Red Hat Software Certification Workflow Guide Red Hat Software Certification 2025 For Use with Red Hat Enterprise Linux and Red Hat OpenShift Red Hat Customer Content Services

Commands:
For example: {Partner Certification} Error occurred while submitting certification test results using the Red Hat Certification application.
subscription-manager register
subscription-manager list --available*
subscription-manager attach --pool= <pool_ID >
subscription-manager repos --enable=cert-1-for-rhel-8- <HOSTTYPE> -rpms
uname -m
subscription-manager repos --enable=cert-1-for-rhel-8-x86_64-rpms
subscription-manager repos --enable=cert-1-for-rhel-9- <HOSTTYPE> -rpms
uname -m
subscription-manager repos --enable=cert-1-for-rhel-9-x86_64-rpms
dnf install redhat-certification-software
rhcert-provision <path_to_test_plan_document>
rhcert-provision
rhcert-run
rhcert-save
dnf install redhat-certification-cockpit
podman login --username <your_username> --password <your_password> --authfile ./temp-authfile.json <registry>
preflight check container registry.example.org/<namespace>/<image_name>:<image_tag>
preflight support
preflight check container registry.example.org/<namespace>/<image_name>:<image_tag> --submit --pyxis-api-token=<api_token> --certification-project-id=<project_id> --docker-config=./temp-authfile.json
chcon -Rv -t container_file_t "storage_path(/.*)?"
├── operators └── my-operator └── v1.0
├── config.yaml ├── operators └── my-operator ├── v1.4.8 │ ├── manifests │ │ ├── cache.example.com_my-operators.yaml │ │ ├── my-operator-controller-manager-metrics-service_v1_service.yaml │ │ ├── my-operator-manager-config_v1_configmap.yaml │ │ ├── my-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml │ │ └── my-operator.clusterserviceversion.yaml │ └── metadata │ └── annotations.yaml └── ci.yaml
new-project oco
export KUBECONFIG=/path/to/your/cluster/kubeconfig
create secret generic kubeconfig --from-file=kubeconfig=USDKUBECONFIG
create secret generic github-api-token --from-literal GITHUB_TOKEN=<github token>
create secret generic pyxis-api-secret --from-literal pyxis_api_key=< API KEY >
apiVersion: v1 kind: PersistentVolume metadata: name: my-local-pv spec: capacity: storage: 5Gi volumeMode: Filesystem accessModes: - ReadWriteOnce persistentVoumeReclaimPolicy: Delete local: path: /dev/vda4 <- use a path from your cluster nodeAffinity: required: nodeSelectorTerms: - matchExpressions: - key: kubernetes.io/hostname operator: In values: - crc-8k6jw-master-0 <- use the name of one of your cluster's node
get pods -n openshift-marketplace
get logs -f -n openshift-operators <pod name> manager
cat <<EOF> workspace-template.yml spec: accessModes: - ReadWriteOnce resources: requests: storage: 5Gi EOF
export KUBECONFIG=/path/to/your/cluster/kubeconfig
adm new-project <my-project-name> # create the project project <my-project-name> # switch into the project
create secret generic kubeconfig --from-file=kubeconfig=USDKUBECONFIG
import-image certified-operator-index --from=registry.redhat.io/redhat/certified-operator-index --reference-policy local --scheduled --confirm --all
USDgit clone https://github.com/redhat-openshift-ecosystem/operator-pipelines USDcd operator-pipelines USDoc apply -R -f ansible/roles/operator-pipeline/templates/openshift/pipelines USDoc apply -R -f ansible/roles/operator-pipeline/templates/openshift/tasks
create secret generic github-api-token --from-literal GITHUB_TOKEN=<github token>
create secret generic pyxis-api-secret --from-literal pyxis_api_key=< API KEY >
base64 /path/to/private/key
cat << EOF > ssh-secret.yml kind: Secret apiVersion: v1 metadata: name: github-ssh-credentials data: id_rsa: | <base64 encoded private key> EOF
create -f ssh-secret.yml
create secret docker-registry registry-dockerconfig-secret --docker-server=quay.io --docker-username=<registry username> --docker-password=<registry password> --docker-email=<registry email>
apply -f ansible/roles/operator-pipeline/templates/openshift/openshift-pipelines-custom-scc.yml
adm policy add-scc-to-user pipelines-custom-scc -z pipeline
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (For example - operators/my-operator/1.2.8) tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --showlog
--param kubeconfig_secret_name=kubeconfig --param kubeconfig_secret_key=kubeconfig
