Deployment Guide Red Hat Trusted Artifact Signer 1 Installing and configuring the Trusted Artifact Signer service for Red Hat platforms Red Hat Trusted Documentation Team

Commands:
OIDCIssuers: - Issuer: ' OIDC_ISSUER_URL ': ClientID: CLIENT_ID IssuerURL: ' OIDC_ISSUER_URL ' Type: email
echo https://USD(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print USD2}')/auth/realms/trusted-artifact-signer
trillian: database: create: false databaseSecretRef: name: trillian-mysql
gunzip cosign-amd64.gz chmod +x cosign-amd64
sudo mv cosign-amd64 /usr/local/bin/cosign
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
project PROJECT_NAME
oc project trusted-artifact-signer
export TUF_URL=USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export OIDC_ISSUER_URL=https://USD(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print USD2}')/auth/realms/trusted-artifact-signer export COSIGN_FULCIO_URL=USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_REKOR_URL=USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_MIRROR=USDTUF_URL export COSIGN_ROOT=USDTUF_URL/root.json export COSIGN_OIDC_CLIENT_ID="trusted-artifact-signer" export COSIGN_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_CERTIFICATE_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_YES="true" export SIGSTORE_FULCIO_URL=USDCOSIGN_FULCIO_URL export SIGSTORE_OIDC_ISSUER=USDCOSIGN_OIDC_ISSUER export SIGSTORE_REKOR_URL=USDCOSIGN_REKOR_URL export REKOR_REKOR_SERVER=USDCOSIGN_REKOR_URL
cosign initialize
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
cosign sign -y IMAGE_NAME:TAG
cosign sign -y ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
cosign verify --certificate-identity= SIGNING_EMAIL_ADDR IMAGE_NAME:TAG
cosign verify --certificate-identity=jdoe@redhat.com ttl.sh/rhtas/test-image:1h
gunzip rekor-cli-amd64.gz chmod +x rekor-cli-amd64
sudo mv rekor-cli-amd64 /usr/local/bin/rekor-cli
rekor-cli get --log-index 0 --rekor_server USDCOSIGN_REKOR_URL --format json | jq
rekor-cli search --email SIGNING_EMAIL_ADDR --rekor_server USDCOSIGN_REKOR_URL --format json | jq
rekor-cli search --email jdoe@redhat.com --rekor_server USDCOSIGN_REKOR_URL --format json | jq
rekor-cli get --uuid UUID --rekor_server USDCOSIGN_REKOR_URL --format json | jq
rekor-cli get --uuid 24296fb24b8ad77a71b9c1374e207537bafdd75b4f591dcee10f3f697f150d7cc5d0b725eea641e7 --rekor_server USDCOSIGN_REKOR_URL --format json | jq
gunzip gitsign-amd64.gz chmod +x gitsign-amd64
sudo mv gitsign-amd64 /usr/local/bin/gitsign
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
project PROJECT_NAME
oc project trusted-artifact-signer
export TUF_URL=USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export OIDC_ISSUER_URL=https://USD(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print USD2}')/auth/realms/trusted-artifact-signer export COSIGN_FULCIO_URL=USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_REKOR_URL=USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_MIRROR=USDTUF_URL export COSIGN_ROOT=USDTUF_URL/root.json export COSIGN_OIDC_CLIENT_ID="trusted-artifact-signer" export COSIGN_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_CERTIFICATE_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_YES="true" export SIGSTORE_FULCIO_URL=USDCOSIGN_FULCIO_URL export SIGSTORE_OIDC_ISSUER=USDCOSIGN_OIDC_ISSUER export SIGSTORE_REKOR_URL=USDCOSIGN_REKOR_URL export REKOR_REKOR_SERVER=USDCOSIGN_REKOR_URL
git config --local commit.gpgsign true git config --local tag.gpgsign true git config --local gpg.x509.program gitsign git config --local gpg.format x509 git config --local gitsign.fulcio USDSIGSTORE_FULCIO_URL git config --local gitsign.rekor USDSIGSTORE_REKOR_URL git config --local gitsign.issuer USDSIGSTORE_OIDC_ISSUER git config --local gitsign.clientID trusted-artifact-signer
git commit --allow-empty -S -m "Test of a signed commit"
cosign initialize
gitsign verify --certificate-identity= SIGNING_EMAIL --certificate-oidc-issuer=USDSIGSTORE_OIDC_ISSUER HEAD
gitsign verify --certificate-identity=jdoe@redhat.com --certificate-oidc-issuer=USDSIGSTORE_OIDC_ISSUER HEAD
gunzip ec-amd64.gz chmod +x ec-amd64
sudo mv ec-amd64 /usr/local/bin/ec
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
project PROJECT_NAME
oc project trusted-artifact-signer
export TUF_URL=USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export OIDC_ISSUER_URL=https://USD(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print USD2}')/auth/realms/trusted-artifact-signer export COSIGN_FULCIO_URL=USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_REKOR_URL=USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_MIRROR=USDTUF_URL export COSIGN_ROOT=USDTUF_URL/root.json export COSIGN_OIDC_CLIENT_ID="trusted-artifact-signer" export COSIGN_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_CERTIFICATE_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_YES="true" export SIGSTORE_FULCIO_URL=USDCOSIGN_FULCIO_URL export SIGSTORE_OIDC_ISSUER=USDCOSIGN_OIDC_ISSUER export SIGSTORE_REKOR_URL=USDCOSIGN_REKOR_URL export REKOR_REKOR_SERVER=USDCOSIGN_REKOR_URL
cosign initialize
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
cosign sign -y IMAGE_NAME:TAG
cosign sign -y ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
{ "builder": { "id": "https://localhost/dummy-id" }, "buildType": "https://example.com/tekton-pipeline", "invocation": {}, "buildConfig": {}, "metadata": { "completeness": { "parameters": false, "environment": false, "materials": false }, "reproducible": false }, "materials": [] }
cosign attest -y --predicate ./predicate.json --type slsaprovenance IMAGE_NAME:TAG
cosign attest -y --predicate ./predicate.json --type slsaprovenance ttl.sh/rhtas/test-image:1h
cosign tree IMAGE_NAME:TAG
cosign tree ttl.sh/rhtas/test-image:1h 📦 Supply Chain Security Related artifacts for an image: ttl.sh/rhtas/test-image@sha256:7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35 └── 💾 Attestations for an image tag: ttl.sh/rhtas/test-image:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.att └── 🍒 sha256:40d94d96a6d3ab3d94b429881e1b470ae9a3cac55a3ec874051bdecd9da06c2e └── 🔐 Signatures for an image tag: ttl.sh/rhtas/test-image:sha256-7de5fa822a9d1e507c36565ee0cf50c08faa64505461c844a3ce3944d23efa35.sig └── 🍒 sha256:f32171250715d4538aec33adc40fac2343f5092631d4fc2457e2116a489387b7
ec validate image --image IMAGE_NAME:TAG --certificate-identity-regexp ' SIGNER_EMAIL_ADDR ' --certificate-oidc-issuer-regexp 'keycloak-keycloak-system' --output yaml --show-successes
ec validate image --image ttl.sh/rhtas/test-image:1h --certificate-identity-regexp 'jdoe@example.com' --certificate-oidc-issuer-regexp 'keycloak-keycloak-system' --output yaml --show-successes success: true successes: - metadata: code: builtin.attestation.signature_check msg: Pass - metadata: code: builtin.attestation.syntax_check msg: Pass - metadata: code: builtin.image.signature_check msg: Pass ec-version: v0.1.2427-499ef12 effective-time: "2024-01-21T19:57:51.338191Z" key: "" policy: {} success: true
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "https://accounts.google.com" IssuerURL: "https://accounts.google.com" ClientID: " CLIENT_ID " Type: email
export OIDC_ISSUER_URL=https://accounts.google.com export COSIGN_OIDC_CLIENT_ID="314919563931-35zke44ouf2oiztjg7v8o8c2ge9usnd1.apps.googleexample.com"
echo SECRET > my-google-client-secret
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG
cosign sign -y --oidc-client-secret-file=my-google-client-secret ttl.sh/rhtas/test-image:1h
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc project keycloak-system
