Chapter 1. Installing Trusted Artifact Signer using the Operator Lifecycle Manager

Procedure

1. Log in to the OpenShift web console with a user that has the cluster-admin role.
2. From the Administrator perspective, expand the Operators navigation menu, and click OperatorHub.
3. In the search field, type trusted, and click the Red Hat Trusted Artifact Signer tile.
4. Click the Install button to show the operator details.

5. Accept the default values, click Install on the Install Operator page, and wait for the installation to finish.

   Important

   Once the installation finishes, a new project is automatically created for you. The new project name is trusted-artifact-signer.

   Note

   The Trusted Artifact Signer operator installs into the openshift-operators namespace, and all dependencies are automatically installed.

6. Optional. Instead of the default database, you can use an alternative database provider for the Trusted Artifact Signer service. If you want to use Amazon’s Relational Database Service (RDS), or a self-managed database on OpenShift, then follow one of those procedures first before continuing on with this installation. Once done configuring one of these other database providers, you can continue onto the next step of this procedure.

7. To deploy the Trusted Artifact Signer service.

   1. Expand Operators from the navigation menu, click Installed Operators.
   2. Select trusted-artifact-signer from the project drop-down box.
   3. Click Red Hat Trusted Artifact Signer.
   4. Click the Securesign tab, and click the Create Securesign button.
   5. On the Create Securesign page, select YAML view.

   6. You can configure Google OAuth, Amazon STS, Red Hat’s SSO, or GitHub OAuth as the initial OIDC provider during this deployment. Under the spec.fulcio.config.OIDCIssuers section, edit the following three lines with the OIDC provider URL, and set the ClientID appropriately.

      Example

      ...
      OIDCIssuers:
        - Issuer: 'OIDC_ISSUER_URL':
          ClientID: CLIENT_ID
          IssuerURL: 'OIDC_ISSUER_URL'
          Type: email
      ...

      Important

      You can define several different OIDC providers in the same configuration.

      Note

      If Red Hat’s SSO is already implemented as your OIDC provider, then run the following command to find the issuer URL:

      $ echo https://$(oc get route keycloak -n keycloak-system | tail -n 1 | awk '{print $2}')/auth/realms/trusted-artifact-signer

      Set the ClientID to trusted-artifact-signer.

   7. Optional. If using a different database other than the default, then under the spec.trillian section, set create to false, and give the name of the database secret object.

      Example

      ...
      trillian:
        database:
          create: false
          databaseSecretRef:
            name: trillian-mysql
      ...

   8. Click the Create button.

8. Click All instances tab to watch the deployment status until the CTlog, Fulcio, Rekor, Trillian, and TUF instances are ready.

   Note

   The Securesign instance does not give a status.

9. You can check on the health of the new Trusted Artifact Signer service by using Prometheus in the OpenShift console. From the navigation menu, expand Observe, and click Dashboards.
10. Verify the installation by signing a container image, or a Git commit.