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) GIT_USERNAME=<your github username> GIT_EMAIL=<your github email address> tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --param pin_digests=true --param git_username=USDGIT_USERNAME --param git_email=USDGIT_EMAIL --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --workspace name=ssh-dir,secret=github-ssh-credentials --showlog
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) GIT_USERNAME=<your github username> GIT_EMAIL=<your github email address> REGISTRY=<your image registry. ie: quay.io> IMAGE_NAMESPACE=<namespace in the container registry> tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --param pin_digests=true --param git_username=USDGIT_USERNAME --param git_email=USDGIT_EMAIL --param registry=USDREGISTRY --param image_namespace=USDIMAGE_NAMESPACE --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --workspace name=ssh-dir,secret=github-ssh-credentials --workspace name=registry-credentials,secret=registry-docker config-secret --showlog \
-param upstream_repo_name=USDUPSTREAM_REPO_NAME #Repo where Pull Request (PR) will be opened --param submit=true
--param pyxis_api_key_secret_name=pyxis-api-secret --param pyxis_api_key_secret_key=pyxis_api_key
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param upstream_repo_name=redhat-openshift-ecosystem/certified-operators --param submit=true --param env=prod --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --showlog
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) GIT_USERNAME=<your github username> GIT_EMAIL=<your github email address> tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --param pin_digests=true --param git_username=USDGIT_USERNAME --param git_email=USDGIT_EMAIL --param upstream_repo_name=redhat-openshift-ecosystem/certified-operators --param submit=true --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --workspace name=ssh-dir,secret=github-ssh-credentials --showlog
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) GIT_USERNAME=<your github username> GIT_EMAIL=<your github email address> REGISTRY=<your image registry. ie: quay.io> IMAGE_NAMESPACE=<namespace in the container registry> tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --param pin_digests=true --param git_username=USDGIT_USERNAME --param git_email=USDGIT_EMAIL --param registry=USDREGISTRY --param image_namespace=USDIMAGE_NAMESPACE --param upstream_repo_name=redhat-openshift-ecosystem/certified-operators --param submit=true --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --workspace name=ssh-dir,secret=github-ssh-credentials --workspace name=registry-credentials,secret=registry-docker config-secret --showlog
GIT_REPO_URL=<Git URL to your certified-operators fork > BUNDLE_PATH=<path to the bundle in the Git Repo> (ie: operators/my-operator/1.2.8) GIT_USERNAME=<your github username> GIT_EMAIL=<your github email address> REGISTRY=<your image registry. ie: quay.io> IMAGE_NAMESPACE=<namespace in the container registry> tkn pipeline start operator-ci-pipeline --param git_repo_url=USDGIT_REPO_URL --param git_branch=main --param bundle_path=USDBUNDLE_PATH --param env=prod --param pin_digests=true --param git_username=USDGIT_USERNAME --param git_email=USDGIT_EMAIL --param upstream_repo_name=redhat-openshift-ecosystem/certified-operators --param registry=USDREGISTRY --param image_namespace=USDIMAGE_NAMESPACE --param submit=true --workspace name=pipeline,volumeClaimTemplateFile=templates/workspace-template.yml --workspace name=ssh-dir,secret=github-ssh-credentials --workspace name=registry-credentials,secret=registry-docker config-secret --showlog
├── operators └── my-operator └── v1.0
├── config.yaml ├── operators └── my-operator ├── v1.4.8 │ ├── manifests │ │ ├── cache.example.com_my-operators.yaml │ │ ├── my-operator-controller-manager-metrics-service_v1_service.yaml │ │ ├── my-operator-manager-config_v1_configmap.yaml │ │ ├── my-operator-metrics-reader_rbac.authorization.k8s.io_v1_clusterrole.yaml │ │ └── my-operator.clusterserviceversion.yaml │ └── metadata │ └── annotations.yaml └── ci.yaml
. └── src ├── Chart.yaml ├── README.md ├── templates │ ├── deployment.yaml │ ├── _helpers.tpl │ ├── hpa.yaml │ ├── ingress.yaml │ ├── NOTES.txt │ ├── serviceaccount.yaml │ ├── service.yaml │ └── tests │ └── test-connection.yaml ├── values.schema.json └── values.yaml
helm package <helmchart folder>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube "quay.io/redhat-certification/chart-verifier" verify <chart-uri>
podman run --rm -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube -v USD(pwd):/charts "quay.io/redhat-certification/chart-verifier" verify /charts/<chart>
