Red Hat Edge Manager authentication on Red Hat OpenShift Container Platform

Enable secure access to Red Hat Edge Manager by integrating your existing OpenShift identity provider, labeling your environment, and assigning the roles required to manage devices, fleets, and organizations.

  • Namespace-to-Organization Mapping: Red Hat Edge Manager uses a 1:1 mapping between OpenShift namespaces and Organizations.
  • Automatic Discovery: Labeling a namespace with io.flightctl/instance=<helm_release_name> triggers automatic discovery and initialization of that namespace as a Red Hat Edge Manager Organization.
  • Multi-Tenancy: You can create and manage multiple isolated organizations in a single cluster by applying the same management label to different namespaces.
  • Identity: Each labeled namespace is treated as a distinct organization so you can separate users, devices, and configurations.

Prerequisites
Copy link

  • Red Hat Edge Manager is deployed on Red Hat OpenShift Container Platform from the Software Catalog.
  • Red Hat OpenShift Container Platform users are created through an identity provider (for example, htpasswd or LDAP).
  • You have cluster-admin access to configure RoleBindings.

Label the namespace and verify
Copy link

  1. In the Red Hat OpenShift Container Platform web console, navigate to Helm Releases and record the Helm release name. This value is required for labeling the namespace and configuring user access.
  2. In your terminal, run the following command to label the namespace: 
    $ oc label namespace <namespace> io.flightctl/instance=<helm_release_name>
    Important

    The label value must match the Helm release name, not the namespace name.

  3. To verify which namespaces are associated with the Helm release name, run the following command: 
    $ oc get namespaces -l io.flightctl/instance=<helm_release_name>

Granting user access to Red Hat Edge Manager
Copy link

Accessing Red Hat Edge Manager resources requires a minimum of two roles: the mandatory view role for organization discovery, plus at least one functional role (for example, flightctl-admin).

Red Hat Edge Manager roles

Table 1. Red Hat Edge Manager roles
Role Purpose

view

Required for organization discovery.

flightctl-admin-<namespace>

Full access to Red Hat Edge Manager resources.

flightctl-operator-<namespace>

CRUD permissions for devices, fleets, resourcesyncs, and repositories; manage image builds, exports, and ImagePromotion resources. Cannot write Catalog or CatalogItem resources directly.

flightctl-viewer-<namespace>

Read-only access.
Important

The role name suffix is derived from the namespace where Red Hat Edge Manager is installed (for example, redhat-edgemanager), not the Helm release name. Substitute <namespace> with the actual namespace name used during deployment.

Grant roles

  1. To grant the view role for organization discovery: 
    $ oc adm policy add-role-to-user view <user_name> -n <namespace>
  2. To grant Red Hat Edge Manager administrative permissions: 
    $ oc adm policy add-role-to-user flightctl-admin-<namespace> <user_name> -n <namespace>
  3. To grant permissions for CRUD operations on Red Hat Edge Manager resources: 
    $ oc adm policy add-role-to-user flightctl-operator-<namespace> <user_name> -n <namespace>
  4. To grant Red Hat Edge Manager read-only access: 
    $ oc adm policy add-role-to-user flightctl-viewer-<namespace> <user_name> -n <namespace>
Note

A User not found warning is expected if the user has not yet logged in. The role binding activates automatically upon their first authentication.

User login
Copy link

You can authenticate with Red Hat Edge Manager by using either the flightctl CLI or the UI. You can obtain a pre-configured flightctl login command from the web console.

Log in with the CLI

  1. Log in to OpenShift: 
    $ oc login
  2. Log in to Red Hat Edge Manager using the OpenShift token: 
    $ flightctl login https://api.flightctl.apps.example.com -k --token=$(oc whoami -t)

Example output 

Auto-selected organization: <uuid> flightctl
Login successful.

Log in with the UI

  1. Navigate to the Red Hat Edge Manager UI.
  2. Click Login with OpenShift.
  3. Authenticate using your OpenShift credentials.

Upon successful authentication, the browser redirects to the Red Hat Edge Manager dashboard.

Verification
Copy link

Verify your access and configuration by running the following commands:

  1. Check the current organization: 
    $ flightctl config current-organization
  2. List available organizations: 
    $ flightctl get organizations
  3. Test access to resources: 
    $ flightctl get devices
$ flightctl get fleets