Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 5. Known issues

Resolved known issues for this release of Red Hat Trusted Artifact Signer (RHTAS):

A list of unresolved known issues found in this release, and earlier releases of RHTAS:

Restoring RHTAS data to new OpenShift cluster
When restoring RHTAS data to a new Red Hat OpenShift cluster, you must regenerate the TLS certificates due to a change of the CA authority for the cluster. This change disrupts secure communication between components, leading some pods to halt during the restoration process. To resolve this issue, initiate the restoration, wait for the ctlog pod start to fail, then delete all the TLS certificates by executing the restoreTls.sh script, forcing the creation of new TLS certificates. Next, delete the terminated ctlog pod and any other pods that did not start. Consequently, all pods will start, and communication between components will be re-established.
The Trillian CR status update fails
The Trillian custom resource (CR) fails to update the status.replicas field within the CR after a user specifies a custom number of replicas. This results in a mismatch between the number of replicas defined and the number reported in the CR status. Although the correct number of pods are deployed, the status field incorrectly displays the default value, which might cause confusion during monitoring. To work around this issue, manually update the status.replicas field in the CR to match the actual number of replicas. As a result of this workaround, the status field accurately reflects the number of replicas.
Cosign fails verification of signed timestamps after rotating the TSA certification chain

The current version of cosign expects only one single Timestamp Authority (TSA) certificate chain. When rotating the TSA certificate chain, you give the whole TSA certificate chain to The Update Framework (TUF) as an individual target. During the rotation process, setting the new TSA certificate chain as the new TUF target, and expiring the old TSA certificate chain gives the following error message:

main.go:74: error during command execution: unable to load TSA certificates: TSA certificate chain must contain exactly one leaf certificate

Currently, there is no workaround for this issue.

For information about rotating the TSA signer key and certificate chain see our procedure for Red Hat OpenShift Container Platform, or Red Hat Enterprise Linux.

Rekor Search UI does not show records after upgrade

After upgrading the RHTAS Operator to the latest version, the existing Rekor data is not found when searching by email address. The backfill-redis Cron job, which ensures that Rekor Search UI can query the transparency log only runs once per day, at midnight. To workaround this issue, you can trigger the backfill-redis job manually, instead of waiting until midnight.

To trigger the backfill-redis job from the command-line interface, run the following command: 

$ oc create job --from=cronjob/backfill-redis backfill-redis -n trusted-artifact-signer
Copy to Clipboard Toggle word wrap

Doing this adds the missing data back to the Rekor Search UI.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat