Chapter 3. Configure additional OpenID Connect providers 3.1. Configuring Google as an OpenID Connect provider for Trusted Artifact Signer You can use Google OAuth 2.0 as your OpenID Connect (OIDC) provider for Red Hat's Trusted Artifact Signer (RHTAS) service. You can decide to configure Google OAuth during the deployment of RHTAS, or at a later time. Important You can define several different OIDC providers in the same configuration. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. Access to the OpenShift web console with the cluster-admin role. A workstation with the oc , and podman binaries installed. From the Google Cloud Console , create an OAuth client ID with the following settings: Set the application type to "Web Application". Authorized redirect URIs must include: http://localhost/auth/callback . Procedure Open a terminal on your workstation, and log in to OpenShift: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example Note You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Update the RHTAS configuration. Open for editing the Securesign resource: Syntax oc edit Securesign NAME -n NAMESPACE Example Note You must use the project name created for the RHTAS installation as the namespace. Under the OIDCIssuers section, add a new subsection with your Google client identifier, issuer's URL, and set the Type value to email : Syntax ... OIDCIssuers: - Issuer: "https://accounts.google.com" IssuerURL: "https://accounts.google.com" ClientID: " CLIENT_ID " Type: email ... Add you Google client identifier to the ClientID field. Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack. Change the OIDC issuer, and client id environment variables to use Google: Example Copy and paste your secret from the Google Console to a plain text file: Syntax echo SECRET > my-google-client-secret If you already have the RHTAS service running, you can verify the updated configuration by signing a test container image. Create an empty container image: Example Push the empty container image to the ttl.sh ephemeral registry: Example Remove the temporary Docker file: Example Sign the container image: Syntax cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG Example A web browser opens allowing you to sign the container image with an email address. Additional resources Creating Google OAuth credentials . 3.2. Configuring Red Hat SSO as an OpenID Connect provider for Trusted Artifact Signer You can use Red Hat Single Sign-On (SSO) as your OpenID Connect provider for Red Hat's Trusted Artifact Signer (RHTAS) service. This gives you a Keycloak authentication environment for applications and secure services. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. Access to the OpenShift web console with the cluster-admin role. Have 1 GB of container storage available for the Keycloak PostgreSQL database. A workstation with the oc binary installed. Procedure Log in to the OpenShift web console with a user that has the cluster-admin role. Create a new project to deploy the Keycloak service. From the Administrator perspective, expand Home from the navigation menu, and click Projects . Click the Create Project button. The new project name is keycloak-system , and click the Create button. Expand Operators from the navigation menu, and click OperatorHub . In the search field, type sso , and click the Red Hat Single Sign-on tile. Click the Install button to show the operator details. If not already set, select keycloak-system from the Installed Namespace drop-down menu. Click Install on the Install Operator page, and wait for the installation to finish. After the installation finishes, click View Operator . From your workstation terminal, log in to the OpenShift cluster: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example Note You can find your login token and URL to use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Switch to the Keycloak project: Example Create a Keycloak instance: Example Create a Keycloak realm: Example Create a Keycloak client: Example Create a Keycloak user: Example Set a user name, the user's email address, and a password or reference a secret object. Go back to the OpenShift web console, click the All instances tab to watch and wait until the Keycloak system initializes successfully. Additional resources Installing Red Hat Trusted Artifact Signer on OpenShift . 