Appendix D. Trusted Artifact Signer configuration reference for Red Hat OpenShift

replicas

integer

1

The number of pod replicas.

affinity

object

N/A

Pod scheduling constraints for affinity or anti-affinity rules.

resources

object

N/A

CPU and memory requests and limits.

tolerations

array

N/A

Tolerations for scheduling pods on nodes with taints.

create

boolean

true

When true, the Operator creates a MySQL database. Set to false, for an external database.

provider

string

mysql

The database provider, either mysql or postgresql.

uri

string

N/A

The connection URI for the database.

pvc

object

N/A

Persistent Volume Claim configuration. Only applicable when create is true.

tls

object

N/A

Transport Layer Security configuration. Only applicable when create is true.

auth.env

array

N/A

Environment variables for database authentication.

auth.secretMount

object

N/A

Mount secrets as files for TLS certificates.

create

boolean

true

When true, the Operator deploys Redis. Set to false, for an external Redis instance.

provider

string

redis

The search index provider, either redis or elasticsearch.

url

string

N/A

The connection URL for the search index.

tls

object

N/A

Transport Layer Security configuration. Only applicable when create is true.

backFillRedis.enabled

boolean

true

Enables or disables the backfill Cron job.

backFillRedis.schedule

string

0 0 * * *

Cron schedule expression.

file:///var/run/attestations?no_tmp_dir=true

Local filesystem (requires PVC)

s3://

s3://bucket-name?region=us-west-1

Amazon S3

s3://

s3://bucket?endpoint=minio.local:9000&use_path_style=true

S3-compatible (MinIO)

gs://

gs://bucket-name

Google Cloud Storage

azblob://

ocs-storagecluster-cephfs

Red Hat OpenShift Data Foundation

NFS

nfs-client

NFS provisioner

Amazon EFS

efs-sc

Amazon EFS CSI driver

Azure Files

azurefile

Azure Files CSI driver

Google Cloud Filestore

name

string

N/A

The name of an existing Persistent Volume Claim (PVC).

size

quantity

user-defined

Expressed in bytes using binary SI suffixes (Gi, Mi, Ti) or using decimal suffixes (G, M, T).

retain

boolean

true

Retain the PVC after deleting the custom resource (CR), this is immutable.

storageClassName

string

N/A

The name of the StorageClass to use for dynamic provisioning.

enabled

boolean

true

Enables or disables attestation storage. Once enabled, this cannot be disabled.

url

string

file:///var/run/attestations?no_tmp_dir=true

Storage location URL using go-cloud blob URL format. Supported schemes are file, s3, gs, and azblob.

maxSize

quantity

100Ki

Maximum allowed size for an individual attestation. Expressed in bytes using binary SI suffixes (Gi, Mi, Ti) or using decimal suffixes (G, M, T).