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: Keycloak metadata: labels: app: sso name: keycloak spec: externalAccess: enabled: true instances: 1 keycloakDeploymentSpec: imagePullPolicy: Always postgresDeploymentSpec: imagePullPolicy: Always EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakRealm metadata: labels: app: sso name: trusted-artifact-signer spec: instanceSelector: matchLabels: app: sso realm: displayName: Red-Hat-Trusted-Artifact-Signer enabled: true id: trusted-artifact-signer realm: trusted-artifact-signer sslRequired: none EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakClient metadata: labels: app: sso name: trusted-artifact-signer spec: client: attributes: request.object.signature.alg: RS256 user.info.response.signature.alg: RS256 clientAuthenticatorType: client-secret clientId: trusted-artifact-signer defaultClientScopes: - profile - email description: Client for Red Hat Trusted Artifact Signer authentication directAccessGrantsEnabled: true implicitFlowEnabled: false name: trusted-artifact-signer protocol: openid-connect protocolMappers: - config: claim.name: email id.token.claim: "true" jsonType.label: String user.attribute: email userinfo.token.claim: "true" name: email protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: claim.name: email-verified id.token.claim: "true" user.attribute: emailVerified userinfo.token.claim: "true" name: email-verified protocol: openid-connect protocolMapper: oidc-usermodel-property-mapper - config: claim.name: aud claim.value: trusted-artifact-signer id.token.claim: "true" access.token.claim: "true" userinfo.token.claim: "true" name: audience protocol: openid-connect protocolMapper: oidc-hardcoded-claim-mapper publicClient: true standardFlowEnabled: true redirectUris: - "*" realmSelector: matchLabels: app: sso EOF
cat <<EOF | oc apply -f - apiVersion: keycloak.org/v1alpha1 kind: KeycloakUser metadata: labels: app: sso name: jdoe spec: realmSelector: matchLabels: app: sso user: email: jdoe@redhat.com enabled: true emailVerified: true credentials: - type: "password" value: "secure" firstName: Jane lastName: Doe username: jdoe EOF
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
create secret tls SECRET_NAME -n NAMESPACE --cert CERTIFICATE_FILE_NAME --key PRIVATE_KEY_FILE_NAME
oc create secret tls keycloak-tls -n keycloak-system --cert certificate.pem --key key.pem
spec: db: vendor: postgres host: postgresql-db usernameSecret: name: postgresql-db key: username passwordSecret: name: postgresql-db key: password
spec: http: tlsSecret: keycloak-tls
spec: fulcio: config: OIDCIssuers: - ClientID: CLIENT_ID Issuer: ' RHBK_REALM_ISSUER_URL ' IssuerURL: ' RHBK_REALM_ISSUER_URL ' Type: email
spec: fulcio: config: OIDCIssuers: - ClientID: trusted-artifact-signer Issuer: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer' IssuerURL: 'https://keycloak-ingress-keycloak-system.apps.openshift.example.com/realms/trusted-artifact-signer' Type: email
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}'
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c" IssuerURL: "https://example.s3.us-east-1.aws.com/47bd6cg0vs5nn01mue83fbof94dj4m9c" ClientID: "trusted-artifact-signer" Type: kubernetes
aws configure
export account_id=USD(aws sts get-caller-identity --query "Account" --output text) export oidc_provider="USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}' | cut -d '/' -f3-)" export role_name=rhtas-sts export namespace=rhtas-sts export service_account=cosign-sts
cat >trust-relationship.json <<EOF { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::USD{account_id}:oidc-provider/USD{oidc_provider}" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "USD{oidc_provider}:aud": "trusted-artifact-signer" } } } ] } EOF
aws iam create-role --role-name rhtas-sts --assume-role-policy-document file://trust-relationship.json --description "Red Hat Trusted Artifact Signer STS Role"
