    • --expiration=365d specifies that the credentials are valid for a year.
    • --output=embedded specifies that the output is an agent configuration file with the enrollment credentials embedded.

      The returned config.yaml contains the URLs of the Red Hat Edge Manager service, the certificate authority bundle, and the enrollment client certificate and key for the agent. See the following example:

    enrollment-service:
  authentication:
    client-certificate-data: LS0tLS1CRUdJTiBD...
    client-key-data: LS0tLS1CRUdJTiBF...
  service:
    certificate-authority-data: LS0tLS1CRUdJTiBD...
    server: https://edge.example.com:7443
  enrollment-ui-endpoint: https://edge.example.com/