3.3. Configuring Red Hat build of Keycloak as an OpenID Connect provider for Trusted Artifact Signer You can configure Red Hat's build of Keycloak (RHBK) as an OpenID Connect (OIDC) provider for Red Hat's Trusted Artifact Signer (RHTAS) service. This procedure guides you on integrating RHBK with RHTAS. Important You can define several different OIDC providers for Fulcio in the same SecureSign configuration. Prerequisites A RHTAS installation on OpenShift Container Platform version 4.13 or later. Access to the OpenShift web console with the cluster-admin role. A workstation with the oc binary installed. Have 1 GB of persistent storage available for the Keycloak PostgreSQL database . A TLS certificate and key . Procedure Log in to the OpenShift web console with a user that has the cluster-admin role. Create a new project to deploy the Keycloak service. From the Administrator perspective, expand Home from the navigation menu, and click Projects . Click the Create Project button. The new project name is keycloak-system , and click the Create button. Deploy an instance of PostgreSQL for use by Keycloak to store persistent data. Important If a database already exists for use by Keycloak, replace the username , password and database name values for the Secret resource that corresponds with your database instance. You can skip the creation of the PostgreSQL Service and StatefulSet steps, and move ahead to the step. Create a Secret resource to store the database information. Expand Workloads from the navigation menu, and click Secrets . Select the keycloak-system from the Project drop-down menu. Click the Create drop-down menu, and select Key/Value secret . Enter postgresql-db in the Secret name field. Enter username in the Key field. Enter keycloak in the Value field. This is the user name Keycloak uses to authenticate to the PostgreSQL database instance. Click the Add key/value link to add another key-value pair. Enter password in the Key field. Enter a password of your choice in the Value field. This is the password Keycloak uses to authenticate to the PostgreSQL database instance. Click the Add key/value link to add another key-value pair. Enter database in the Key field. Enter keycloak in the Value field. This is the name of the database for storing Keycloak data within the PostgreSQL database instance. Click the Create button. Create the PostgreSQL Service and StatefulSet. Click the + icon. Copy the Service and StatefulSet YAML configuration text , and on the Import YAML page, paste the text into the text editor box. Click the Create button to add the Service and StatefulSet to the keycloak-system project. Open a terminal from your workstation, and log in to the OpenShift cluster: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example Note You can find your login token and URL to use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Create a new Secret resource to contain the Transport Layer Security (TLS) certificate and the corresponding private key: Syntax oc create secret tls SECRET_NAME -n NAMESPACE --cert CERTIFICATE_FILE_NAME --key PRIVATE_KEY_FILE_NAME Example Note The OpenShift's service serving certificate can automate the generation and management of a TLS certificates for use by Keycloak. Refer to the appendix for more information. In OpenShift web console, expand Operators from the navigation menu, and click OperatorHub . In the search field, type keycloak , and click the Keycloak Operator tile from the certified Red Hat catalog. Click the Install button to show the operator details. On the Install Operator page, select keycloak-system from the Installed Namespace drop-down menu, and click the Install button. Wait for the installation to finish. After the installation finishes, click the View Operator button. Click Create instance on the Keycloak tile. On the Create Keycloak page, select YAML view . On the name line, replace example-keycloak with your custom name, for example, keycloak . The host name can either be explicitly specified within the hostname property or automatically generated similar to other routes. On the hostname line, replace example.org with your custom host name. Note See the appendix for the steps necessary to have OpenShift generate the host name for the Keycloak instance. Under the spec section, add your database details: Example spec: ... db: vendor: postgres host: postgresql-db usernameSecret: name: postgresql-db key: username passwordSecret: name: postgresql-db key: password ... Also, under the spec section, for the http property, specify the name of the Secret resource containing the TLS certificates. Example spec: ... http: tlsSecret: keycloak-tls ... Click the Create button. Expand the Networking navigation menu, and click Routes . To open the Keycloak Administration Console, click the link to the route associated with the Keycloak instance. The default credentials for the admin user are stored in a Secret called keycloak-initial-admin . To locate the password, expand the Workloads navigation menu, and click Secrets . Select the keycloak-initial-admin Secret. Under the Data section, locate the password key, and click the icon. On the Keycloak Administration Console log in page, enter admin as the username, and paste the contents of the step as the password. Create a new realm called trusted-artifact-signer . On the navigation menu, select the Red Hat Build of Keycloak drop-down menu. Select Create Realm . Enter trusted-artifact-signer as the Resource name . Click Create to create the new realm. Create a new User . The new user can log in to the Keycloak Administration Console, and can also sign containers and commits using RHTAS. On the navigation menu, under the Manage section, and select Clients . Click the