new-project NAMESPACE
oc new-project rhtas-sts
cat >service_account.yaml <<EOF apiVersion: v1 kind: ServiceAccount metadata: name: USDservice_account namespace: USDnamespace annotations: eks.amazonaws.com/role-arn: "arn:aws:iam::USD{account_id}:role/USD{role_name}" # optional: Defaults to "sts.amazonaws.com" if not set eks.amazonaws.com/audience: "trusted-artifact-signer" # optional: When "true", adds AWS_STS_REGIONAL_ENDPOINTS env var to containers eks.amazonaws.com/sts-regional-endpoints: "true" # optional: Defaults to 86400 for expirationSeconds if not set eks.amazonaws.com/token-expiration: "86400" EOF
oc apply -f service_account.yaml
cat >deployment.yaml <<EOF apiVersion: apps/v1 kind: Deployment metadata: name: cosign-sts namespace: USD{namespace} spec: selector: matchLabels: app: cosign-sts template: metadata: labels: app: cosign-sts spec: securityContext: runAsNonRoot: true serviceAccountName: cosign-sts containers: - args: - -c - env; cosign initialize --mirror=\USDCOSIGN_MIRROR --root=\USDCOSIGN_ROOT; while true; do sleep 86400; done command: - /bin/sh name: cosign image: registry.redhat.io/rhtas-tech-preview/cosign-rhel9@sha256:f4c2cec3fc1e24bbe094b511f6fe2fe3c6fa972da0edacaf6ac5672f06253a3e pullPolicy: IfNotPresent env: - name: AWS_ROLE_SESSION_NAME value: signer-identity-session - name: AWS_REGION value: us-east-1 - name: OPENSHIFT_APPS_SUBDOMAIN value: USD(oc get cm -n openshift-config-managed console-public -o go-template="{{ .data.consoleURL }}" | sed 's@https://@@; s/^[^.]*\.//') - name: OIDC_AUTHENTICATION_REALM value: "trusted-artifact-signer" - name: COSIGN_FULCIO_URL value: USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_OIDC_ISSUER value: USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}') - name: COSIGN_CERTIFICATE_OIDC_ISSUER value: USD(oc get authentication cluster -o jsonpath='{.spec.serviceAccountIssuer}') - name: COSIGN_REKOR_URL value: USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_MIRROR value: USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) - name: COSIGN_ROOT value: "USD(oc get tuf -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer)/root.json" - name: COSIGN_YES value: "true" securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true serviceAccount: USD{service_account} serviceAccountName: USD{service_account} terminationGracePeriodSeconds: 30 EOF
oc apply -f deployment.yaml
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
rsh -n NAMESPACE deployment/cosign-sts env IMAGE= IMAGE_NAME:TAG /bin/sh
oc rsh -n rhtas-sts deployment/cosign-sts env IMAGE=ttl.sh/rhtas/test-image:1h /bin/sh
cosign sign -y --identity-token=USD(cat USDAWS_WEB_IDENTITY_TOKEN_FILE) ttl.sh/rhtas/test-image:1h
cosign verify --certificate-identity=https://kubernetes.io/namespaces/USD(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)/serviceaccounts/cosign-sts --certificate-oidc-issuer=USDCOSIGN_CERTIFICATE_OIDC_ISSUER ttl.sh/rhtas/test-image:1h
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
oc get routes -n keycloak-system keycloak -o jsonpath='https://{.spec.host}'
oc get secret/credential-keycloak -n keycloak-system -o jsonpath='{ .data.ADMIN_PASSWORD }' | base64 -d
export RHTAS_APP_REGISTRATION=USD(az ad app create --display-name=rhtas --web-redirect-uris=http://localhost:0/auth/callback --enable-id-token-issuance --query appId -o tsv)
export RHTAS_APP_REGISTRATION_CLIENT_SECRET=USD(az ad app credential reset --id=USDRHTAS_APP_REGISTRATION --display-name="RHTAS Client Secret" -o tsv --query 'password')
az rest -m post --headers Content-Type=application/json --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies --body '{"definition": ["{\"ClaimsMappingPolicy\":{\"Version\":1,\"IncludeBasicClaimSet\":\"true\", \"ClaimsSchema\":[{\"value\":\"true\",\"JwtClaimType\":\"email_verified\"}]}}"],"displayName": "EmailVerified"}'
