Installing Red Hat Advanced Developer Suite - software supply chain

Procedure

1. To use a custom software catalog, set the catalogURL:

       - name: Developer Hub
         properties:
           catalogURL: https://github.com/redhat-appstudio/tssc-sample-templates/blob/release-v1.7.x/all.yaml

   Copy to Clipboard Toggle word wrap

2. To disable automatic installation of components that are already integrated externally, set enabled: false:

       - name: Advanced Cluster Security
         enabled: false
         namespace: tssc-acs

   Copy to Clipboard Toggle word wrap
   Note

   If external integrations are not correctly reflected in the config.yaml, the installation program will deploy default components. Update the file to prevent unintended provisioning.

3. To select your Identity and Access Management (IAM) provider, set authProvider:

       - name: Developer Hub
           authProvider: <github|gitlab>

   Copy to Clipboard Toggle word wrap

   You can specify github (default) or gitlab.

   Important

   You must integrate the authentication provider that you choose.

4. To enable role-based access control (RBAC) for Developer Hub, set RBAC.enabled to true:

       - name: Developer Hub
           authProvider: <github|gitlab>
           RBAC:
             enabled: true
           # adminUsers:
           #   - <username>
           # orgs:
           #   - <github_org>

   Copy to Clipboard Toggle word wrap
   Note

   If you do not define adminUsers, the installation program defaults to the GitHub or GitLab credentials specified during integration. If you specify GitHub as your IAM provider, you can specify an orgs list, but if you specify GitLab it will ignore the orgs list and default to the organization specified in the integration configuration.

5. To use custom namespace prefixes instead of the default ones, configure the namespacePrefixes property. By default, RHADS - SSC creates the following namespaces during installation:

   • tssc-app-ci: For continuous integration pipeline workloads

   • tssc-app-development, tssc-app-stage, and tssc-app-prod: For development, staging, and production deployments

     You can customize the prefixes for these namespaces and define additional sets. For example:

         - name: Developer Hub
           namespacePrefixes:
             - my_prefix1  # This generates the following namespaces: `my_prefix1-app-ci`, `my_prefix1-app-development`, `my_prefix1-app-stage`, `my_prefix1-app-prod`
             - my_prefix2 # This generates the following namespaces: `my_prefix2-app-ci`, `my_prefix2-app-development`, `my_prefix2-app-stage`, `my_prefix2-app-prod`

     Copy to Clipboard Toggle word wrap
6. After you complete all necessary changes, you can push it to the cluster using the tssc config --create ` command. If you are updating a configuration that you have already pushed, specify the `--force option too. Once you push the configuration, you can run the tssc deploy command again to implement the changes.

1. Create a GitHub personal access token.
2. Create a GitHub application.

Procedure

1. Set the application ID to an environment variable by running the following command:

   bash-5.1$ export GL_APP_ID=<app_id>

   Copy to Clipboard Toggle word wrap

2. Set the application secret to an environment variable by running the following command:

   bash-5.1$ export GL_APP_SECRET=<app_secret>

   Copy to Clipboard Toggle word wrap

3. Set the GitLab API token to an environment variable by running the following command:

   bash-5.1$ export GL_API_TOKEN=<api_token>

   Copy to Clipboard Toggle word wrap

4. Set the GitLab URL to an environment variable by running the following command:

   bash-5.1$ export GL_URL=<url>

   Copy to Clipboard Toggle word wrap

5. Set the GitLab group to an environment variable by running the following command:

   bash-5.1$ export GL_GROUP=tssc

   Copy to Clipboard Toggle word wrap

6. Integrate GitLab by running the following command:

   bash-5.1$ tssc integration gitlab \
     --token="$GL_API_TOKEN" \
     --host="$GL_URL" \
     --group $GL_GROUP \
     --app-id $GL_APP_ID \
     --app-secret $GL_APP_SECRET
     --insecure

   Copy to Clipboard Toggle word wrap

Procedure

1. Before you integrate RHACS, obtain an API token and the Central endpoint URL. The URL must include the protocol, hostname, and port. For example, https://central-rhacs.example.com:443.

   1. Follow the instructions at Create an RHACS API token to generate the token.
   2. Save the token to a file, such as values.txt, for reuse in later steps.
   3. Follow the instructions at Configure the Central endpoint URL to locate your ACS Central endpoint.
   4. Save the endpoint URL to a file, such as values.txt, for reuse in later steps.

2. In your tssc container, run the following integration command:

   bash-5.1$ tssc integration acs \
     --endpoint="$ACS_ENDPOINT" \
     --token="$ACS_TOKEN"

   Copy to Clipboard Toggle word wrap

   Replace the following variables:

   • $ACS_ENDPOINT: The URL of your RHACS Central endpoint
   • $ACS_TOKEN: The RHACS API token

Procedure

1. In the tssc container, run the following integration command:

   bash-5.1$ tssc integration bitbucket \
     --username="$BB_USERNAME" \
     --app-password="$BB_TOKEN" \
     --host="$BB_URL"

   Copy to Clipboard Toggle word wrap

   Replace the following variables:

   • $BB_USERNAME: Your Bitbucket username
   • $BB_TOKEN: Your Bitbucket app password

   • $BB_URL: Your Bitbucket host URL (optional)

     Note

     If you are using the default Bitbucket Cloud host (bitbucket.org), you can omit the --host option.

