Configuration of RH Entitlements

[rtaniwa]

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Additional context

[adelton]

@rtaniwa Could you please describe in more details what the use-cases would be for the solution delivered by this request? Is it handling of entitlements for RHEL-based container image builds on the existing Ubuntu GitHub Actions environments, or something else?

[rtaniwa]

Hi @adelton. I will let @jduimovich add the details. I opened this up as a placeholder during some of our planning discussions, but we never circled back to add the details required.

[jduimovich]

@adelton Yes, the main use case is around entitlements for RHEL based container builds but we also see use cases for the using github actions runner (in openshift as well as on direcly on a customers RHEL).
The issue will be to enable consistency in a customers workflow such that it runs transparently on GH VMs or on OpenShift Runners or on RHEL natively.

For containers its configuration and management of a subscription

1. simplify team configuration and access to registry.redhat.io, registry.connect.redhat.com (github org level configurations)
2. management of entitlements in rhel based containers to run install/update (yum, dnf)
3. subscription manager inside containers with proper lifecycle (unsubscribe).
4. security concerns to ensure entitlement subscriptions don't leak

For runners, same use cases (running a standard workflow) but with usage of the customer environment.
We also had some thoughts on making RHEL an official runner or simplify the connection of RHEL to GHA which would make reuse in customer HW/SW environment simpler.

Lastly there was a consideration to enable a github app to manage all this automatically (install / remove entitlements as needed by actions) and we could incorporate that app into the redhat dev portal to simplify customers use of entitlements with github actions.

Much of this can be done manually today with manual configuration movement of entitlement files and these use cases would simplify the use experience.

If you have thoughts on these use cases, perhaps there are other scenarios we had not considered or solutions already available we are unaware of, I'd like to hear it.

[adelton]

Hello, I've now filed #60 to show a possible implementation of an Action which allows to entitle podman build (and podman run but those I assume install Red Hat content less often) by adding single step to the workflow, without changing Dockerfiles or modifying the podman build commands.

[adelton]

@jduimovich, @divyansh42 Could I get some feedback on the #60 proposal? I'd like to start using it to test RHEL-based images of https://github.com/freeipa/freeipa-container and while I can certainly put the same logic to that repository, I'd prefer to use some standard and generally accepted approach.