export RHTAS_APP_REGISTRATION_OBJ_ID=USD(az ad app show --id USDRHTAS_APP_REGISTRATION --output tsv --query id)
az rest --method PATCH --uri https://graph.microsoft.com/v1.0/applications/USD{RHTAS_APP_REGISTRATION_OBJ_ID} --headers 'Content-Type=application/json' --body "{\"api\":{\"acceptMappedClaims\":true}}"
export SERVICE_PRINCIPAL_ID=USD(az ad sp create --id=USD{RHTAS_APP_REGISTRATION} -o tsv --query 'id')
export CLAIM_MAPPING_POLICY_ID=USD(az rest --uri https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies -o tsv --query "value[?displayName=='EmailVerified'] | [0].id")
az rest -m post --headers Content-Type=application/json --uri "https://graph.microsoft.com/v1.0/servicePrincipals/USD{SERVICE_PRINCIPAL_ID}/claimsMappingPolicies/\USDref" --body "{\"@odata.id\": \"https://graph.microsoft.com/v1.0/policies/claimsMappingPolicies/USD{CLAIM_MAPPING_POLICY_ID}\"}"
export TENANT_ID=USD(az account show -o tsv --query tenantId)
export ENTRA_ID_OIDC_ENDPOINT=USD(echo https://login.microsoftonline.com/USD{TENANT_ID}/v2.0)
edit Securesign NAME -n NAMESPACE
oc edit Securesign securesign-sample -n trusted-artifact-signer
OIDCIssuers: - Issuer: "USD{ENTRA_ID_OIDC_ENDPOINT}" IssuerURL: "USD{ENTRA_ID_OIDC_ENDPOINT}" ClientID: "USD{RHTAS_APP_REGISTRATION}" Type: email
echo USDRHTAS_APP_REGISTRATION_CLIENT_SECRET > rhtas-entra-id-client-secret
export TUF_URL=USD(oc get tuf -n trusted-artifact-signer -o jsonpath='{.items[0].status.url}') export OIDC_ISSUER_URL=USD(oc get securesign -n trusted-artifact-signer rhtas -o jsonpath='{ .spec.fulcio.config.OIDCIssuers[0].Issuer }') export COSIGN_REKOR_URL=USD(oc get rekor -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export COSIGN_MIRROR=USDTUF_URL export COSIGN_ROOT=USDTUF_URL/root.json export COSIGN_OIDC_CLIENT_ID=USDRHTAS_APP_REGISTRATION export SIGSTORE_OIDC_CLIENT_ID=USDCOSIGN_OIDC_CLIENT_ID export COSIGN_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_CERTIFICATE_OIDC_ISSUER=USDOIDC_ISSUER_URL export COSIGN_YES="true" export COSIGN_FULCIO_URL=USD(oc get fulcio -o jsonpath='{.items[0].status.url}' -n trusted-artifact-signer) export SIGSTORE_FULCIO_URL=USDCOSIGN_FULCIO_URL export SIGSTORE_OIDC_ISSUER=USDCOSIGN_OIDC_ISSUER export SIGSTORE_REKOR_URL=USDCOSIGN_REKOR_URL export COSIGN_OIDC_CLIENT_SECRET_FILE=USD(pwd)/rhtas-entra-id-client-secret
cosign initialize
echo "FROM scratch" > ./tmp.Dockerfile podman build . -f ./tmp.Dockerfile -t ttl.sh/rhtas/test-image:1h
podman push ttl.sh/rhtas/test-image:1h
rm ./tmp.Dockerfile
cosign sign -y --oidc-client-secret-file= SECRET_FILE IMAGE_NAME:TAG
cosign sign -y --oidc-client-secret-file=rhtas-entra-id-client-secret ttl.sh/rhtas/test-image:1h
mysql -h REGIONAL_ENDPOINT -P 3306 -u USER_NAME -p
mysql -h exampledb.1234.us-east-1.rds.amazonaws.com -P 3306 -u admin -p
create database trillian;
use trillian;
CREATE USER trillian@'%' IDENTIFIED BY ' PASSWORD '; GRANT ALL PRIVILEGES ON trillian.* TO 'trillian'@'%'; FLUSH PRIVILEGES;
EXIT
curl -o dbconfig.sql https://raw.githubusercontent.com/securesign/trillian/main/storage/mysql/schema/storage.sql
mysql -h FQDN_or_SERVICE_ADDR -P 3306 -u USER_NAME -p PASSWORD -D DB_NAME < PATH_TO_CONFIG_FILE
mysql -h rhtasdb.example.com -P 3306 -u trillian -p mypassword123 -D trillian < dbconfig.sql
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
create secret generic OBJECT_NAME --from-literal=mysql-database=trillian --from-literal=mysql-host= FQDN_or_SERVICE_ADDR --from-literal=mysql-password= PASSWORD --from-literal=mysql-port=3306 --from-literal=mysql-root-password= PASSWORD --from-literal=mysql-user= USER_NAME
oc create secret generic trillian-mysql --from-literal=mysql-database=trillian --from-literal=mysql-host=mariadb.trusted-artifact-signer.svc.cluster.local --from-literal=mysql-password=mypassword123 --from-literal=mysql-port=3306 --from-literal=mysql-root-password=myrootpassword123 --from-literal=mysql-user=trillian
