Chapter 1. Select your installation platform As as systems administrator, you can select two different installation platforms to run Red Hat Trusted Artifact Signer (RHTAS). You can deploy RHTAS to Red Hat OpenShift Container Platform, or to Red Hat Enterprise Linux by using Ansible. Important Deploying RHTAS to Red Hat Enterprise Linux is currently a Technical Preview feature. Select your installation platform: Red Hat OpenShift Red Hat Enterprise Linux 1.1. Installing Trusted Artifact Signer using the Operator Lifecycle Manager You can install the Red Hat Trusted Artifact Signer (RHTAS) operator, and deploy the RHTAS service by using OpenShift's Operator Lifecycle Manager (OLM). This deployment gives you a basic signing framework with your choice of an OpenID Connect (OIDC) provider. You must configure at least one of the following OIDC providers: Red Hat Single Sign-on (SSO), Google, Amazon Secure Token Service (STS), or GitHub. You can also optionally customize your database solution, if you do not want to use the default. Prerequisites Red Hat OpenShift Container Platform version 4.13 or later. Access to the OpenShift web console with the cluster-admin role. A workstation with the oc binary installed. Procedure Log in to the OpenShift web console with a user that has the cluster-admin role. From the Administrator perspective, expand the Operators navigation menu, and click OperatorHub . In the search field, type trusted , and click the Red Hat Trusted Artifact Signer tile. Click the Install button to show the operator details. Accept the default values, click Install on the Install Operator page, and wait for the installation to finish. Important Once the installation finishes, a new project is automatically created for you. The new project name is trusted-artifact-signer . Note The Trusted Artifact Signer operator installs into the openshift-operators namespace, and all dependencies are automatically installed. Optional. Instead of the default database, you can use an alternative database provider for the Trusted Artifact Signer service. If you want to use Amazon's Relational Database Service (RDS) , or a self-managed database on OpenShift , then follow one of those procedures first before continuing on with this installation. Once done configuring one of these other database providers, you can continue onto the step of this procedure. To deploy the Trusted Artifact Signer service. Expand Operators from the navigation menu, click Installed Operators . Select trusted-artifact-signer from the project drop-down box. Click Red Hat Trusted Artifact Signer . Click the Securesign tab, and click the Create Securesign button. On the Create Securesign page, select YAML view . You can configure Google OAuth , Amazon STS , Red Hat's SSO , or GitHub OAuth as the initial OIDC provider during this deployment. Under the spec.fulcio.config.OIDCIssuers section, edit the following three lines with the OIDC provider URL, and set the ClientID appropriately. Example Important You can define several different OIDC providers in the same configuration. Note If Red Hat's SSO is already implemented as your OIDC provider, then run the following command to find the issuer URL: Set the ClientID to trusted-artifact-signer . Optional. If using a different database other than the default, then under the spec.trillian section, set create to false , and give the name of the database secret object. Example Click the Create button. Click All instances tab to watch the deployment status until the CTlog , Fulcio , Rekor , Trillian , and TUF instances are ready. Note The Securesign instance does not give a status. You can check on the health of the new Trusted Artifact Signer service by using Prometheus in the OpenShift console. From the navigation menu, expand Observe , and click Dashboards . Verify the installation by signing a container image , or a Git commit . Additional resources See the Appendix in the RHTAS Deployment Guide for more information about RHTAS components and version numbers. 1.2. Installing Trusted Artifact Signer using Ansible You can install the Red Hat Trusted Artifact Signer (RHTAS) on Red Hat Enterprise Linux by using a Red Hat provided Ansible Playbook. This deployment gives you a basic signing framework with Keycloak as the OpenID Connect (OIDC) provider. Important Deploying RHTAS on Red Hat Enterprise Linux by using Ansible is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs), might not be functionally complete, and Red Hat does not recommend to use them for production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. See the support scope for Red Hat Technology Preview features for more details. Prerequisites Red Hat Enterprise Linux version 9.2 or later. A Red Hat user account to access the Red Hat Hybrid Cloud Console. Procedure Log in to the Red Hat Hybrid Cloud Console with your Red Hat credentials. From the home page, click the Services drop-down menu, and click Red Hat Ansible Automation Platform . From the navigational menu, expand Automation Hub , and click Collections . In the search field type rhtas and press enter. Click the artifact_signer link on the Red Hat Trusted Artifact Signer tile. Click the Documentation tab, and follow the steps there to complete the installation of RHTAS on Red Hat Enterprise Linux. Note For a detailed overview of all the configuration parameters, click the tas_single_node link under the Roles section. Additional resources See the Appendix in the RHTAS Deployment Guide for more information about RHTAS components and version numbers.

Commands:
OIDCIssuers: - Issuer: ' OIDC_ISSUER_URL ': ClientID: CLIENT_ID IssuerURL: ' OIDC_ISSUER_URL ' Type: email
echo https://USD(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print USD2}')/auth/realms/trusted-artifact-signer
trillian: database: create: false databaseSecretRef: name: trillian-mysql