Chapter 5. Known issues

We found an issue on how Cosign selects an OpenID Connect (OIDC) provider when using Cosign version 3 or later. Cosign adheres to the signing_config.v0.2.json provided by The Update Framework (TUF) to determine the service URLs for RHTAS components. Cosign follows the "winner-takes-all" logic for selecting which OIDC provider to use for authentication by identifying which OIDC entry has the highest compatible API version within a certain period of time. If there are multiple OIDC providers that meet this criteria, then the first OIDC provider is selected, and the others are ignored. This logic prevents the user from manually selecting which OIDC provider they want to used, even if using the --oidc-issuer flag, because the signing_config.v0.2.json is active. This can result in a hard failure, with the following message:

Error: cannot specify service URLs and use signing config

To workaround this issue, you must bypass the automated signing configuration by setting the --use-signing-config to false. This allows you to explicitly set the OIDC provider of your choice when using the --oidc-issuer flag.

When restoring RHTAS data to a new Red Hat OpenShift cluster, you must regenerate the TLS certificates due to a change of the CA authority for the cluster. This change disrupts secure communication between components, leading some pods to halt during the restoration process. To resolve this issue, initiate the restoration, then before scaling the operator, delete all the TLS certificates by running the following commands:

$ oc delete secret securesign-sample-ctlog-tls securesign-sample-rekor-redis-tls securesign-sample-trillian-db-tls securesign-sample-trillian-logserver-tls securesign-sample-trillian-logsigner-tls
$ oc scale deploy rhtas-operator-controller-manager --replicas=1 -n openshift-operators

As a result, all pods will start, and communication between components will be re-established.

After upgrading the RHTAS Operator to the latest version, the existing Rekor data is not found when searching by email address. The backfill-redis Cron job, which ensures that Rekor Search UI can query the transparency log only runs once per day, at midnight. To workaround this issue, you can trigger the backfill-redis job manually, instead of waiting until midnight.

To trigger the backfill-redis job from the command-line interface, run the following command:

$ oc create job --from=cronjob/backfill-redis backfill-redis -n trusted-artifact-signer

Doing this adds the missing data back to the Rekor Search UI.