podman run -it --rm quay.io/redhat-certification/chart-verifier verify --help
Verifies a Helm chart by checking some of its characteristics Usage: chart-verifier verify <chart-uri> [flags] Flags: -S, --chart-set strings set values for the chart (can specify multiple or separate values with commas: key1=val1,key2=val2) -G, --chart-set-file strings set values from respective files specified via the command line (can specify multiple or separate values with commas: key1=path1,key2=path2) -X, --chart-set-string strings set STRING values for the chart (can specify multiple or separate values with commas: key1=val1,key2=val2) -F, --chart-values strings specify values in a YAML file or a URL (can specify multiple) --debug enable verbose output -x, --disable strings all checks will be enabled except the informed ones -e, --enable strings only the informed checks will be enabled --helm-install-timeout duration helm install timeout (default 5m0s) -h, --help help for verify --kube-apiserver string the address and the port for the Kubernetes API server --kube-as-group stringArray group to impersonate for the operation, this flag can be repeated to specify multiple groups. --kube-as-user string username to impersonate for the operation --kube-ca-file string the certificate authority file for the Kubernetes API server connection --kube-context string name of the kubeconfig context to use --kube-token string bearer token used for authentication --kubeconfig string path to the kubeconfig file -n, --namespace string namespace scope for this request -V, --openshift-version string set the value of certifiedOpenShiftVersions in the report -o, --output string the output format: default, json or yaml -k, --pgp-public-key string file containing gpg public key of the key used to sign the chart -W, --web-catalog-only set this to indicate that the distribution method is web catalog only (default: true) --registry-config string path to the registry config file (default "/home/baiju/.config/helm/registry.json") --repository-cache string path to the file containing cached repository indexes (default "/home/baiju/.cache/helm/repository") --repository-config string path to the file containing repository names and URLs (default "/home/baiju/.config/helm/repositories.yaml") -s, --set strings overrides a configuration, e.g: dummy.ok=false -f, --set-values strings specify application and check configuration values in a YAML file or a URL (can specify multiple) -E, --suppress-error-log suppress the error log (default: written to ./chartverifier/verifier-<timestamp>.log) --timeout duration time to wait for completion of chart install and test (default 30m0s) -w, --write-to-file write report to ./chartverifier/report.yaml (default: stdout) Global Flags: --config string config file (default is USDHOME/.chart-verifier.yaml)
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube "quay.io/redhat-certification/chart-verifier" verify -enable images-are-certified,helm-lint <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube "quay.io/redhat-certification/chart-verifier" verify -disable images-are-certified,helm-lint <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube "quay.io/redhat-certification/chart-verifier" verify -chart-set default.port=8080 <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube -v USD(pwd):/values "quay.io/redhat-certification/chart-verifier" verify -chart-values /values/overrides.yaml <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube -v USD(pwd):/values "quay.io/redhat-certification/chart-verifier" verify --timeout 40m <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube "quay.io/redhat-certification/chart-verifier" verify -enable images-are-certified,helm-lint <chart-uri> > report.yaml
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube -v USD(pwd)/chartverifier:/app/chartverifier -w "quay.io/redhat-certification/chart-verifier" verify -enable images-are-certified,helm-lint <chart-uri>
podman run --rm -i -e KUBECONFIG=/.kube/config -v "USD{HOME}/.kube":/.kube -v USD(pwd)/chartverifier:/app/chartverifier "quay.io/redhat-certification/chart-verifier" verify -enable images-are-certified,helm-lint <chart-uri> > report.yaml
tar zxvf <tarball>
./chart-verifier verify <chart-uri>
chart: name: awesome shortDescription: A Helm chart for Awesomeness publicPgpKey: null providerDelivery: False users: - githubUsername: <username-one> - githubUsername: <username-two> vendor: label: acme name: ACME Inc.