mysql -u USDMYSQL_USER -pUSDMYSQL_PASSWORD -DUSDMYSQL_DATABASE
EXIT
curl -o dbconfig.sql https://raw.githubusercontent.com/securesign/trillian/main/storage/mysql/schema/storage.sql
mysql -h FQDN_or_SERVICE_ADDR -P 3306 -u USER_NAME -p PASSWORD -D DB_NAME < PATH_TO_CONFIG_FILE
mysql -h rhtasdb.example.com -P 3306 -u trillian -p mypassword123 -D trillian < dbconfig.sql
login --token= TOKEN --server= SERVER_URL_AND_PORT
oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
create secret generic OBJECT_NAME --from-literal=mysql-database=trillian --from-literal=mysql-host= FQDN_or_SERVICE_ADDR --from-literal=mysql-password= PASSWORD --from-literal=mysql-port=3306 --from-literal=mysql-root-password= PASSWORD --from-literal=mysql-user= USER_NAME
oc create secret generic trillian-mysql --from-literal=mysql-database=trillian --from-literal=mysql-host=mariadb.trusted-artifact-signer.svc.cluster.local --from-literal=mysql-password=mypassword123 --from-literal=mysql-port=3306 --from-literal=mysql-root-password=myrootpassword123 --from-literal=mysql-user=trillian
apiVersion: v1 kind: Service metadata: annotations: service.beta.openshift.io/serving-cert-secret-name: keycloak-tls labels: app: keycloak app.kubernetes.io/instance: keycloak name: keycloak-service-trusted namespace: keycloak-system spec: internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - name: https port: 8443 selector: app: keycloak app.kubernetes.io/instance: keycloak
spec: ingress: annotations: route.openshift.io/destination-ca-certificate-secret: keycloak-tls route.openshift.io/termination: reencrypt
spec: http: tlsSecret: keycloak-tls
spec: hostname: hostname: example.com
spec: ingress: className: openshift-default
oc get ingressclass
spec: hostname: hostname: example-keycloak-ingress-keycloak-system.apps.rhtas.example.com
--- apiVersion: v1 kind: Service metadata: name: postgresql-db namespace: keycloak-system spec: internalTrafficPolicy: Cluster ipFamilies: - IPv4 ipFamilyPolicy: SingleStack ports: - port: 5432 selector: app: postgresql-db --- apiVersion: apps/v1 kind: StatefulSet metadata: name: postgresql-db namespace: keycloak-system spec: persistentVolumeClaimRetentionPolicy: whenDeleted: Retain whenScaled: Retain podManagementPolicy: OrderedReady replicas: 1 revisionHistoryLimit: 10 selector: matchLabels: app: postgresql-db serviceName: postgresql-db template: metadata: labels: app: postgresql-db spec: containers: - env: - name: POSTGRESQL_USER valueFrom: secretKeyRef: key: username name: postgresql-db - name: POSTGRESQL_PASSWORD valueFrom: secretKeyRef: key: password name: postgresql-db - name: POSTGRESQL_DATABASE valueFrom: secretKeyRef: key: database name: postgresql-db image: registry.redhat.io/rhel9/postgresql-15:latest imagePullPolicy: IfNotPresent livenessProbe: exec: command: - /usr/libexec/check-container - --live failureThreshold: 3 initialDelaySeconds: 120 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 10 name: postgresql-db readinessProbe: exec: command: - /usr/libexec/check-container failureThreshold: 3 initialDelaySeconds: 5 periodSeconds: 10 successThreshold: 1 timeoutSeconds: 1 securityContext: allowPrivilegeEscalation: false capabilities: drop: - ALL terminationMessagePath: /dev/termination-log terminationMessagePolicy: File volumeMounts: - mountPath: /var/lib/pgsql/data name: data dnsPolicy: ClusterFirst restartPolicy: Always schedulerName: default-scheduler securityContext: runAsNonRoot: true seccompProfile: type: RuntimeDefault terminationGracePeriodSeconds: 30 updateStrategy: rollingUpdate: partition: 0 type: RollingUpdate volumeClaimTemplates: - apiVersion: v1 kind: PersistentVolumeClaim metadata: name: data spec: accessModes: - ReadWriteOnce resources: requests: storage: 1Gi volumeMode: Filesystem