Skip to content
This repository was archived by the owner on Mar 10, 2025. It is now read-only.

Commit fed7a21

Browse files
sallyomsallyom
committed
update docs/README
1 parent 3ca1ba1 commit fed7a21

File tree

7 files changed

+169
-30
lines changed

7 files changed

+169
-30
lines changed

‎README.md

+5-2
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,11 @@ This chart extends all the features in the upstream chart in addition to includi
88

99
### Installing from the Chart Repository
1010

11-
For a quickstart on how to install Sigstore components on OpenShift refer to the
12-
[quickstart quide](docs/quick-start-with-keycloak.md)
11+
For a quickstart on how to install Sigstore components on OpenShift with OpenShift SSO (Keycloak), refer to the
12+
[quickstart quide with keycloak](docs/quick-start-with-keycloak.md)
13+
14+
For a quickstart on how to install Sigstore components on OpenShift with the upstream Sigstore OIDC Issuer URL, refer to the
15+
[quickstart quide](docs/quick-start-with-sigstore-issuer.md)
1316

1417
## Scaffolding Chart
1518

‎charts/trusted-artifact-signer/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,4 +33,4 @@ sources:
3333
# This is the chart version. This version number should be incremented each time you make changes
3434
# to the chart and its templates, including the app version.
3535
# Versions are expected to follow Semantic Versioning (https://semver.org/)
36-
version: 0.1.29
36+
version: 0.1.30

‎charts/trusted-artifact-signer/README.md

+41-14
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,17 @@
33

44
A Helm chart for deploying Sigstore scaffold chart that is opinionated for OpenShift
55

6-
![Version: 0.1.29](https://img.shields.io/badge/Version-0.1.29-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
6+
![Version: 0.1.30](https://img.shields.io/badge/Version-0.1.30-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
77

88
## Overview
99

1010
This wrapper chart builds on top of the [Scaffold](https://github.com/sigstore/helm-charts/tree/main/charts/scaffold)
1111
chart from the Sigstore project to both simplify and satisfy the requirements for deployment within an OpenShift
1212

13-
If you have already read this document and want a quick no-fail path to installing a Sigstore stack with RH SSO,
13+
Refer to the quick-start to install Sigstore components on OpenShift with the upstream Sigstore OIDC Issuer URL,
14+
[quickstart quide](docs/quick-start-with-sigstore-issuer.md)
15+
16+
For a quick no-fail path to installing a Sigstore stack with RH SSO,
1417
follow [quick start](../../docs/quick-start-with-keycloak.md)
1518

1619
The chart enhances the scaffold chart by taking care of the following:
@@ -35,15 +38,48 @@ scaffold:
3538

3639
### Sample Implementation
3740

38-
#### Prerequisites
39-
40-
The following must be satisfied prior to deploying the sample implementation:
41+
The installer and the quick start with RedHat SSO script include the creation of the necessary secrets:
4142

4243
* Fulcio root CA certificate and signing keys
4344
* More information in [requirements-keys-certs.md](../../docs/requirements-keys-certs.md)
4445
* OpenID Token Issuer endpoint
46+
* The public Sigstore OIDC Issuer URL `https://oauth2.sigstore.dev/auth` is configured in the absence of any other OIDC provider.
4547
* Keycloak/RHSSO requirements can be followed and deployed in OpenShift with [keycloak-example.md](../../docs/keycloak-example.md)
4648

49+
To add configuration options to the TAS installation, either provide a custom `values.yaml` or provide available flags to the `tas-install`
50+
command.
51+
52+
#### Configure the install with the `tas-install` command flags.
53+
54+
Here are the available options for use with `tas-install`. For any other customization, you may provide a `values.yaml` with necessary
55+
information.
56+
57+
```
58+
$ ./tas-install install -h
59+
Installs Trusted Artifact Signer (TAS) on a Kubernetes cluster.
60+
61+
This command performs a series of actions:
62+
1. Initializes the Kubernetes client to interact with your cluster
63+
2. Sets up necessary certificates
64+
3. Configures secrets
65+
4. Deploys TAS to openshift
66+
67+
Usage:
68+
tas-installer install [flags]
69+
70+
Flags:
71+
--chart-location string /local/path/to/chart or oci://registry/repo location of Helm chart (default "./charts/trusted-artifact-signer")
72+
--chart-version string Version of the Helm chart (default "0.1.29")
73+
-h, --help help for install
74+
--oidc-client-id string Specify the OIDC client ID
75+
--oidc-issuer-url string Specify the OIDC issuer URL e.g for keycloak: https://[keycloak-domain]/auth/realms/[realm-name]
76+
--oidc-type string Specify the OIDC type
77+
--values string path to custom values file for chart configuration
78+
79+
Global Flags:
80+
--kubeconfig string Specify the kubeconfig path (default "/Users/somalley/.kube/config")
81+
```
82+
4783
#### Update the values file
4884

