Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

always unregister system from red hat subscription manager #1564

Merged
merged 1 commit into from
Nov 5, 2024
Merged

always unregister system from red hat subscription manager #1564

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 14 additions & 11 deletions task/buildah-oci-ta/0.2/buildah-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -441,20 +441,25 @@ spec:
# shared emptydir volume to "/etc/pki/entitlement" to prevent certificates from being included in the produced
# container.

REGISTERED="false"
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
mkdir -p /shared/rhsm/etc/pki/entitlement
mkdir -p /shared/rhsm/etc/pki/consumer

VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key
-v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z
-v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)
echo "Adding activation key to the build"

if ! grep subscription-manager "$dockerfile_path" | grep -q register; then
# user is not running registration in the Containerfile: pre-register.
echo "Pre-registering with subscription manager."
subscription-manager register --org "$(cat /tmp/activation-key/org)" --activationkey "$(cat /tmp/activation-key/activationkey)"
REGISTERED=$?
# copy generated certificates to /shared/rhsm-tmp
cp /etc/pki/entitlement/*.pem /shared/rhsm-tmp
trap 'subscription-manager unregister || true' EXIT

# copy generated certificates to /shared volume
cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement
cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer

# and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca
VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/run/secrets/rhsm/ca/redhat-uep.pem)
Expand Down Expand Up @@ -507,6 +512,9 @@ spec:
command="$buildah_cmd"
fi

# disable host subcription manager integration
find /usr/share/rhel/secrets -type l -exec unlink {} \;

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
Expand All @@ -527,11 +535,6 @@ spec:

# Needed to generate base images SBOM
echo "$BASE_IMAGES" >/shared/base_images_from_dockerfile

# unregister pod from subscription manager
if [ "$REGISTERED" == "0" ]; then
subscription-manager unregister
fi
computeResources:
limits:
cpu: "4"
Expand Down
25 changes: 14 additions & 11 deletions task/buildah-remote-oci-ta/0.2/buildah-remote-oci-ta.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -475,20 +475,25 @@ spec:
# shared emptydir volume to "/etc/pki/entitlement" to prevent certificates from being included in the produced
# container.

REGISTERED="false"
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
mkdir -p /shared/rhsm/etc/pki/entitlement
mkdir -p /shared/rhsm/etc/pki/consumer

VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key
-v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z
-v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)
echo "Adding activation key to the build"

if ! grep subscription-manager "$dockerfile_path" | grep -q register; then
# user is not running registration in the Containerfile: pre-register.
echo "Pre-registering with subscription manager."
subscription-manager register --org "$(cat /tmp/activation-key/org)" --activationkey "$(cat /tmp/activation-key/activationkey)"
REGISTERED=$?
# copy generated certificates to /shared/rhsm-tmp
cp /etc/pki/entitlement/*.pem /shared/rhsm-tmp
trap 'subscription-manager unregister || true' EXIT

# copy generated certificates to /shared volume
cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement
cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer

# and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca
VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/run/secrets/rhsm/ca/redhat-uep.pem)
Expand Down Expand Up @@ -541,6 +546,9 @@ spec:
command="$buildah_cmd"
fi

# disable host subcription manager integration
find /usr/share/rhel/secrets -type l -exec unlink {} \;

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
Expand All @@ -562,11 +570,6 @@ spec:
# Needed to generate base images SBOM
echo "$BASE_IMAGES" >/shared/base_images_from_dockerfile

# unregister pod from subscription manager
if [ "$REGISTERED" == "0" ]; then
subscription-manager unregister
fi

buildah push "$IMAGE" "oci:konflux-final-image:$IMAGE"
REMOTESSHEOF
chmod +x scripts/script-build.sh
Expand Down
25 changes: 14 additions & 11 deletions task/buildah-remote/0.2/buildah-remote.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,20 +452,25 @@ spec:
# shared emptydir volume to "/etc/pki/entitlement" to prevent certificates from being included in the produced
# container.