Create Client button In the Client Id field, enter trusted-artifact-signer . Optionally, you can enter a Name and Description into the corresponding fields. Click . Accept the default options for the Capability Config step of the new client creation process. Click . In the Valid redirect URIs field, enter * . Click Save to create the client. On the navigation menu, under the Configure section, select Realm Settings to locate the Issuer URL for the trusted-artifact-signer realm. to Endpoints , click the OpenID Endpoint Configuration link. Copy the URL from the issuer property. Under the .spec.fulcio.config.OIDCIssuers section of the SecureSign resource for RHTAS, replace CLIENT_ID with trusted-artifact-signer , and paste the URL content to replace RHBK_REALM_ISSUER_URL : Syntax spec: ... fulcio: config: OIDCIssuers: - ClientID: CLIENT_ID Issuer: ' RHBK_REALM_ISSUER_URL ' IssuerURL: ' RHBK_REALM_ISSUER_URL ' Type: email ... Example 3.4. Configuring Amazon STS as an OpenID Connect provider for Trusted Artifact Signer You can use Amazon's Security Token Service (STS) as your OpenID Connect (OIDC) provider for Red Hat's Trusted Artifact Signer (RHTAS) service. You can decide to configure Amazon STS during the deployment of RHTAS, or at a later time. Important You can define several different OIDC providers in the same configuration. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. Access to the OpenShift web console with the cluster-admin role. A workstation with the oc , podman , and aws binaries installed. Enable managed Amazon Web Service (AWS) Resources for OpenShift environments. A created Amazon Identity and Access Management (IAM) user with full permissions. This allows access to run IAM operations. Created access keys for this user. Procedure Open a terminal on your workstation, and log in to OpenShift: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example Note You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Find the AWS OIDC provider URL: Example Update RHTAS the configuration. Open for editing the Securesign resource: Syntax oc edit Securesign NAME -n NAMESPACE Example Note You must use the project name created for the RHTAS installation as the namespace. Under the OIDCIssuers section, add a new subsection with your AWS STS client identifier, issuer's URL, and set the Type value to kubernetes : Example Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack. Configure the AWS command-line tool by entering your access key, secret key, default region, and output format: Example Set the following environment variables: Example Create a Trust Policy that gets associated with newly created IAM roles: Example Create a new IAM role for the RHTAS service by using the trust policy: Example On the OpenShift cluster with STS enabled, create a new project namespace: Syntax oc new-project NAMESPACE Example Create a service account for assuming an IAM role, and running a workload within the OpenShift project namespace. Create the service account manifest: Example Apply the service account manifest to OpenShift: Example Create a new deployment workload for signing container images within a image registry. Create the deployment manifest: Example Apply the deployment manifest to OpenShift: Example Create a test container image to sign. Create an empty container image: Example Push the empty container image to the ttl.sh ephemeral registry: Example Remove the temporary Docker file: Example Validate the configuration by signing and verifying the test container image. Open a remote shell session within a running pod: Syntax oc rsh -n NAMESPACE deployment/cosign-sts env IMAGE= IMAGE_NAME:TAG /bin/sh Example Sign the container image: Example Verify the signed container image: Example 3.5. Configuring GitHub as an OpenID Connect provider for Trusted Artifact Signer You can use GitHub OAuth 2.0 when federating it with Red Hat's Single Sign-On (SSO) service as an OpenID Connect (OIDC) provider for the Red Hat Trusted Artifact Signer (RHTAS) service. This procedure guides you on integrating GitHub OAuth with an existing Red Hat SSO deployment on OpenShift. Important You can define several different OIDC providers in the same configuration. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. A running Red Hat SSO instance. A workstation with the oc binary installed. Create a GitHub OAuth app , and after registering the application, make note of the client identifier and secret values. Important When registering your new GitHub OAuth app, you must specify the Homepage URL , and the Authorization callback URL . Enter placeholder values for both of these fields, for example, https://localhost:8080 . Later in this procedure you will modify your GitHub OAuth app with the intended values for these fields. Procedure Open a terminal on your workstation, and log in to OpenShift: Syntax oc login --token= TOKEN --server= SERVER_URL_AND_PORT Example Note You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command . Offer your user name and password again, if asked, and click