Install Red Hat Edge Manager with Helm in a disconnected environment

Install Red Hat Edge Manager from a local Helm chart and mirrored container images after you prepare offline artifacts and configure ImageTagMirrorSet on the disconnected cluster.

Before you begin

Procedure

  1. Create a project for the release: 
    oc new-project edge-manager
  2. Confirm the ImageTagMirrorSet from Configuring ImageTagMirrorSet for Red Hat Edge Manager images is active before you install.
    Note

    To use a corporate CA for Red Hat Edge Manager service certificates, create the flightctl-ca secret in this project before you run helm install. See Using a custom CA for Red Hat Edge Manager service certificates.
  3. When your internal mirror registry requires authentication, create an image pull secret in the release namespace: 
    oc create secret docker-registry rhem-pull-secret \
  --namespace edge-manager \
  --docker-server=<local_registry> \
  --docker-username=<username> \
  --docker-password=<password>

    Skip this step when the mirror registry allows anonymous pulls.

    Note

    global.imagePullSecretName authenticates pulls of Red Hat Edge Manager service pod images only. If you use the image builder worker with authenticated builder service images (podman, bootc-image-builder, and syft), configure registry credentials separately. See Configuring registry authentication for builder service images.
  4. Extract the cluster ingress CA bundle for device and CLI trust configuration: 
    oc get configmap default-ingress-cert -n openshift-config-managed \
  -o jsonpath='{.data.ca-bundle\.crt}' > /tmp/ingress-ca.crt

    Edge devices and the Flight Control CLI use this CA to verify the Red Hat Edge Manager API when you serve the route with the cluster ingress certificate.

  5. Install from the local chart tar file. Set global.imageRegistry to the registry path where you mirrored Red Hat Edge Manager images. When you created a pull secret, reference it in Helm values: 
    helm install flightctl ./redhat-rhem-<version>.tgz -n edge-manager \
  --set global.imageRegistry=<local_registry>/<path> \
  --set global.imagePullSecretName=rhem-pull-secret \
  --set global.auth.caCert="$(cat /tmp/ingress-ca.crt)" \
  --set global.auth.insecureSkipTlsVerify=false

    Adjust value keys per the chart values.yaml for your release. Omit global.imagePullSecretName when the mirror registry does not require authentication.

    For clusters without dynamic storage provisioning, include static PV binding values. Pass a values file with the -f flag or add --set flags for the binding parameters to the base helm install command from the previous step:

    helm install flightctl ./redhat-rhem-<version>.tgz -n edge-manager \
  --set global.imageRegistry=<local_registry>/<path> \
  --set global.imagePullSecretName=rhem-pull-secret \
  --set global.auth.caCert="$(cat /tmp/ingress-ca.crt)" \
  --set global.auth.insecureSkipTlsVerify=false \
  --set db.builtin.volumeName=<database_pv_name> \
  --set alertmanager.volumeName=<alertmanager_pv_name>

    Omit global.imagePullSecretName when the mirror registry does not require authentication.

    For the full list of static PV binding parameters, see Helm chart values for static PV binding.

  6. Wait for pods to reach Running: 
    oc get pods -n edge-manager
  7. Complete authentication setup, multicluster mode selection, and CLI access per Installing Red Hat Edge Manager on Red Hat OpenShift Container Platform and Red Hat Edge Manager authentication on Red Hat OpenShift Container Platform. Use the ingress CA from the extraction step for global.auth.caCert.

Results

  • All pods in edge-manager reach Running without ImagePullBackOff errors referencing public registries.
  • The web UI is available over HTTPS at the flightctl-ui route (standalone) or through Fleet Management (multicluster extensions).
  • flightctl login succeeds for a valid user and flightctl version reports Server Version.