이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 1. Overview
Red Hat Trusted Application Pipeline RHTAP is a DevSecOps framework that integrates security from project inception to production. It reduces security risks in continuous integration/continuous delivery (CI/CD) pipelines by embedding security checks, ensuring artifact integrity, and enabling compliance with standards such as Supply chain Levels for Software Artifacts (SLSA).
1.1. Key features
- Ready-to-use templates: Start project quickly with customizable templates that include established security practices. Reduce setup time and focus on delivering secure software sooner.
- Secure CI/CD pipelines: Build, test, and deploy container images securely using pre-configured pipelines integrated with your Git repository. Apply security measures at every stage to reduce risks before code reaches production.
- Integrated security checks: Detect and address potential vulnerabilities with detailed insights to help understand the potential threats.
- SBOM management: Automatically generate a Software Bill of Materials (SBOM) for each pipeline run. Sign attestations and maintain a clear record of component origins, ensuring traceability and compliance throughout the software life cycle.
- Tamper-proof artifact signing: Apply cryptographic signatures to code submissions and related artifacts. Maintain an immutable log of build and deployment activities to preserve trust and integrity.
- Compliance and policy enforcement: Comply with standards such as Supply chain Levels for Software Artifacts (SLSA) Level 3 and enterprise requirements. Configure approval gates, run vulnerability scans, and enforce policies so only verified, compliant artifacts move forward.
1.2. Integrated technologies
RHTAP integrates with industry-leading platforms and tools:
| Component or Technology | Description |
|---|---|
| Red Hat Developer Hub (RHDH) | A self-service portal that streamlines development and integrates security best practices from the get-go. |
| Red Hat Trusted Artifact Signer (RHTAS) | Enhances software integrity through signature and attestation, ensuring all artifacts are secure and authentic. |
| Red Hat Trusted Profile Analyzer (RHTPA) | Automates the creation and management of SBOMs, providing transparency and compliance in your software supply chain. |
| Advanced Cluster Security (ACS) | Automates the scanning of artifacts for vulnerabilities. |
| OpenShift GitOps | Manages Kubernetes deployments and infrastructure using Git repositories, ensuring consistent, automated, and secure deployment practices. |
| OpenShift Pipelines | Automates the CI/CD processes with visibility and control over build, test, and deployment workflows. |
| Argo CD | Automates application deployment and lifecycle management, ensuring consistent versions of app definitions, configurations, and environments. |
1.3. Configuration options
RHTAP allows flexibility in CI/CD management, source repositories, and artifact registries:
| Category | Options |
|---|---|
| CI/CD pipelines |
Note All CI pipelines except Tekton conform to SLSA Build L2. Tekton conforms to Build L3. |
| Source repositories |
|
| Artifact registries |
|
