Installing Red Hat Trusted Application Pipeline

Procedure:

1. Go to your Developer Settings page in GitHub.
2. In the left panel, under Personal access tokens, select Tokens (classic).
3. From the Generate new token drop down menu under the page banner, select Generate new token (classic). You may need to authenticate to continue.
4. Enter a name, select an expiration date, and under Select scopes, select repo (which should automatically include all scopes from repo: status to security_events).

5. Select Generate token. GitHub redirects you to a new page, where your token is visible. Create a new file called private.env, and save this token in that file.

   Note

   The private.env is critical to the success of your installation. Please ensure you create this file and save it in a secure location.

Procedure

1. In your CLI, authenticate to registry.redhat.io.

   $ podman login registry.redhat.io

   Copy to Clipboard Toggle word wrap

2. Pull the installer image.

   $ podman pull registry.redhat.io/rhtap-cli/rhtap-cli-rhel9:latest

   Copy to Clipboard Toggle word wrap

3. Start the rhtap-cli container image.

   $ podman run \
           -it \
           --entrypoint=bash \
           --publish 8228:8228 \
           --rm \
           rhtap-cli:latest

   Copy to Clipboard Toggle word wrap

4. In the running container, login to your OpenShift cluster as ClusterAdmin.

   bash-5.1$ oc login https://api.<input omitted>.openshiftapps.com:443 --username cluster-admin --password <input omitted>

   Copy to Clipboard Toggle word wrap

5. Run the following command to start creating a GitHub application. Replace $GH_TOKEN with the token you created in the previous procedure. Replace $GH_ORG_NAME with the name of the GitHub organization you are using for RHTAP. Replace $GH_APP_NAME with a name you would like to use for your application.

   bash-5.1$ rhtap-cli integration github-app --create --token="$GH_TOKEN" --org="$GH_ORG_NAME" $GH_APP_NAME

   Copy to Clipboard Toggle word wrap
6. The output of this command includes a URL. Use your web browser on your workstation to navigate to this address. When prompted, click Create your GitHub App.
7. The button redirects you to GitHub. If necessary, authenticate in GitHub to confirm access. Then click Create GitHub App for <your organization’s name>.
8. A new message displays in your browser, telling you that the app was successfully created. Click on the hyperlinked text to install the new application in your GitHub organization.
9. The link redirects you to GitHub. Click the green Install button.
10. Select the organization that you are using for RHTAP.

11. When prompted, select All repositories, so RHTAP can create new repositories in your organization. Click the green Install button.

    Note

    You may want to keep this GitHub page open, although you can close it without interrupting installation. In the page banner, there is a link that you can use after installation to access RHTAP (beginning with https://backstage-developer-hub-rhtap…​).

Procedure:

1. In your web browser, navigate to the RHTAP software catalog repository.

2. Beneath the banner of the page, select Fork and fork the repository.

   1. Uncheck the box that says "Copy the main branch only".
3. Once the fork is ready, copy its address. Label and save it in private.env.

4. In your new fork, beneath the banner, click main to open a dropdown menu. Under Tags, select the release that corresponds to the version of RHTAP that you are using.

   Note

   Be sure to update your fork from time to time, so updates from the upstream repository can benefit your instance of RHTAP.

Procedure

1. Before you can integrate your instance of ACS, you need an API token and the central endpoint URL.

   1. Follow the instructions for the prerequisites here to create an API token. Save the token in private.env.
   2. Follow the instructions here to configure your endpoint. Save the URL in private.env.

2. In your rhtap-cli container, run the integration command. Replace $ACS_ENDPOINT with your ACS central endpoint URL, and $ACS_TOKEN with your ACS API token.

   bash-5.1$ rhtap-cli integration acs --endpoint="$ACS_ENDPOINT" --token="$ACS_TOKEN"

   Copy to Clipboard Toggle word wrap

Procedure:

1. In your web browser, login to Quay. On the right side of the banner, select your username and select Account Settings from the dropdown menu.
2. On your user settings page, under Docker CLI Password, select Generate Encrypted Password. In the popup window, enter your password to authenticate.
3. Next, still in the popup window, select Docker Configuration > View [username]-auth.json. Copy the string, without the quotation marks, following "auth":.
4. In your private.env file, label and create the Docker configuration value with the following format, using your username and auth token where appropriate: {"auths": {"quay.io": {"auth": "[auth token]","email": ""}}}
5. Back in the Quay UI, return to the default Repositories page. On the right side, under Users and Organizations, select the Quay organization you want to use for RHTAP.
6. From the tabs on the left side, select Applications.
7. Click Create New Application. Give your application a name.
8. Click on the application’s name.
9. From the tabs on the left, select Generate Token.
10. From the options for permissions for the token, select View all visible repositories.
11. Click Generate Access Token.
12. Click Authorize Applicaiton.
13. The UI displays an access token. Label and save this token in private.env, too.