Display Token to view the command. Log in to the Red Hat SSO console. Find the Red Hat SSO console URL from the command line: Example Copy and paste the Red Hat SSO console URL into your web browser. Click Administration Console . Retrieve the admin password from the command line: Example Copy the output from this command. From your web browser, log in as the admin user, and paste the password in the corresponding field. Click the Sign In button. Select your realm from the dropdown on the navigation menu. Add the GitHub identity provider. From the navigational menu, click Identity Providers . From the Add provider... drop-down menu, select GitHub . Add your GitHub OAuth client identifier to the Client ID field. Add your GitHub OAuth client secret to the Client Secret field. Turn on the Trust Email option. Click the Save button. Add the identity provider mapper to the newly created identity provider. Click the Mapper tab. Click the Create button. Give a Name to the new mapper. Change the Mapper Type to Hardcoded Attribute . Set the User Attribute field to emailVerified . Set the User Attribute Value field to true . Click the Save button. From the GitHub Identity Provider Settings page, copy the Redirect URI value and paste it to your GitHub OAuth app Authorization Callback URL field. Also, paste this same value into the Homepage URL field, but remove the broker/github/endpoint part of the URL string. Click Update Application . You can now sign commits , and containers by using GitHub as your OIDC provider. When signing artifacts, a web browser opens and prompts you to sign in to your Red Hat SSO account. Click the GitHub button to sign in with your credentials. Click the Authorize button to enable GitHub user details to be accessible by Red Hat SSO. Additional resources Installing Red Hat Trusted Artifact Signer on OpenShift . Using cosign for signing and verifying . Using gitsign for signing and verifying . 3.6. Configuring Microsoft Entra ID as an OpenID Connect provider for Trusted Artifact Signer You can use Microsoft Entra ID as your OpenID Connect (OIDC) provider for Red Hat's Trusted Artifact Signer (RHTAS) service. You can decide to configure Microsoft Entra ID during the deployment of RHTAS, or at a later time. Note Integrating Microsoft Entra ID into RHTAS requires no subscriptions. Important You can define several different OIDC providers in the same configuration. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. A Microsoft Azure account with permissions to create resources. An Azure verified email address for users signing artifacts. Access to the Microsoft Azure command-line interface. A workstation with the oc , cosign , podman , and az binaries installed. Procedure Open a terminal on your workstation. Create an App Registration within Microsoft Entra ID representing a client: Example Create a new client secret that allows user to use the App Registration to get a ID token: Example Note By default, client secrets are only valid for one year. You can customize this value by using the --years or --end-date flags. Create a new Claim Mapping Policy to define a new JWT claim called email_verified , use a static value of true : Example Get the App Registration object identifier: Example Update the App Registration manifest: Example Create a new Service Principal and associate it with the App Registration: Example Get the Claim Mapping Policy identifier: Example Associate the Claim Mapping Policy with the Service Principal: Example Get the tenant identifier: Example Get OIDC endpoint: Example Update the RHTAS configuration. Open for editing the Securesign resource: Syntax oc edit Securesign NAME -n NAMESPACE Example Note You must use the project name created for the RHTAS installation as the namespace. Under the OIDCIssuers section, add a new subsection with the client identifier, issuer's URL, and set the Type value to email : Syntax ... OIDCIssuers: - Issuer: "USD{ENTRA_ID_OIDC_ENDPOINT}" IssuerURL: "USD{ENTRA_ID_OIDC_ENDPOINT}" ClientID: "USD{RHTAS_APP_REGISTRATION}" Type: email ... Save your changes, and quit the editor. After a few seconds the operator automatically reconfigures the RHTAS software stack. Create a local client secret file: Example Configure your shell environment for signing artifacts: Example Initialize the local machine for signing: Example Verify the updated configuration by signing a test container image. Create an empty container image: Example Push the empty container image to the ttl.sh ephemeral registry: Example Remove the temporary Docker file: Example Sign the container image: Syntax cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG Example A web browser opens allowing you to sign the container image with an email address.

Commands:
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "https://accounts.google.com" IssuerURL: "https://accounts.google.com" ClientID: " CLIENT_ID " Type: email
export OIDC_ISSUER_URL=https://accounts.google.com export COSIGN_OIDC_CLIENT_ID="314919563931-35zke44ouf2oiztjg7v8o8c2ge9usnd1.apps.googleexample.com"
