Known issues

A list of known issues in this release of Red Hat Trusted Artifact Signer (RHTAS).

Securesign pods fail to start after reverting from KMS to File mode
Copy link

Currently, if you revert a Securesign custom resource (CR) from KMS mode to File mode, stale KMS Secret references remain in the .status fields of the generated Fulcio and TimestampAuthority CRs. As a result, Fulcio and TimestampAuthority pods fail to start with FailedMount errors because they attempt to mount nonexistent KMS Secret keys. As a workaround, manually delete the generated Fulcio and TimestampAuthority CRs in the affected namespace: 
oc delete fulcio <fulcio_instance_name>
oc delete timestampauthority <timestampauthority_instance_name>
After deleting the CRs, the parent Securesign controller recreates the component CRs with the correct File-mode configuration, clearing the stale references and resolving the mount errors so that the pods start successfully.

Reverting Securesign components from KMS to File mode reuses historical signing material
Copy link

Currently, if you revert an operator-managed Rekor, Fulcio, or TimestampAuthority signer from KMS mode back to the default generated File configuration by removing the KMS configuration without specifying replacement key references, the component reuses the original deterministic File signer Secret. As a result, expected key rotation does not occur, and the component reactivates its historical signing key and associated certificate or certificate chain. As a workaround, manually provision new signing material in Secrets and explicitly reference it in the parent Securesign custom resource (CR):
  • For Rekor, use type: secret and keyRef.
  • For Fulcio and TimestampAuthority, use type: file, file.privateKeyRef, and certificateChain.certificateChainRef with matching keys and certificates.
After you provision the new Secrets, complete the required trust-material refresh and TUF publication. The affected components then use the newly provisioned signing material as active File signers instead of reactivating historical material.