Create the Policy Controller resources

After installing the Red Hat Trusted Artifact Signer (RHTAS) Policy Controller Operator, you need to create three new resources. These resources are: the base Policy Controller resource, the cluster image policy resource, and the Trust Root resource.

Before you begin

  • Installation of the RHTAS Policy Controller Operator.
  • A workstation with the oc, curl, and tufcli binaries installed.

About this task

Note
By default the Policy Controller resyncs the cluster image policies every 10 hours.

Procedure

  1. Open a terminal on your workstation, and log in to OpenShift: 
    oc login --token=TOKEN --server=SERVER_URL_AND_PORT
     
    $ oc login --token=sha256~ZvFDBvoIYAbVECixS4-WmkN4RfnNd8Neh3y1WuiFPXC --server=https://example.com:6443
    Note

    You can find your login token and URL for use on the command line from the OpenShift web console. Log in to the OpenShift web console. Click your user name, and click Copy login command. Offer your user name and password again, if asked, and click Display Token to view the command.
  2. Create and switch to the policy-controller-operator namespace: 
    $ oc new-project policy-controller-operator ; oc project policy-controller-operator
  3. Create a basic Policy Controller resource.
    1. Configure the Policy Controller to watch your namespaces that match the defined label selector under spec.policy-controller.webhook.namespaceSelector.matchExpressions: 
      ...
spec:
  policy-controller:
    ...
    webhook:
      ...
      namespaceSelector:
        matchExpressions:
          - key: policy.rhtas.com/include
            operator: In
            values: ["true"]
...
       
