Install Red Hat Edge Manager from the Software Catalog

Install Red Hat Edge Manager from the Software Catalog in the Red Hat OpenShift Container Platform web console by creating a project, configuring certificates, and deploying the application.

Before you begin

  • An active Red Hat Edge Manager subscription.
  • Cluster CPU, memory, and persistent storage sized for your expected device count. See Red Hat Edge Manager system requirements in the Additional resources section.
  • For clusters without dynamic storage provisioning, static PV binding is configured before you deploy. See Configuring static PV binding for clusters without dynamic storage provisioning.
  • Firewall and network rules that allow administrators, automation, and edge devices to reach the Red Hat Edge Manager endpoints you expose on the cluster. For listener ports and how they apply on Red Hat OpenShift Container Platform and on Red Hat Enterprise Linux, see Network ports for Red Hat Edge Manager in the Additional resources section.
  • A Red Hat OpenShift Container Platform cluster version 4.19 or later.
  • Cluster administrator permissions.
  • The OpenShift CLI (oc) installed and authenticated.
  • For access through the Red Hat Advanced Cluster Management console, Red Hat Advanced Cluster Management is installed on the cluster and you can enable dynamic plugins in the Red Hat OpenShift Container Platform web console.

    Optional:

  • To sign Red Hat Edge Manager service certificates with a corporate CA instead of the default self-signed CA, install the cert-manager Operator on the cluster. Complete Using a custom CA for Red Hat Edge Manager service certificates in the Additional resources section before you deploy Red Hat Edge Manager.

Procedure

  1. Log in to the Red Hat OpenShift Container Platform web console and navigate to Home Projects.
  2. Click Create Project.
    1. Enter a name for your project in the Name field.
    2. Optional: Enter a display name for your project in the Display name field.
    3. Optional: Enter a description for your project in the Description field.
    4. Click Create to create your project.
    Note

    To use a corporate CA for Red Hat Edge Manager service certificates, create the flightctl-ca secret in this project before you finish the Software Catalog installation. See Using a custom CA for Red Hat Edge Manager service certificates in the Additional resources section.
  3. Navigate to Ecosystem Software Catalog.
  4. Select your project from the Project dropdown menu. If the project does not appear in the dropdown, refresh your browser.
  5. Search for "Red Hat Edge Manager", select the Red Hat Edge Manager tile, and click Create in the side panel.
  6. Enter a name for your Helm release in the Release Name field and select the required version from the Chart version dropdown menu.
  7. Before finishing the installation, you must configure the ingress certificates. In your terminal, run the following commands to extract the cluster’s Certificate Authority (CA) bundle: 
    $ oc get configmap default-ingress-cert \
    -n openshift-config-managed \
    -o jsonpath='{.data.ca-bundle\.crt}' > /tmp/ingress-ca.crt

$ cat /tmp/ingress-ca.crt
  8. Under the Configure via section, select the YAML view radio button, locate the global.auth.caCert field, and paste the contents of /tmp/ingress-ca.crt as shown in the following example:

    Example YAML configuration 

    global:
  auth:
    caCert: |
      -----BEGIN CERTIFICATE-----
      MIIDWzCCAkOgAwIBAgIIUUg1fwtYuLYwDQYJKoZIhvcNAQELBQAwJjEkMCIGA1UE
      ...
      [Full certificate content]
      ...
      -----END CERTIFICATE-----
    insecureSkipTlsVerify: false
    Warning

    Verify the global.auth.caCert field is included. If it is missing, you must add it manually to allow edge devices to verify the API. Ensure global.auth.caCert is correctly indented. If this field is missing or malformed, managed edge devices cannot verify the API identity and fail to connect.

     Important

    Set global.enableMulticlusterExtensions according to how you use Red Hat Edge Manager on this cluster:

    • Standalone Red Hat Edge Manager: Use the Red Hat Edge Manager UI through a dedicated OpenShift route. If Red Hat Advanced Cluster Management is also installed but you do not want Edge management inside the Red Hat Advanced Cluster Management console, set global.enableMulticlusterExtensions to "false".
    • Red Hat Advanced Cluster Management-integrated Red Hat Edge Manager: Use Edge capabilities from Fleet Management. Set global.enableMulticlusterExtensions to true or auto (as supported by your chart version). After the Helm release is deployed, enable the flightctl-plugin dynamic plugin in the Red Hat OpenShift Container Platform console. For the steps, see Accessing Red Hat Edge Manager from the Red Hat Advanced Cluster Management console in the Additional resources section.

    The OpenShift Software Catalog used here installs the Red Hat Edge Manager service. It is not the same as the in-product Software Catalog in the Red Hat Edge Manager web console, which distributes operating system images and applications to edge devices.

    Note

    To control Kubernetes Secret Provider access to cluster secrets:

    • Grant access per namespace (Recommended): Use a Role and RoleBinding to grant the flightctl-worker service account access to specific namespaces. This is the recommended method to ensure limited permission access for the worker. For details, see the Managing devices topic on Secrets from a Kubernetes cluster.
    • Allow cluster-wide access: Set global.worker.clusterLevelSecretAccess to true in the YAML configuration. Use this option only if the worker requires access to secrets across the entire cluster.

    To automatically detect rotated secrets referenced from fleet or device templates, set global.periodic.clusterLevelSecretAccess to true when secrets reside outside the release namespace. Also label those secrets with flightctl.io/sync-<release_namespace>: "true". For details, see Configuring synchronization in the Additional resources section.

    If your cluster uses pre-provisioned PersistentVolumes without dynamic storage provisioning, add the static PV binding values to the YAML editor before you click Create. See Configuring static PV binding for clusters without dynamic storage provisioning.

  9. Click Create to deploy Red Hat Edge Manager.

    If you later upgrade the Red Hat Edge Manager Helm chart through the Red Hat OpenShift Container Platform web console and change the chart version, the upgrade form shows only the new chart version’s defaults and does not include custom values from your installed release. To preserve configuration when upgrading, see Upgrading the Red Hat Edge Manager Helm release on Red Hat OpenShift Container Platform.

Results

  1. Verify that all Red Hat Edge Manager pods are running: 
    $ oc get pods -n <namespace>

    All pods show a STATUS of Running.

  2. Verify that the Red Hat Edge Manager web UI route is accessible: 
    $ oc get route -n <namespace>

    Open the URL shown in the HOST/PORT column in a web browser to confirm the UI loads.

  3. Verify that the Flight Control CLI can connect: 
    $ flightctl login
$ flightctl version

    The flightctl version command reports a Server Version.