Chapter 2. New features and enhancements

Ability to add OIDC providers for Ansible deployments of RHTAS

With this release, you can configure OpenID Connect (OIDC) providers under the tas_single_node_fulcio.fulcio_config section of the RHTAS Ansible Playbook. Update the playbook by adding your OIDC provider URL to the oidc_issuers variable, save your changes, and then re-run the playbook. You can have many OIDC providers defined in the oidc_issuers variable.

Monitoring for RHTAS containers

With this release, you can monitor and manage the RHTAS containers with the Cockpit web interface. This gives users a web-based user interface to simplify container management, and improves maintainability.

Expose passphrase variables for RHTAS components

When the Ansible collection creates a passphrase, they are easily guessable, and therefore a security risk. With this release, we expose the passphrase variables for each RHTAS component. This allows users to configure the passphrase as they see fit in the RHTAS Ansible Playbook.

Producing a warning or violation dynamically for policy checks

With this release of Enterprise Contract (EC), a single policy check can be either a warning or a violation based on logic defined in the policy check. You can select the warning or violation based on dynamic criteria, such as an effective date, or other runtime logic.

Improvements to the validation output

With this release, we added more details to the output of the ec validate image command for better auditing. The output shows the Git SHA or image digest when resolving a non-permanent reference, such as a tag or Git branch, if defined in the policy source for Enterprise Contract (EC). With this additional information you can see exactly which policies and policy data used during the validation.

Support for running Enterprise Contract commands without a timeout

With this release, you can specify the --timeout 0 on Enterprise Contract (EC) commands to override the default timeout of 5 minutes. This is helpful in Continuous Integration and Continuous Deployment (CI/CD) environments where they manage their own task timeouts.

Support for policy exceptions for specific components

In earlier versions of Enterprise Contract (EC), any policy exception was applied to all components being evaluated. With this release, you can specify which component a particular policy exception applies to. This gives you more fine-grained control when applying policy exceptions.