14. In your rhtap-cli container, run the following command to integrate your instance of Quay. Replace $QUAY_DOCKERCONFIGJSON with the Docker configuration value. Replace $QUAY_TOKEN with the token you just generated. And replace $QUAY_URL with the address for your instance of Quay (https://quay.io if you have not installed Quay in your cluster).

    bash-5.1$ rhtap-cli integration quay --dockerconfigjson='$QUAY_DOCKERCONFIGJSON' --token="$QUAY_TOKEN" --url="$QUAY_URL"

    Copy to Clipboard Toggle word wrap

Procedure

1. In your rhtap-cli container, run the integration command. Replace $BB_USERNAME with your Bitbucket username, and $BB_TOKEN with your Bitbucket access tokens. If you are integrating with a custom Bitbucket host, replace $BB_URL with you Bitbucket host URL. If you are using the default bitbucket.org host, you can remove the --host option.

   bash-5.1$ rhtap-cli integration bitbucket --username="$BB_USERNAME" --app-password="$BB_TOKEN" --host="$BB_URL"

   Copy to Clipboard Toggle word wrap

Procedure

1. In your rhtap-cli container, run the integration command. Replace $GL_API_TOKEN with your GitLab API token. If you are integrating with a custom GitLab host, replace $GL_URL with you GitLab host URL. If you are using the default gitlab.com host, you can remove the --host option.

   bash-5.1$ rhtap-cli integration gitlab --token="$GL_API_TOKEN" --host="$GL_URL"

   Copy to Clipboard Toggle word wrap

Procedure

1. In your rhtap-cli container, run the integration command. Replace $JK_API_TOKEN with your Jenkins API token, $JK_URL with you Jenkins instance URL, $JK_USERNAME with your Jenkins user ID.

   bash-5.1$ rhtap-cli integration jenkins --token="$JK_API_TOKEN" --url="$JK_URL" --username="$JK_USERNAME"

   Copy to Clipboard Toggle word wrap

Procedure

1. In the Artifactory UI, in the Administration view, click the green Set Up Client/CI Tool button next to the repository that you want to use.
2. Select Docker Client

3. Follow the UI instructions to authenticate in your CLI.

   1. The UI generates a token to use as a password. Make sure to save it in private.env.
   2. When you login to JFrog in your CLI, you should get a message saying your password has been stored in a location such as ~/.docker/config.json. If you do not see this message, a later step in this procedure explains what to do.

4. In your rhtap-cli container, run the integration command. Set the value of AF_URL to the URL of your instance (for example, "https://myusername.jfrog.io"). Set the value of AF_DOCKERCONFIGJSON to the contents of the file where your password was stored. Set the value of AF_API_TOKEN to the token that JFrog generated.

   bash-5.1$ rhtap-cli integration artifactory --url="$AF_URL" --dockerconfigjson='$AF_DOCKERCONFIGJSON' --token="$AF_API_TOKEN"

   Copy to Clipboard Toggle word wrap

Procedure

1. In the rhatp-cli container, create a copy of the config.yaml file:.

   bash-5.1$ cp config.yaml my-config.yaml

   Copy to Clipboard Toggle word wrap

2. Using the vi text editor, change the contents of /rhtap-cli/config.yaml as appropriate for the optional procedures you completed:

   bash-5.1$ vi my-config.yaml

   Copy to Clipboard Toggle word wrap

   1. If you forked the software catalog, then change the catalogURL to the URL for your fork, as shown in the example below.

      redHatDeveloperHub:
            enabled: &rhdhEnabled true
            namespace: *installerNamespace
            properties:
              catalogURL: https://github.com/<your username>/tssc-sample-templates/blob/release/all.yaml

      Copy to Clipboard Toggle word wrap

   2. If you ran rhtap-cli integration commands, then change the values for the relevant enabled fields to false. This is not necessary if you are using an alternative host for your source code. But any other integration you made requires a change to be made in this file. The example below shows the change you need to make for integrating a pre-existing instance of ACS.

      redHatAdvancedClusterSecurity:
            enabled: &rhacsEnabled false
            namespace: rhtap-acs

      Copy to Clipboard Toggle word wrap
      Note

      If you try to integrate outside products or pre-existing instances, but do not customize config.yaml, RHTAP still installs and uses its default products. You must customize config.yaml for your rhtap-cli integration commands to take effect.

3. Once you have made the appropriate changes, save the new my-config.yaml file.

Procedure

1. In the rhatp-cli container, run the installation command. If you did not make any changes to config.yaml, you can simply run rhtap-cli deploy. But if you did customize that file, run the following command, and replace the $CONFIG variable with the path of your customized file.

   Note

   Installation takes about fifteen minutes to complete.

   bash-5.1$ rhtap-cli deploy --config=$CONFIG

   Copy to Clipboard Toggle word wrap
2. Once installation is complete, be sure to save the output of the rhtap-cli deploy command in your private.env file. This output enables you to access your instances of the new products that are now installed.

3. Now, you can access your instance of RHTAP!

   1. After creating a GitHub app, you may have left the page for your new GitHub app open, as our note suggested. In that case, you can use the link in the banner of that page to access RHTAP.
   2. Otherwise, navigate to your the Authorized GitHub Apps tab on your Applications page. Click on the name of the app you created for RHTAP. Again, in the banner of this page, you can find the link you need to access RHTAP, which begins with https://backstage-developer-hub-rhtap…​.

Procedure

1. Go to your ACS instance. If you did not have ACS before installing RHTAP, you can find the access details in the rhtap-cli deploy command output, which you saved to ~/install_values.txt at the end of the installation procedure.
2. Follow the instructions in the Red Hat Advanced Cluster Security for Kubernetes 4.6 documentation to integrate Quay into ACS.