User Story

As a developer building applications on OpenShift
I want to use RHEL entitlements in my builds
So that I can add RHEL subscription content to my container image

Acceptance Criteria

Defintion of done: Draft a Google Doc that will be a "polished draft" of the blog post, with equivalents of engineering code review, QE validation, and docs review. Post should demonstrate for CEE/customers how to use RHEL entitlements in builds. This includes:

Cluster admins should be able to do the following:

• Create a SharedSecret object on the cluster, referencing the entitlement secret that the insights operator places on the cluster (etc-pki-entitlement in the openshift-config-managed)
• Create a Role/RoleBinding for the builder service account in a specific namespace, granting it permission to "use" the SharedSecret.

Developers should then be able to do the following:

• The shared entitlement can be added to a Build
• The build can consume the entitlement and access subscription content, example `dnf install -y kernel-devel`

Docs Impact

Rolfe may be involved in editing the blog post. The materials will be a re-packaging of what is in BUILD-347.

QE Impact

QE should still re-verify the procedure in the blog post. Chances are that this will repeat any testing in BUILD-347.

PX Impact

• Blog post - a follow up to https://cloud.redhat.com/blog/the-path-to-improving-the-experience-with-rhel-entitlements-on-openshift that outlines the process for granting builds permission to use the RHEL entitlement (and potentially other workloads!).

Notes

• Blog post - a follow up to https://cloud.redhat.com/blog/the-path-to-improving-the-experience-with-rhel-entitlements-on-openshift that outlines the process for granting builds permission to use the RHEL entitlement (and potentially other workloads!).

For RBAC, there are alternatives to creating a namespaced role/rolebinding:

• Create a ClusterRole/ClusterRoleBinding which grants "use" permission for the SharedSecret for all builder service accounts can access it.
• Create a ClusterRole that aggregates to the "edit" role.

Zvanko's blog post: https://cloud.redhat.com/blog/how-to-use-entitled-image-builds-to-build-drivercontainers-with-ubi-on-openshift