Before you deploy Red Hat Trusted Artifact Signer (RHTAS) in an high availability (HA) environment, there are some requirements for you to consider. The base requirements for running an HA deployment of RHTAS is Red Hat OpenShift, and access to production-ready storage and database solutions.

Your OpenShift cluster must have a minimum of three worker nodes, and Red Hat recommends having a minimum of three replicas for each RHTAS component. The RHTAS components are: Rekor, Fulcio, Certificate Transparency Log (CTLog), Timestamp Authority (TSA), The Update Framework (TUF), and Trillian.

For HA RHTAS environments, Red Hat recommends using production-ready storage solutions for running external databases, storing objects, and for a Redis instance. Examples of production-ready storage solutions would be Amazon Simple Storage Service (S3), Google Cloud Storage, or Microsoft Azure Blob. You can also consider using Persistent Volume Claims (PVC) with the ReadWriteMany access mode.

It is important to distribute the RHTAS pods to different nodes in your OpenShift cluster to minimize a single point of failure. For HA RHTAS environments, Red Hat recommends using the soft anti-affinity option (affinity.podAntiAffinity.preferredDuringSchedulingIgnoredDuringExecution) to control pod scheduling across your OpenShift cluster for each RHTAS component. Soft anti-affinity allows pod scheduling if resource constraints cannot be met. You can set resource requirements for each RHTAS component by defining their limits for CPU and memory usage. Along with scheduling pods to run on nodes with specific tolerations and taints, you can dedicate nodes to running RHTAS-only workloads.