Deploy Trusted Artifact Signer console

Deploy the Red Hat Trusted Artifact Signer Console on OpenShift to provide a web interface for viewing trust root status, verifying signed artifacts, and exploring Rekor transparency log entries. The Console includes UI and API components that connect to Rekor and TUF services.

Before you begin

  • Red Hat OpenShift Container Platform version 4.16 or later.
  • An active RHTAS instance deployed in your cluster.
  • Rekor and TUF services running and accessible in the target namespace.
  • oc CLI configured with cluster administrative privileges.

Procedure

  1. Deploy the Console by creating a Console custom resource. The RHTAS Operator watches for these custom resources and automatically creates the necessary pods, services, and routes. Create a YAML definition of a Console custom resource using one of the following configurations based on your environment:
    • Minimal deployment with Route/Ingress enabled: Use this configuration to access the Console UI from a web browser. On OpenShift, setting ingress.enabled: true automatically creates a Route that exposes the UI with edge TLS termination. 
      apiVersion: rhtas.redhat.com/v1
kind: Console
metadata:
  name: console
  namespace: NAMESPACE
spec:
  ui:
    ingress:
      enabled: true
  api: {}

      Replace NAMESPACE with the namespace where RHTAS is deployed. The empty API configuration means the operator automatically discovers Rekor and TUF services in the same namespace.

      Example:

      apiVersion: rhtas.redhat.com/v1
kind: Console
metadata:
  name: console
  namespace: trusted-artifact-signer
spec:
  ui:
    ingress:
      enabled: true
  api: {}
    • Explicit service references: Use this configuration when Rekor or TUF services are running in a different namespace or belong to a separate resource instance. 
      apiVersion: rhtas.redhat.com/v1
kind: Console
metadata:
  name: console
  namespace: NAMESPACE
spec:
  ui:
    ingress:
      enabled: true
    rekor:
      ref:
        name: REKOR_INSTANCE_NAME
        namespace: REKOR_NAMESPACE
  api:
    tuf:
      ref:
        name: TUF_INSTANCE_NAME
        namespace: TUF_NAMESPACE

      where

      NAMESPACE
      The namespace where you want to deploy the Console.
      REKOR_INSTANCE_NAME
      The name of your Rekor custom resource instance.
      REKOR_NAMESPACE
      The namespace where Rekor is deployed.
      TUF_INSTANCE_NAME
      The name of your TUF custom resource instance.
      TUF_NAMESPACE
      The namespace where TUF is deployed.
    • External URLs: Use this configuration when targeting external or standalone Rekor and TUF endpoints hosted outside the local cluster. 
      apiVersion: rhtas.redhat.com/v1
kind: Console
metadata:
  name: console
  namespace: NAMESPACE
spec:
  ui:
    ingress:
      enabled: true
    rekor:
      url: REKOR_URL
  api:
    tuf:
      url: TUF_URL

      where

      NAMESPACE
      The namespace where you want to deploy the Console.
      REKOR_URL
      The external URL of the Rekor service endpoint.
      TUF_URL
      The external URL of the TUF service endpoint.
  2. Deploy the Console using one of the following methods:
    • Using the OpenShift web console:
      1. In the Administrator perspective of the web console, select the project as trusted-artifact-signer.
      2. Go to the Operators Installed Operators page.
      3. Click Red Hat Trusted Artifact Signer.
      4. Click the Console tab, and click the Create Console button.
      5. Configure the Console using one of the following methods:
        • Form view: Complete the form fields based on your selected configuration from step 1.
          1. In the Name field, enter a name for the Console instance (for example, console).
          2. Expand the ui section and set Ingress Enabled to true to enable Route/Ingress access.
          3. If using explicit service references, expand the ui Rekor Ref section and specify the Rekor instance name and namespace.
          4. If using explicit service references, expand the api Tuf Ref section and specify the TUF instance name and namespace.
          5. If using external URLs, expand the ui Rekor section and enter the Rekor URL.
          6. If using external URLs, expand the api Tuf section and enter the TUF URL.
          7. Click Create.
        • YAML view: Paste your YAML configuration directly.
          1. Click YAML view to switch to the YAML editor.
          2. Delete the default YAML content.
          3. Paste your selected YAML configuration from step 1 into the editor.
          4. Click Create.
    • Using the CLI: Apply your selected custom resource configuration: 
      $ oc apply -f <console_config>.yaml

      Replace <console_config> with the name of your configuration file.

Results

  1. Check the Console deployment status: 
    $ oc get consoles.rhtas.redhat.com -n trusted-artifact-signer

    Expected output:

    NAME      STATUS   URL
console   Ready    https://console-ui-trusted-artifact-signer.apps.example.com

    The Console is ready when the STATUS column shows Ready and a URL is displayed.