REGISTERED="false"
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
mkdir -p /shared/rhsm/etc/pki/entitlement
mkdir -p /shared/rhsm/etc/pki/consumer

VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \
-v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \
-v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)
echo "Adding activation key to the build"

if ! grep subscription-manager "$dockerfile_path" | grep -q register; then
# user is not running registration in the Containerfile: pre-register.
echo "Pre-registering with subscription manager."
subscription-manager register --org "$(cat /tmp/activation-key/org)" --activationkey "$(cat /tmp/activation-key/activationkey)"
REGISTERED=$?
# copy generated certificates to /shared/rhsm-tmp
cp /etc/pki/entitlement/*.pem /shared/rhsm-tmp
trap 'subscription-manager unregister || true' EXIT

# copy generated certificates to /shared volume
cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement
cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer

# and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca
VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/run/secrets/rhsm/ca/redhat-uep.pem)
Expand Down Expand Up @@ -518,6 +523,9 @@ spec:
command="$buildah_cmd"
fi

# disable host subcription manager integration
find /usr/share/rhel/secrets -type l -exec unlink {} \;

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
Expand All @@ -539,11 +547,6 @@ spec:
# Needed to generate base images SBOM
echo "$BASE_IMAGES" > /shared/base_images_from_dockerfile

# unregister pod from subscription manager
if [ "$REGISTERED" == "0" ]; then
subscription-manager unregister
fi

buildah push "$IMAGE" "oci:konflux-final-image:$IMAGE"
REMOTESSHEOF
chmod +x scripts/script-build.sh
Expand Down
25 changes: 14 additions & 11 deletions task/buildah/0.2/buildah.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -373,20 +373,25 @@ spec:
# shared emptydir volume to "/etc/pki/entitlement" to prevent certificates from being included in the produced
# container.

REGISTERED="false"
if [ -e /activation-key/org ]; then
cp -r --preserve=mode "$ACTIVATION_KEY_PATH" /tmp/activation-key
mkdir /shared/rhsm-tmp
VOLUME_MOUNTS+=(--volume /tmp/activation-key:/activation-key -v /shared/rhsm-tmp:/etc/pki/entitlement:Z)
mkdir -p /shared/rhsm/etc/pki/entitlement
mkdir -p /shared/rhsm/etc/pki/consumer

VOLUME_MOUNTS+=(-v /tmp/activation-key:/activation-key \
-v /shared/rhsm/etc/pki/entitlement:/etc/pki/entitlement:Z \
-v /shared/rhsm/etc/pki/consumer:/etc/pki/consumer:Z)
echo "Adding activation key to the build"

if ! grep subscription-manager "$dockerfile_path" | grep -q register; then
# user is not running registration in the Containerfile: pre-register.
echo "Pre-registering with subscription manager."
subscription-manager register --org "$(cat /tmp/activation-key/org)" --activationkey "$(cat /tmp/activation-key/activationkey)"
REGISTERED=$?
# copy generated certificates to /shared/rhsm-tmp
cp /etc/pki/entitlement/*.pem /shared/rhsm-tmp
trap 'subscription-manager unregister || true' EXIT

# copy generated certificates to /shared volume
cp /etc/pki/entitlement/*.pem /shared/rhsm/etc/pki/entitlement
cp /etc/pki/consumer/*.pem /shared/rhsm/etc/pki/consumer

# and then mount get /etc/rhsm/ca/redhat-uep.pem into /run/secrets/rhsm/ca
VOLUME_MOUNTS+=(--volume /etc/rhsm/ca/redhat-uep.pem:/run/secrets/rhsm/ca/redhat-uep.pem)
Expand Down Expand Up @@ -439,6 +444,9 @@ spec:
command="$buildah_cmd"
fi

# disable host subcription manager integration
find /usr/share/rhel/secrets -type l -exec unlink {} \;

unshare -Uf "${UNSHARE_ARGS[@]}" --keep-caps -r --map-users 1,1,65536 --map-groups 1,1,65536 -w "${SOURCE_CODE_DIR}/$CONTEXT" -- sh -c "$command"

container=$(buildah from --pull-never "$IMAGE")
Expand All @@ -460,11 +468,6 @@ spec:
# Needed to generate base images SBOM
echo "$BASE_IMAGES" > /shared/base_images_from_dockerfile

# unregister pod from subscription manager
if [ "$REGISTERED" == "0" ]; then
subscription-manager unregister
fi

securityContext:
capabilities:
add:
Expand Down
Loading