Support for password-protected signer keys is removed for new instances

In Red Hat Trusted Artifact Signer (RHTAS) 1.5.0, support for configuring a password-protected (encrypted) private key as the signer key for the Fulcio, Certificate Transparency (CT) log, Rekor, or Timestamp Authority (TSA) services has been removed. This change enforces FIPS 140 compliance, because the traditional PEM password-encryption scheme uses an algorithm that is not FIPS-validated.

You cannot deploy a new RHTAS instance or rotate an existing instance's signer key by using a password-protected private key. As an alternative, secure unencrypted private keys by using standard Kubernetes role-based access control (RBAC) and etcd encryption at rest.

Existing instances that already reference an encrypted signer key continue to function, and the RHTAS Operator preserves the existing password reference as long as the signer key does not change.

Support for Rekor Search UI is removed

Copy link

When you update to Red Hat Trusted Artifact Signer (RHTAS) to 1.5.0 version, the Operator automatically migrates existing Rekor Search UI configurations to a Console custom resource and removes the legacy Search UI resources from the cluster. You can access the Console at console-ui-<namespace>.<cluster-domain>