This repository contains tasks and pipelines to implement a simple RHEL Image Mode building and converting workflow

It comes with a configuration playbook and vars to set-up everything in Red Hat Ansible Automation Platform (projects, credentials, etc) to start working with it.

To make use of the tooling provided in this repository, a Kubernetes namespace must be targeted as a destination. Specify the namespace by setting an environment variable NAMESPACE as shown below:

NAMESPACE=<namespace>

This variable will be used in subsequent commands

For the pipelines to properly work, the podman tasks (image building and bootc-image-builder) require privileged execution access.

One solution could be to add the privileged SCC to the pipeline service account:

oc adm policy add-scc-to-user privileged -z pipeline -n $NAMESPACE

For the VM Deployment

All the tasks require credentials to fetch container images from registry.redhat.io and to fetch/push images to a destination container registry, for instance quay.io. You can store the credentials in a secret that can be then associated to the workspaces in the pipelines. For registries that require authentication, specify the credentials using the podman login command to create a new authfile in the current directory:

podman login <registry> --authfile=auth.json

Repeat this command until all source and target registries have been specified

Create a Secret containing the credentials:

oc create secret generic registry-credentials --from-file=.dockerconfigjson=auth.json --type=kubernetes.io/dockerconfigjson -n $NAMESPACE

Remove the authfile is desired:

rm -f auth.json

To build RHEL Image Mode container images, entitlements for RHEL are needed. Entitlements can be fetched directly from the openshift-config-managed project:

oc get secret etc-pki-entitlement -n openshift-config-managed -o json | \
  jq 'del(.metadata.resourceVersion)' | jq 'del(.metadata.creationTimestamp)' | \
  jq 'del(.metadata.uid)' | jq 'del(.metadata.namespace)' | \
  oc -n $NAMESPACE create -f -

It will create a secret called etc-pki-entitlement in the $NAMESPACE that can be then bound to the pipeline.

The repo comes with two different tasks:

• task-image-mode-build.yml -> To handle the creation and push of the container image
• task-bootc-image-builder.yml -> To handle the conversion of the container image to a specific format (QCOW2, ISO, AMI, VMDK)

Apply the tasks to the cluster:

oc apply -f task-bootc-image-builder.yml -f task-image-mode-build.yml -f task-git-clone.yml -n $NAMESPACE

The repo comes with two pipeline:

• pipeline-image-build.yml -> Combines a Git clone task to fetch a Containerfile from a repository with the task-image-mode-build task we defined before
• pipeline-bootc-image-builder.yml -> Uses bootc-image-builder to convert a RHEL Bootc container image to a preferred format.
• pipeline-deploy-vm.yml -> It generates a ContainerDisk for Kubevirt/OCP Virtualization with a QCOW2 file and spins a VM.

Each pipeline has its own workspaces to manage Registry Credentials,

Apply the tasks to the cluster:

oc apply -f pipeline-image-build.yml -f pipeline-bootc-image-builder.yml -f pipeline-deploy-vm.yml -n $NAMESPACE

Parameters

Workspaces

Parameters

Workspaces

Parameters

Workspaces

N/A

The execution of a Pipeline is achieved using a PipelineRun resource.

The following examples are available as starting points to initiate the processes described in a pipeline:

• rhel-bootc-image-build

Be sure to review the contents of both the PipelineRun and their underlying referenced Pipeline resources for any parameters that need to be customized for the particular environment.

Pipeline can be triggered by creating a new PipelineRun using one of customized examples:

oc create -f <file>