charts/partners/acme/awesome/0.1.0/
charts/partners/acme/awesome/0.1.0/awesome-0.1.0.tgz charts/partners/acme/awesome/0.1.0/awesome-0.1.0.tgz.prov
awesome-0.1.0.tgz awesome-0.1.0.tgz.prov awesome-0.1.0.tgz.key report.yaml
. └── src ├── Chart.yaml ├── README.md ├── templates │ ├── deployment.yaml │ ├── _helpers.tpl │ ├── hpa.yaml │ ├── ingress.yaml │ ├── NOTES.txt │ ├── serviceaccount.yaml │ ├── service.yaml │ └── tests │ └── test-connection.yaml ├── values.schema.json └── values.yaml
gpg --sign --armor --detach-sign --output report.yaml.asc report.yaml
awesome-0.1.0.tgz.key report.yaml
<partner-label>-<chart-name>-<version-number> index.yaml (#<PR-number>) (e.g, acme-psql-service-0.1.1 index.yaml (#7)).
mkdir -p test-results; cd test-results podman run -v "USD(pwd):/data:z" -w /data --rm -it USD(KUBECONFIG=USD(pwd)/kubeconfig.yaml oc adm release info --image-for=tests) sh -c "KUBECONFIG=/data/kubeconfig.yaml /usr/bin/openshift-tests run openshift/network/third-party -o /data/results.txt"
curl -L https://github.com/kubevirt/kubevirt/releases/download/v<KubeVirt version>/conformance.yaml -o kubevirt-conformance.yaml
sonobuoy run --skip-preflight --plugin kubevirt-conformance.yaml
sonobuoy status
sonobuoy retrieve
sonobuoy results <tarball>
Plugin: kubevirt-conformance Status: passed Total: 637 Passed: 9 Failed: 0 Skipped: 628
describe
oc config view --raw > kubeconfig.yaml
mkdir -p test-results; cd test-results podman run -v "USD(pwd):/data:z" -w /data --rm -it USD(KUBECONFIG=USD(pwd)/kubeconfig.yaml oc adm release info --image-for=tests) sh -c "KUBECONFIG=/data/kubeconfig.yaml TEST_CSI_DRIVER_FILES=/data/manifest.yaml /usr/bin/openshift-tests run openshift/csi -o /data/results.txt"
run -v `pwd`:/data:z --rm -it registry.redhat.io/openshift4/ose-tests sh -c "KUBECONFIG=/data/kubeconfig.yaml TEST_CSI_DRIVER_FILES=/data/manifest.yaml /usr/bin/openshift-tests run --dry-run openshift/csi
oc get clusterversion -o yaml
podman image list registry.redhat.io/openshift4/ose-tests
oc get configmap storage-checkup-config -n <target_namespace> -o yaml