echo SECRET > my-google-client-secret
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG
cosign sign -y --oidc-client-secret-file=my-google-client-secret ttl.sh/rhtas/test-image:1h
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc project keycloak-system
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: Keycloak metadata: labels: app: sso name: keycloak spec: externalAccess: enabled: true instances: 1 keycloakDeploymentSpec: imagePullPolicy: Always postgresDeploymentSpec: imagePullPolicy: Always EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakRealm metadata: labels: app: sso name: trusted-artifact-signer spec: instanceSelector: matchLabels: app: sso realm: displayName: Red-Hat-Trusted-Artifact-Signer enabled: true id: trusted-artifact-signer realm: trusted-artifact-signer sslRequired: none EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakClient metadata: labels: app: sso name: trusted-artifact-signer spec: client: attributes: request.object.signature.alg: RS256 user.info.response.signature.alg: RS256 clientAuthenticatorType: client-secret clientId: trusted-artifact-signer defaultClientScopes: - profile - email description: Client for Red Hat Trusted Artifact Signer authentication directAccessGrantsEnabled: true implicitFlowEnabled: false name: trusted-artifact-signer protocol: openid-connect protocolMappers: - config: claim.name: email id.token.claim: "true" jsonType.label: String user.attribute: email userinfo.token.claim: "true" name: email protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: claim.name: email-verified id.token.claim: "true" user.attribute: emailVerified userinfo.token.claim: "true" name: email-verified protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: claim.name: aud claim.value: trusted-artifact-signer id.token.claim: "true" access.token.claim: "true" userinfo.token.claim: "true" name: audience protocol: openid-connect protocolMapper: oidc-hardcoded-claim-mapper publicClient: true standardFlowEnabled: true redirectUris: - "*" realmSelector: matchLabels: app: sso EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakUser metadata: labels: app: sso name: jdoe spec: realmSelector: matchLabels: app: sso user: email: jdoe@redhat.com enabled: true emailVerified: true credentials: - type: "password" value: "secure" firstName: Jane lastName: Doe username: jdoe EOF
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
create secret tls SECRET_NAME -n NAMESPACE --cert CERTIFICATE_FILE_NAME --key PRIVATE_KEY_FILE_NAME
oc create secret tls keycloak-tls -n keycloak-system --cert certificate.pem --key key.pem
spec: db: vendor: postgres host: postgresql-db usernameSecret: name: postgresql-db key: username passwordSecret: name: postgresql-db key: password
spec: http: tlsSecret: keycloak-tls
spec: fulcio: config: OIDCIssuers: - ClientID: CLIENT_ID Issuer: ' RHBK_REALM_ISSUER_URL ' IssuerURL: ' RHBK_REALM_ISSUER_URL ' Type: email
spec: fulcio: config: OIDCIssuers: - ClientID: trusted-artifact-signer Issuer: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer' IssuerURL: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer' Type: email
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}'
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c" IssuerURL: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c" ClientID: "trusted-artifact-signer" Type: kubernetes
aws configure
export account_id=USD(aws sts get-caller-identity --query "Account" --output text) export oidc_provider="USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}' | cut -d '/' -f3-)" export role_name=rhtas-sts export namespace=rhtas-sts export service_account=cosign-sts
cat >trust-relationship.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::USD{account_id}:oidc-provider/USD{oidc_provider}" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "USD{oidc_provider}:aud": "trusted-artifact-signer" } } } ] } EOF
aws iam create-role --role-name rhtas-sts --assume-role-policy-document file://trust-relationship.json --description "Red Hat Trusted Artifact Signer STS Role"
new-project NAMESPACE
oc new-project rhtas-sts
cat >service_account.yaml <<EOF apiVersion: v1 kind: ServiceAccount metadata: name: USDservice_account namespace: USDnamespace annotations: eks.amazonaws.com/role-arn: "arn:aws:iam::USD{account_id}:role/USD{role_name}" # optional: Defaults to "sts.amazonaws.com" if not set eks.amazonaws.com/audience: "trusted-artifact-signer" # optional: When "true", adds AWS_STS_REGIONAL_ENDPOINTS env var to containers eks.amazonaws.com/sts-regional-endpoints: "true" # optional: Defaults to 86400 for expirationSeconds if not set eks.amazonaws.com/token-expiration: "86400" EOF
oc apply -f service_account.yaml
