Appendix C. High availability resource specifications example

apiVersion: rhtas.redhat.com/v1alpha1
kind: Securesign
metadata:
  name: securesign-ha
  namespace: trusted-artifact-signer
spec:
  trillian:
    database:
      create: false
      provider: mysql
      uri: "$(MYSQL_USER):$(MYSQL_PASSWORD)@tcp($(MYSQL_HOST):$(MYSQL_PORT))/$(MYSQL_DATABASE)"
    auth:
      env:
        - name: MYSQL_HOST
          valueFrom:
            secretKeyRef:
              name: trillian-db-credentials
              key: mysql-host
        - name: MYSQL_PORT
          valueFrom:
            secretKeyRef:
              name: trillian-db-credentials
              key: mysql-port
        - name: MYSQL_USER
          valueFrom:
            secretKeyRef:
              name: trillian-db-credentials
              key: mysql-user
        - name: MYSQL_PASSWORD
          valueFrom:
            secretKeyRef:
              name: trillian-db-credentials
              key: mysql-password
        - name: MYSQL_DATABASE
          valueFrom:
            secretKeyRef:
              name: trillian-db-credentials
              key: mysql-database
    server:
      replicas: 3
      resources:
        requests:
          cpu: "500m"
          memory: "256Mi"
        limits:
          cpu: "1000m"
          memory: "512Mi"
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app.kubernetes.io/name
                      operator: In
                      values:
                        - trillian-logserver
                topologyKey: kubernetes.io/hostname
    signer:
      replicas: 3
      resources:
        requests:
          cpu: "100m"
          memory: "128Mi"
        limits:
          cpu: "250m"
          memory: "256Mi"
      affinity:
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app.kubernetes.io/name
                      operator: In
                      values:
                        - trillian-logsigner
                topologyKey: kubernetes.io/hostname

  rekor:
    replicas: 3
    resources:
      requests:
        cpu: "500m"
        memory: "256Mi"
      limits:
        cpu: "1000m"
        memory: "512Mi"
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                      - rekor-server
              topologyKey: kubernetes.io/hostname
    attestations:
      enabled: true
      url: "s3://my-attestation-bucket?region=us-east-1"
    searchIndex:
      create: false
      provider: redis
      url: "redis://redis.example.com:6379"
    auth:
      env:
        - name: AWS_ACCESS_KEY_ID
          valueFrom:
            secretKeyRef:
              name: rekor-s3-credentials
              key: AWS_ACCESS_KEY_ID
        - name: AWS_SECRET_ACCESS_KEY
          valueFrom:
            secretKeyRef:
              name: rekor-s3-credentials
              key: AWS_SECRET_ACCESS_KEY

  fulcio:
    replicas: 3
    resources:
      requests:
        cpu: "250m"
        memory: "128Mi"
      limits:
        cpu: "500m"
        memory: "256Mi"
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                      - fulcio-server
              topologyKey: kubernetes.io/hostname
    config:
      OIDCIssuers:
        - ClientID: "trusted-artifact-signer"
          IssuerURL: "https://your-oidc-issuer.example.com"
          Issuer: "https://your-oidc-issuer.example.com"
          Type: "email"
    certificate:
      organizationName: "Example Organization"
      organizationEmail: "admin@example.com"

  ctlog:
    replicas: 3
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "250m"
        memory: "256Mi"
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                      - ctlog
              topologyKey: kubernetes.io/hostname

  tuf:
    replicas: 3
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "250m"
        memory: "256Mi"
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                      - tuf
              topologyKey: kubernetes.io/hostname
    pvc:
      accessModes:
        - ReadWriteMany
      size: "100Mi"
      storageClass: "ocs-storagecluster-cephfs"

  tsa:
    replicas: 3
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "250m"
        memory: "256Mi"
    affinity:
      podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                  - key: app.kubernetes.io/name
                    operator: In
                    values:
                      - tsa-server
              topologyKey: kubernetes.io/hostname
    signer:
      certificateChain:
        rootCA:
          organizationName: "Example Root Organization"
          organizationEmail: "admin@example.com"
        intermediateCA:
          - organizationName: "Example Intermediate Organization"
            organizationEmail: "admin@example.com"
        leafCA:
          organizationName: "Example Leaf CA"
          organizationEmail: "admin@example.com"