      $ cat <<EOF | oc apply -f -
apiVersion: rhtas.charts.redhat.com/v1alpha1
kind: PolicyController
metadata:
  name: policycontroller-sample
spec:
  policy-controller:
    cosign:
      webhookName: "policy.rhtas.com"
    webhook:
      name: webhook
      extraArgs:
        webhook-name: policy.rhtas.com
        mutating-webhook-name: defaulting.clusterimagepolicy.rhtas.com
        validating-webhook-name: validating.clusterimagepolicy.rhtas.com
      failurePolicy: Fail
      namespaceSelector:
        matchExpressions:
          - key: policy.rhtas.com/include
            operator: In
            values: ["true"]
      webhookNames:
        defaulting: "defaulting.clusterimagepolicy.rhtas.com"
        validating: "validating.clusterimagepolicy.rhtas.com"
EOF
      Important
      You must create this resource in the policy-controller-operator namespace.
    2. Add the policy.rhtas.com/include: "true" label to the namespace that you want watched by the Policy Controller: 
      apiVersion: v1
kind: Namespace
metadata:
  labels:
    policy.rhtas.com/include: "true"
  name: example-namespace
    3. If you have a custom Certificate Authority (CA) bundle or self-signed certificates, then you can add your ConfigMap name and key under the spec.policy-controller.webhook.registryCaBundle section of the Policy Controller resource: 
      ...
spec:
  policy-controller:
    ...
    webhook:
      registryCaBundle:
        name: CONFIGMAP_NAME
        key: CA_BUNDLE_KEY
...
  4. Create a Trust Root resource. You have three options for creating the Trust Root resource: a custom TUF repository, using your own keys, or using a serialized TUF root.
    1. Configure these environment variables from the RHTAS services: 
      $ export TUF_URL="$(oc -n trusted-artifact-signer get tuf -o jsonpath='{.items[0].status.url}')"
$ export BASE64_TUF_ROOT="$(curl -fsSL "$TUF_URL/root.json" | base64 -w0)"
$ export FULCIO_URL="$(oc -n trusted-artifact-signer get fulcio -o jsonpath='{.items[0].status.url}')"
$ export CTLOG_URL="http://ctlog.trusted-artifact-signer.svc.cluster.local"
$ export REKOR_URL="$(oc -n trusted-artifact-signer get rekor -o jsonpath='{.items[0].status.url}')"
$ export TSA_URL="$(oc -n trusted-artifact-signer get timestampAuthorities -o jsonpath='{.items[0].status.url}')"
    2. Option 1. Create the TrustRoot resource for a custom TUF repository: 
      $ cat <<EOF | oc apply -f -
apiVersion: policy.sigstore.dev/v1alpha1
kind: TrustRoot
metadata:
  name: trust-root
spec:
  remote:
    mirror: $TUF_URL
    root: |
      $BASE64_TUF_ROOT
EOF
    3. Option 2. Create a Trust Root with your own keys.
      1. Create and apply the TrustRoot resource using this template: 
        apiVersion: policy.sigstore.dev/v1alpha1
kind: TrustRoot
metadata:
  name: trust-root
spec:
  sigstoreKeys:
    certificateAuthorities:
    - subject:
        organization: fulcio-organization
        commonName: fulcio-common-name
      uri: $FULCIO_URL
      certChain: |-
        FULCIO_CERT_CHAIN
    ctLogs:
    - baseURL: $CTLOG_URL
      hashAlgorithm: sha-256
      publicKey: |-
        CTFE_PUBLIC_KEY
    tLogs:
    - baseURL: $REKOR_URL
      hashAlgorithm: sha-256
      publicKey: |-
        REKOR_PUBLIC_KEY
    timestampAuthorities:
    - subject:
        organization: tsa-organization
        commonName: tsa-common-name
      uri: $TSA_URL
      certChain: |-
        TSA_CERT_CHAIN
        Note
        Substitute the public keys and certificate chain values with your specific values for your RHTAS environment.
    4. Option 3. Create a Trust Root for a serialized TUF root.
      1. Create a temporary directory to contain a clone of your TUF root: 
        $ mkdir -p tuf-repo
      2. Download and clone the TUF repository: 
        $ curl -s $TUF_URL/root.json > root.json
$ tufcli clone --metadata-url=$TUF_URL --metadata-dir=tuf-repo --targets-url=$TUF_URL/targets --targets-dir=tuf-repo/targets --root=root.json
      3. Archive and encode the TUF repository: 
        $ tar -C ./tuf-repo -czf tuf-repo.tgz .
$ export MIRROR_FS=$(base64 -w0 tuf-repo.tgz)
      4. Create the TrustRoot resource: 
        $ cat <<EOF | oc apply -f -
apiVersion: policy.sigstore.dev/v1alpha1
kind: TrustRoot
metadata:
  name: trust-root
spec:
  repository:
    root: |-
      $BASE64_TUF_ROOT
    mirrorFS: |-
      $MIRROR_FS
EOF
  5. Create a basic Policy Controller cluster image policy resource.
    1. Configure these environment variables for Fulcio, Rekor, the Trust Root, and the OpenID Connect (OIDC) issuer and subject: 
      $ export FULCIO_URL="$(oc -n trusted-artifact-signer get fulcio -o jsonpath='{.items[0].status.url}')"
$ export REKOR_URL="$(oc -n trusted-artifact-signer get rekor -o jsonpath='{.items[0].status.url}')"
$ export TRUST_ROOT_RESOURCE="trust-root"
$ export OIDC_ISSUER_URL="https://ISSUER_URL"
$ export OIDC_SUBJECT="SUBJECT"
    2. Create the ClusterImagePolicy resource: 
      $ cat <<EOF | oc apply -f -
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: cluster-image-policy
spec:
  images:
    - glob: "**"
  authorities:
    - keyless:
        url: $FULCIO_URL
        trustRootRef: $TRUST_ROOT_RESOURCE
        identities:
          - issuer: $OIDC_ISSUER_URL
            subject: $OIDC_SUBJECT
      ctlog:
        url: $REKOR_URL
        trustRootRef: $TRUST_ROOT_RESOURCE
      rfc3161timestamp:
        trustRootRef: $TRUST_ROOT_RESOURCE
EOF
      Note
      The glob value of ** evaluates all container images.