Obtain credentials for Lumi Enterprise on OpenShift

info

This information applies to Imply Lumi Enterprise deployments on OpenShift.
Lumi Enterprise on OpenShift is an early access feature.

Before you install Imply Lumi Enterprise on OpenShift, set up the credentials required for your deployment. This topic explains how to obtain the required credentials.

In this topic, placeholder values are shown in uppercase—for example, YOUR_DOCKERHUB_USERNAME. Replace these with values for your own environment.

Docker Hub credentials

Imply stores Lumi container images in a private Docker Hub repository. To pull the images, your OpenShift cluster needs Docker Hub credentials with access to that repository.

When you sign up for Lumi, you provide the email address for your Docker Hub account. Imply invites you to join its Docker Hub organization and grants you access to the Lumi repository.

Lumi requires a Docker Hub personal access token (PAT) with Read-only access permissions to pull container images. A PAT is a security credential you use to authenticate with a service instead of using a username and password. If you don't already have a PAT, generate one in Docker Hub and set Access permissions to Read-only. The default, Public Repo Read-only, only allows access to public repositories, so your cluster can't pull images from the private Lumi repository. For more information, see Create and manage personal access tokens in the Docker documentation.

Your cluster needs a Kubernetes secret containing your Docker Hub credentials before it can pull Lumi images. The Helm chart can create the secret for you, or you can create it yourself:

Helm chart creates the secret

To have the Helm chart create the secret for you, add your Docker Hub username and PAT directly to values.yaml. The chart creates the secret as part of installation.

  registry:
    dockerhub:
      username: YOUR_DOCKERHUB_USERNAME
      password: YOUR_DOCKERHUB_PAT

Use the Docker Hub PAT, not your account password. You must set both fields together, or the install fails with a validation error.

You create the secret

To create the secret manually, base64-encode your username and PAT into a .dockerconfigjson file, then use that file to create a Kubernetes secret:

USERNAME="YOUR_DOCKERHUB_USERNAME"
PAT="YOUR_DOCKERHUB_PAT"
NAMESPACE="NAMESPACE"
PRIVATE_REGISTRY_SECRET_NAME="PRIVATE_REGISTRY_ACCESS"

AUTH=$(echo -n "${USERNAME}:${PAT}" | base64 -w 0)

cat > .dockerconfigjson << EOF
{
    "auths": {
        "https://index.docker.io/v1/": {
            "auth": "${AUTH}"
        },
        "registry-1.docker.io": {
            "auth": "${AUTH}"
        }
    }
}
EOF

# Skip this command if the namespace already exists.
oc create namespace ${NAMESPACE}

oc create secret generic ${PRIVATE_REGISTRY_SECRET_NAME} \
  --from-file=.dockerconfigjson=.dockerconfigjson \
  --type=kubernetes.io/dockerconfigjson \
  --namespace=${NAMESPACE} \
  -o yaml

rm .dockerconfigjson

Point the chart at your secret by name in values.yaml:

registry:
  pullSecret: PRIVATE_REGISTRY_ACCESS

tip

If pods fail to start with an ImagePullBackOff or unauthorized error, check that your PAT's Access permissions are set to Read-only, not Public Repo Read-only.

Lumi onboarding credentials

Contact your Imply support representative to obtain the following Lumi onboarding credentials:

• Tenant ID
• Customer ID
• API key

You set these in values.yaml as tenantId, customerId, and apiKey. You also need the tenant ID when you configure permissions.

RSA key pair

Lumi uses an RSA key pair to sign and verify authentication tokens.

Generate an RSA key pair:

openssl genrsa -out private.pem 2048
openssl rsa -in private.pem -pubout -out public.pem

You need to add both RSA keys to your values.yaml. Make sure to preserve the indentation and include the full key including the header and footer lines:

auth:
  rsa:
    privateKey: |
      -----BEGIN RSA PRIVATE KEY-----
      <paste private key content here>
      -----END RSA PRIVATE KEY-----
    publicKey: |
      -----BEGIN PUBLIC KEY-----
      <paste public key content here>
      -----END PUBLIC KEY-----

tip

Treat the private key as a secret. Don't commit it to source control or share it.

Next step

After you gather your credentials, continue to Configure permissions.