cat >deployment.yaml <<EOF apiVersion: apps/v1 kind: Deployment metadata: name: cosign-sts namespace: USD{namespace} spec: selector: matchLabels: app: cosign-sts template: metadata: labels: app: cosign-sts spec: securityContext: runAsNonRoot: true serviceAccountName: cosign-sts containers: - args: - -c - env; cosign initialize --mirror=\USDCOSIGN_MIRROR --root=\USDCOSIGN_ROOT; while true; do sleep 86400; done command: - /bin/sh name: cosign image: registry.redhat.io/rhtas-tech-preview/cosign-rhel9@sha256:f4c2cec3fc1e24bbe094b511f6fe2fe3c6fa972da0edacaf6ac5672f06253a3e pullPolicy: IfNotPresent env: - name: AWS_ROLE_SESSION_NAME value: signer-identity-session - name: AWS_REGION value: us-east-1 - name: OPENSHIFT_APPS_SUBDOMAIN value: USD(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//') - name: OIDC_AUTHENTICATION_REALM value: "trusted-artifact-signer" - name: COSIGN_FULCIO_URL value: USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_OIDC_ISSUER value: USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}') - name: COSIGN_CERTIFICATE_OIDC_ISSUER value: USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}') - name: COSIGN_REKOR_URL value: USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_MIRROR value: USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_ROOT value: "USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)/root.json" - name: COSIGN_YES value: "true" securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true serviceAccount: USD{service_account} serviceAccountName: USD{service_account} terminationGracePeriodSeconds: 30 EOF
oc apply -f deployment.yaml
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
rsh -n NAMESPACE deployment/cosign-sts env IMAGE= IMAGE_NAME:TAG /bin/sh
oc rsh -n rhtas-sts deployment/cosign-sts env IMAGE=ttl.sh/rhtas/test-image:1h /bin/sh
cosign sign -y --identity-token=USD(cat USDAWS_WEB_IDENTITY_TOKEN_FILE) ttl.sh/rhtas/test-image:1h
cosign verify --certificate-identity=https://kubernetes.io/namespaces/USD(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/serviceaccounts/cosign-sts --certificate-oidc-issuer=USDCOSIGN_CERTIFICATE_OIDC_ISSUER ttl.sh/rhtas/test-image:1h
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc get routes -n keycloak-system keycloak -o jsonpath='https://{.spec.host}'
oc get secret/credential-keycloak -n keycloak-system -o jsonpath='{ .data.ADMIN_PASSWORD }' | base64 -d
export RHTAS_APP_REGISTRATION=USD(az ad app create --display-name=rhtas --web-redirect-uris=http://localhost:0/auth/callback --enable-id-token-issuance --query appId -o tsv)
export RHTAS_APP_REGISTRATION_CLIENT_SECRET=USD(az ad app credential reset --id=USDRHTAS_APP_REGISTRATION --display-name="RHTAS Client Secret" -o tsv --query 'password')
az rest -m post --headers Content-Type=application/json --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies --body '{"definition": ["{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\":[{\"value\":\"true\",\"JwtClaimType\":\"email_verified\"}]}}"],"displayName": "EmailVerified"}'
export RHTAS_APP_REGISTRATION_OBJ_ID=USD(az ad app show --id USDRHTAS_APP_REGISTRATION --output tsv --query id)
az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/USD{RHTAS_APP_REGISTRATION_OBJ_ID} --headers 'Content-Type=application/json' --body "{\"api\":{\"acceptMappedClaims\":true}}"
export SERVICE_PRINCIPAL_ID=USD(az ad sp create --id=USD{RHTAS_APP_REGISTRATION} -o tsv --query 'id')
export CLAIM_MAPPING_POLICY_ID=USD(az rest --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies -o tsv --query "value[?displayName=='EmailVerified'] | [0].id")
az rest -m post --headers Content-Type=application/json --uri "https://graph.microsoft.com/v1.0/servicePrincipals/USD{SERVICE_PRINCIPAL_ID}/claimsMappingPolicies/\USDref" --body "{\"@odata.id\": \"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/USD{CLAIM_MAPPING_POLICY_ID}\"}"
export TENANT_ID=USD(az account show -o tsv --query tenantId)
export ENTRA_ID_OIDC_ENDPOINT=USD(echo https://login.microsoftonline.com/USD{TENANT_ID}/v2.0)
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "USD{ENTRA_ID_OIDC_ENDPOINT}" IssuerURL: "USD{ENTRA_ID_OIDC_ENDPOINT}" ClientID: "USD{RHTAS_APP_REGISTRATION}" Type: email
echo USDRHTAS_APP_REGISTRATION_CLIENT_SECRET > rhtas-entra-id-client-secret
export TUF_URL=USD(oc get tuf -n trusted-artifact-signer -o jsonpath='{.items[0].status.url}') export OIDC_ISSUER_URL=USD(oc get securesign -n trusted-artifact-signer rhtas -o jsonpath='{ .spec.fulcio.config.OIDCIssuers[0].Issuer }') export COSIGN_REKOR_URL=USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_MIRROR=USDTUF_URL export COSIGN_ROOT=USDTUF_URL/root.json export COSIGN_OIDC_CLIENT_ID=USDRHTAS_APP_REGISTRATION export SIGSTORE_OIDC_CLIENT_ID=USDCOSIGN_OIDC_CLIENT_ID export COSIGN_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_CERTIFICATE_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_YES="true" export COSIGN_FULCIO_URL=USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export SIGSTORE_FULCIO_URL=USDCOSIGN_FULCIO_URL export SIGSTORE_OIDC_ISSUER=USDCOSIGN_OIDC_ISSUER export SIGSTORE_REKOR_URL=USDCOSIGN_REKOR_URL export COSIGN_OIDC_CLIENT_SECRET_FILE=USD(pwd)/rhtas-entra-id-client-secret
cosign initialize
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG
cosign sign -y --oidc-client-secret-file=rhtas-entra-id-client-secret ttl.sh/rhtas/test-image:1h