Uploaded image for project: 'OpenShift Builds'
  1. OpenShift Builds
  2. BUILD-397

Blog Post - Builds work with RHEL subscriptions



    • 5
    • Sprint 214


      User Story

      As a developer building applications on OpenShift
      I want to use RHEL entitlements in my builds
      So that I can add RHEL subscription content to my container image

      Acceptance Criteria

      Defintion of done: Draft a Google Doc that will be a "polished draft" of the blog post, with equivalents of engineering code review, QE validation, and docs review. Post should demonstrate for CEE/customers how to use RHEL entitlements in builds. This includes:

      Cluster admins should be able to do the following:

      • Create a SharedSecret object on the cluster, referencing the entitlement secret that the insights operator places on the cluster (etc-pki-entitlement in the openshift-config-managed)
      • Create a Role/RoleBinding for the builder service account in a specific namespace, granting it permission to "use" the SharedSecret.

      Developers should then be able to do the following:

      • The shared entitlement can be added to a Build
      • The build can consume the entitlement and access subscription content, example `dnf install -y kernel-devel`

      Docs Impact

      Rolfe may be involved in editing the blog post. The materials will be a re-packaging of what is in BUILD-347.

      QE Impact

      QE should still re-verify the procedure in the blog post. Chances are that this will repeat any testing in BUILD-347.

      PX Impact


      For RBAC, there are alternatives to creating a namespaced role/rolebinding:

      • Create a ClusterRole/ClusterRoleBinding which grants "use" permission for the SharedSecret for all builder service accounts can access it.
      • Create a ClusterRole that aggregates to the "edit" role.

      Zvanko's blog post: https://cloud.redhat.com/blog/how-to-use-entitled-image-builds-to-build-drivercontainers-with-ubi-on-openshift


        Issue Links



              gmontero@redhat.com Gabe Montero
              adkaplan@redhat.com Adam Kaplan
              0 Vote for this issue
              3 Start watching this issue