Release notes for Red Hat Trusted Application Pipeline 1.3

Bitbucket Cloud is now supported

You can now choose Bitbucket Cloud as your Git repository hosting service to create components in RHTAP applications. You can combine source code from different Git platforms (GitHub, GitLab, and Bitbucket) to build an application. To use Bitbucket, integrate it during the RHTAP installation and then configure it using the Setting up Bitbucket guide.

GitLab CI is now supported

You can now use GitLab CI as your CI provider. To use it, integrate GitLab during the RHTAP installation and then configure GitLab CI to ensure secure CI/CD workflows. Additionally, you can choose to customize GitLab pipelines. If you don’t integrate GitLab CI, RHTAP defaults to Tekton.

Technology Preview: GitHub Actions is now supported

You can now choose GitHub Actions as your CI provider. You can integrate GitHub Actions during the RHTAP installation, otherwise, RHTAP defaults to Tekton. This feature is available as a Technology Preview, and it is not fully supported, may not be functionally complete, and is not intended for production use.

JFrog Artifactory is now supported

You can now choose JFrog Artifactory as your container images registry when you create your application. To use Artifactory, refer to the Integrating JFrog Artifactory section in the Installation guide. If you don’t integrate JFrog Artifactory, RHTAP defaults to Quay.

Technology Preview: A new software template is now available

RHTAP introduces a new secure software template called Import User Repository. It allows you to import code from the existing Git repository and create a new repository that includes software supply chain security functionality provided by RHTAP. To learn more, view the Bring your source template on GitHub. Note that this is a Technology Preview feature.

Changes to the RHTAP installation

The RHTAP installer now includes all the resources needed for RHTAP deployment in the single binary to simplify installation. The new installer also provides extra monitoring to watch over Kubernetes resource status for improved reliability during installation.

Changes to the MinIO installation

Installing MinIO through OpenShift OperatorHub subscription is no longer available. As a result, the Operator will no longer update the MinIO installation automatically.

SBOMs are now automatically uploaded to RHTPA

RHTAP now automatically publishes your software bill of materials (SBOM) to Red Hat Trusted Profile Analyzer when you use any of the supported CI providers: Tekton, Jenkins, GitLab CI or GitHub Actions. Note that GitHub Actions is a Technology Preview feature and has not been fully tested.

Red Hat Developer Hub plugins

RHTAP enables a selection of RHDH dynamic plugins to support creation and monitoring of trusted secure supply chain applications. Some of the plugins enabled by RHTAP include Technology Preview and community plugins that may not be functionally complete.

GitLab authentication is now supported on RHDH

Previously, you could only use GitHub authentication as a sign-in option in Red Hat Developer Hub, to access RHTAP. Now you can also use GitLab authentication to sign in RHDH and access RHTAP.

Pipeline fails if you create a new Deployment Namespace

When you create a new component with a new Deployment Namespace, the pipeline fails with the error tasks.tekton.dev "rhtap-dev-namespace-setup" not found. To work around this issue, use the default Deployment Namespace called rhtap-app.

View logs and View SBOM icons don’t link to correct information

After a Pipeline Run is finished, you should be able to access the build summary and SBOM by clicking the View logs and View SBOM icons in the Actions menu. However, these icons don’t always show the correct information. To access the correct steps in logs, click either of these two icons, and in the pop-up window with logs, select the step you need: show-sbom or show-summary.

Vulnerabilities tab in RHTPA may show Internal server error

When RHTAP uploads the SBOM to Red Hat Trusted Profile Analyzer, RHTPA accepts the SBOM but may show Internal server error in the Vulnerabilities tab. If you encounter this issue, contact rhtpa-support@redhat.com.

RHDH doesn’t display the Image Registry tab if RHTAP cannot detect your registry type

The Red Hat Developer Hub UI doesn’t display the Image Registry tab on the component’s page if RHTAP is unable to detect which container image registry you’re using. RHTAP analyzes your registry URL to annotate your components, and if that annotation is missing, the tab will not appear in the RHDH UI. To work around this issue, you can manually enable the Image Registry tab.

Jenkins can only use one Git hosting provider

The default Jenkins configuration uses a global credential called GITOPS_AUTH_PASSWORD to authenticate when updating the gitops repository with a newly built image. Because only one such global variable is available, a single Jenkins instance can only be configured to work with one Git repository provider at a time, GitHub, GitLab, or Bitbucket Cloud.

RHTAP doesn’t automatically find a Rekor server when running Jenkins pipelines

When running a Jenkins pipeline, RHTAP cannot find a Rekor server if your Jenkins instance runs outside the RHTAP cluster. To work around this problem, you must manually provide the external routes for the Rekor and TUF services by configuring the REKOR_HOST and TUF_MIRROR environment variables in the env.sh file. Their values should include your cluster URL. For details and instructions, refer to Customizing sample software templates for Jenkins.

When you use GitLab, you might see an error: namespaces "rhtap-acs" not found

When you use GitLab as an authentication option, a Git hosting platform and a CI provider, and you also disable ACS and integrate Quay, at the end of the RHTAP installation you might see the following error:

RHTAP doesn’t support some environments

RHTAP 1.3 does not support the following environments: any air-gapped environment, IBM Power Platform, IBM Z Platform, ARM64, and Federal Information Processing Standards (FIPS) mode OCP.

Uninstallation of RHTAP is not supported

Uninstallation of RHTAP is not currently supported, but it can be done by removing all rhtap namespaces from the cluster.