Install the Red Hat Edge Manager RPM package

Prepare your Red Hat Enterprise Linux host for the Red Hat Edge Manager installation by enabling the necessary repositories, installing the flightctl-services package, and then starting and verifying the running services.

  • An active Red Hat Edge Manager subscription enabled for your Red Hat account
  • Firewall and network rules that allow administrators, automation, and edge devices to reach the Red Hat Edge Manager listeners on this host or its DNS name. For a port and traffic overview, see Network ports for Red Hat Edge Manager in the Additional resources section.
  • A Red Hat Enterprise Linux host with:
    • Red Hat Enterprise Linux 9.x or 10.x
    • Minimal installation
    • CPU, memory, and disk sized for your expected device count; see System requirements in the Additional resources section
    • Administrative access (root or sudo-capable user)
    • SSH access
    • Podman installed for managing containers
  • The system hostname must be set to a fully qualified domain name (FQDN), for example rhem.example.com. The flightctl-pam-issuer service does not start without a FQDN hostname.
  • A DNS name that resolves to the Red Hat Edge Manager host’s IP address. Set this name as global.baseDomain in /etc/flightctl/service-config.yaml so the HTTPS gateway can serve the web console and APIs on port 443. For certificate and DNS planning, see Planning DNS and TLS for the standalone gateway in the Additional resources section.
    1. SSH into your Red Hat Enterprise Linux host.
    2. Authenticate and log in to the Red Hat Container Registry: 
      sudo podman login registry.redhat.io
    3. Install the necessary repositories and packages:
      • Ensure that the Red Hat Edge Manager repositories are enabled by running the command for your Red Hat Enterprise Linux version:

        For Red Hat Enterprise Linux 9:

        sudo subscription-manager repos --enable edge-manager-1.3-for-rhel-9-x86_64-rpms

        For Red Hat Enterprise Linux 10:

        sudo subscription-manager repos --enable edge-manager-1.3-for-rhel-10-x86_64-rpms
      • Install the Red Hat Edge Manager service by running: 
        sudo dnf install -y flightctl-services
    4. Enable and start the services: Warning

      This command might take a few minutes to fully initialize all background services.

       
      sudo systemctl enable --now flightctl.target
    5. Run the following command to verify the status of the required services: 
      sudo systemctl list-units flightctl-*.service

Ensure that all listed services show a status of active, including flightctl-gateway.service when your release ships the standalone HTTPS gateway.

Note

Some services are one-time initialization tasks (such as flightctl-db-migrate.service) and will correctly display a status of active(exited). Persistent background services will display as active(running).

If your services do not run correctly, use the following log command to troubleshoot further and remediate:

sudo journalctl -u <impacted service> -b --no-pager

After you verify that the Flight Control services are running, the management server is ready to process requests.

You can now access the web UI at your global.baseDomain address on port 443 through the HTTPS gateway. Configure valid authentication credentials before you sign in to the dashboard.

Configure authentication credentials
Copy link

By default, Red Hat Edge Manager on Red Hat Enterprise Linux uses the PAM Issuer to provide OIDC-compliant authentication backed by local system credentials.

The steps below create a first global administrator. To assign additional roles or organization-scoped roles through PAM groups, see Roles and organizations with the PAM issuer in the Additional resources section. To authenticate users from LDAP, FreeIPA, or Active Directory through SSSD, see Authenticating with SSSD and the PAM issuer in the Additional resources section.

  1. Create the flightctl-admin role group for global administrators: 
    sudo podman exec flightctl-pam-issuer groupadd flightctl-admin
  2. On your Red Hat Enterprise Linux host, prepare a Linux crypt (SHA-512) password hash for the next step’s useradd -p option. Any tool that produces a compatible hash is acceptable; the examples below are optional. As a best practice, keep plain text out of podman exec commands and shell history. For example, run mkpasswd so the password is read interactively: 
    mkpasswd -m sha-512

    If mkpasswd is not installed, install the whois package (dnf install whois) or generate a SHA-512 crypt hash with openssl passwd -6.

  3. Create the user with a home directory, add the user to the group flightctl-admin, and apply the hash as the account password. Enclose the hash in single quotes so the shell does not expand $ characters in the hash. 
    sudo podman exec flightctl-pam-issuer useradd \
  -m \
  --groups flightctl-admin \
  -p '<PASSWORD_HASH>' \
  <USER>

Installing the Flight Control CLI
Copy link

You can install the Flight Control CLI from the RPM package or by downloading the binary from the UI. You can also obtain a pre-configured flightctl login command from the web console UI.

Installing the Flight Control CLI RPM package

To install the Flight Control CLI by using the RPM, complete the following steps:

  1. Install the flightctl CLI with your package manager by running the following command: 
    sudo dnf install -y flightctl-cli
  2. Verify that the flightctl CLI is working correctly by running the following command: 
    flightctl version
    Note

    The output displays the Client Version. The Server Version is only available after you authenticate. Use the flightctl login command to log in to the CLI for the first time to enable server version access.
  3. Run the following command to initiate the authentication process for the web UI. Note

    If you use certificates from the built-in generator or a private CA, trust /etc/flightctl/pki/ca.crt on the client or use --insecure-skip-tls-verify only in non-production environments.

     
    flightctl login https://<DNS_Name> --username <user_name> --password <password>

    Replace <DNS_Name> with the same value as global.baseDomain in /etc/flightctl/service-config.yaml.

Note

If you upgraded from a release that used port 3443 for the user API, you can continue to connect on port 3443 until you reconfigure your clients. For port planning, see Network ports for Red Hat Edge Manager in the Additional resources section.

The CLI is now successfully authenticated and configured to communicate with the Flight Control API. It establishes a secure link between your local environment and the management server, allowing you to issue subsequent commands to manage your fleets and devices.

Installing the Flight Control CLI binary from the UI

To install the Flight Control CLI binary from the UI, complete the following steps:

  1. Navigate to your global.baseDomain address and log in by using the credentials you created in the Configure authentication credentials section.
  2. Click the ❔ (question mark) icon in the upper part of the Red Hat Edge Manager UI.
  3. Select and click the downloadable archive file based on your Red Hat Enterprise Linux processor architecture.

    The <flightctl-os-arch>.tar.gz file is downloaded to your default download location.

  4. Extract the flightctl binary file from the downloaded archive. 
    $ tar -xvf <flightctl-os-arch>.tar.gz
  5. Copy the flightctl binary into a directory in your execution path as root, then set execute permission on the installed file. In the following example, the /usr/local/bin directory is on the path for users on the system: 
    $ sudo cp flightctl /usr/local/bin/
$ sudo chmod +x /usr/local/bin/flightctl
  6. Verify that the flightctl is working correctly by running the following command: 
    flightctl version