Procedure

1. In the tssc container, run the following integration command:

   bash-5.1$ tssc integration jenkins \
     --token="$JK_API_TOKEN" \
     --url="$JK_URL" \
     --username="$JK_USERNAME"

   Copy to Clipboard Toggle word wrap

   Replace the following variables:

   • $JK_API_TOKEN: Your Jenkins API token
   • $JK_URL: The URL of your Jenkins instance
   • $JK_USERNAME: Your Jenkins user ID

Procedure

1. In the tssc container, run the following integration command:

   bash-5.1$ tssc integration azure \
     --organization="$AZURE_ORGANIZATION" \
     --host="$AZURE_HOST_URL" \
     --token="$AZURE_API_TOKEN" \

   Copy to Clipboard Toggle word wrap

   Replace the following variables:

   • $AZURE_ORGANIZATION: Your Azure DevOps organization name.
   • $AZURE_HOST_URL: Your DevOps base URL (omit this option if using the default dev.azure.com).
   • $AZURE_API_TOKEN: Your personal access token.

Procedure

1. In a web browser, log in to your Quay account.

   1. Browse to your organization’s robot accounts.
   2. Select an appropriate robot account. For example, a robot account with write permission.
   3. In the pop-up, select Docker Configuration > View [username-robotaccount]-auth.json.
   4. Copy the string value (without quotation marks) that follows "auth":.
   5. Save the auth value and your Quay username to a file, such as values.txt, so that you can use them when constructing the Docker configuration.
   6. Repeat the steps 1b through 1e for the robot account with read permission.
2. In a separate browser tab, go to the Repositories page.
3. Under Users and Organizations, click the name of the organization you want to use with RHADS - SSC.
4. In the navigation, click Applications.
5. Click Create New Application and enter a name.
6. Click the name of the application that you created.
7. In the navigation, click Generate Token.
8. In the permissions list, select View all visible repositories.
9. Click Generate Access Token.

10. Click Authorize Application. Quay displays the access token. Copy this token.

    Note

    You can use an OAuth application instead of a user or robot account. For more information, see: Creating an OAuth 2 access token.

    Additionally, only the View all visible repositories permission is required.

11. In your tssc container, run the following command to integrate Quay with RHADS - SSC, passing all required values inline:

    # Docker configuration JSON string for the read/write robot account
    bash-5.1$ tssc integration quay \
      --dockerconfigjson='{"auths":{"quay.io":{"auth":"<auth_token_write_permission>","email":""}}}' \
      --dockerconfigjsonreadonly='{"auths":{"quay.io":{"auth":"<auth_token_read_permission>","email":""}}}' \
      --token="<quay_access_token>" \
      --url="https://quay.io"

    Copy to Clipboard Toggle word wrap

    Replace the following values:

    • <auth_token_write_permission>: The value from the auth.json file under "auth": for read and write robot account.
    • <auth_token_read_permission>: The value from the auth.json file under "auth": for read only robot account.
    • <quay_access_token>: The access token you generated via the OAuth application

    • https://quay.io: The Quay instance URL (use your custom URL if self-hosted)

      Note

      Make sure to enclose the entire --dockerconfigjson value in single quotes to preserve JSON formatting.

Procedure

1. In the Artifactory web UI, go to the Administration view.
2. Click the Set Up Client/CI Tool button next to the repository that you want to use.
3. Select Docker Client.

4. Follow the instructions in the UI to authenticate from your CLI:

   1. The UI generates a token that is used as your Docker password. Save the token to a file, such as values.txt, for reuse in later steps

   2. After logging in to JFrog via the CLI, you should see a message that your password was saved in a file such as ~/.docker/config.json.

      Note

      If you do not see this message, you can manually generate the config.json content in a later step.

5. In your tssc container, run the following integration command:

   bash-5.1$ tssc integration artifactory \
     --url="$AF_URL" \
     --dockerconfigjson='$AF_DOCKERCONFIGJSON' \
     --token="$AF_API_TOKEN"

   Copy to Clipboard Toggle word wrap

   Replace the following variables:

   • $AF_URL: The URL of your JFrog instance (for example, https://myusername.jfrog.io)
   • $AF_DOCKERCONFIGJSON: The contents of the config.json file where the password was stored

   • $AF_API_TOKEN: The token generated by JFrog

     Note

     Make sure to wrap the $AF_DOCKERCONFIGJSON value in single quotes to preserve the JSON structure.

     If the CLI did not generate the config.json file, you can manually create its contents by using the following format:

     {
       "auths": {
         "<jfrog_instance_url>": {
           "auth": "<base64_format_of_username:password>",
           "email": ""
         }
       }
     }

     Copy to Clipboard Toggle word wrap

Procedure

1. (Optional) Create temporary environment variables and store the following values:

   REGISTRY_URL="<url to the nexus container registry>"
   AUTHFILE='auth.json'  # This file will be created in the next step.

   Copy to Clipboard Toggle word wrap

   If you choose not to create these variables, remember to replace the variables in the code examples with relevant values.

2. Log in to your Nexus container registry using Podman and generate a Docker-compatible authentication file:

   podman login --authfile="${AUTHFILE}" "${REGISTRY_URL}"

   Copy to Clipboard Toggle word wrap

   This command logs in to Nexus, creates an auth.json file, and stores your Nexus username and password in it.

3. In your tssc container, run the following integration command:

   tssc integration nexus \
     --url="${REGISTRY_URL}" \
     --dockerconfigjson="$(cat ${AUTHFILE})"

   Copy to Clipboard Toggle word wrap

4. Remove the local auth.json file as it is no longer needed.

   rm "${AUTHFILE}"

   Copy to Clipboard Toggle word wrap