4985
Helm values files are available in the examples directory that provides a baseline to work off of.
@@ -55,15 +91,6 @@ to curate the deployment of the chart:
5591

5692
2. Perform any additional customizations as desired
5793

58-
### Installing the Chart
59-
60-
When logged in as an elevated OpenShift user, execute the following to install the chart referencing the
61-
customized values file. The OPENSHIFT_APPS_SUBDOMAIN will be substituted in the values file with `envsubst` below:
62-
63-
```shell
64-
OPENSHIFT_APPS_SUBDOMAIN=apps.$(oc get dns cluster -o jsonpath='{ .spec.baseDomain }') envsubst < examples/values-sigstore-openshift.yaml | helm upgrade -i trusted-artifact-signer --debug charts/trusted-artifact-signer -n sigstore --create-namespace --values -
65-
```
66-
6794
### Monitor Sigstore Components with Grafana
6895

6996
For real-time analytics through Grafana, refer to our [enable-grafana-monitoring.md](../../docs/enable-grafana-monitoring.md) guide.

‎charts/trusted-artifact-signer/README.md.gotmpl

+40-12
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,10 @@
88
This wrapper chart builds on top of the [Scaffold](https://github.com/sigstore/helm-charts/tree/main/charts/scaffold)
99
chart from the Sigstore project to both simplify and satisfy the requirements for deployment within an OpenShift
1010

11-
If you have already read this document and want a quick no-fail path to installing a Sigstore stack with RH SSO,
11+
Refer to the quick-start to install Sigstore components on OpenShift with the upstream Sigstore OIDC Issuer URL,
12+
[quickstart quide](docs/quick-start-with-sigstore-issuer.md)
13+
14+
For a quick no-fail path to installing a Sigstore stack with RH SSO,
1215
follow [quick start](../../docs/quick-start-with-keycloak.md)
1316

1417
The chart enhances the scaffold chart by taking care of the following:
@@ -33,15 +36,48 @@ scaffold:
3336

3437
### Sample Implementation
3538

36-
#### Prerequisites
37-
38-
The following must be satisfied prior to deploying the sample implementation:
39+
The installer and the quick start with RedHat SSO script include the creation of the necessary secrets:
3940

4041
* Fulcio root CA certificate and signing keys
4142
* More information in [requirements-keys-certs.md](../../docs/requirements-keys-certs.md)
4243
* OpenID Token Issuer endpoint
44+
* The public Sigstore OIDC Issuer URL `https://oauth2.sigstore.dev/auth` is configured in the absence of any other OIDC provider.
4345
* Keycloak/RHSSO requirements can be followed and deployed in OpenShift with [keycloak-example.md](../../docs/keycloak-example.md)
4446

47+
To add configuration options to the TAS installation, either provide a custom `values.yaml` or provide available flags to the `tas-install`
48+
command.
49+
50+
#### Configure the install with the `tas-install` command flags.
51+
52+
Here are the available options for use with `tas-install`. For any other customization, you may provide a `values.yaml` with necessary
53+
information.
54+
55+
```
56+
$ ./tas-install install -h
57+
Installs Trusted Artifact Signer (TAS) on a Kubernetes cluster.
58+
59+
This command performs a series of actions:
60+
1. Initializes the Kubernetes client to interact with your cluster
61+
2. Sets up necessary certificates
62+
3. Configures secrets
63+
4. Deploys TAS to openshift
64+
65+
Usage:
66+
tas-installer install [flags]
67+
68+
Flags:
69+
--chart-location string /local/path/to/chart or oci://registry/repo location of Helm chart (default "./charts/trusted-artifact-signer")
70+
--chart-version string Version of the Helm chart (default "0.1.29")
71+
-h, --help help for install
72+
--oidc-client-id string Specify the OIDC client ID
73+
--oidc-issuer-url string Specify the OIDC issuer URL e.g for keycloak: https://[keycloak-domain]/auth/realms/[realm-name]
74+
--oidc-type string Specify the OIDC type
75+
--values string path to custom values file for chart configuration
76+
77+
Global Flags:
78+
--kubeconfig string Specify the kubeconfig path (default "/Users/somalley/.kube/config")
79+
```
80+
4581
#### Update the values file
4682

4783
Helm values files are available in the examples directory that provides a baseline to work off of.
@@ -53,14 +89,6 @@ to curate the deployment of the chart:
5389

5490
2. Perform any additional customizations as desired
5591

56-
### Installing the Chart
57-
58-
When logged in as an elevated OpenShift user, execute the following to install the chart referencing the
59-
customized values file. The OPENSHIFT_APPS_SUBDOMAIN will be substituted in the values file with `envsubst` below:
60-
61-
```shell
62-
OPENSHIFT_APPS_SUBDOMAIN=apps.$(oc get dns cluster -o jsonpath='{ .spec.baseDomain }') envsubst < examples/values-sigstore-openshift.yaml | helm upgrade -i trusted-artifact-signer --debug charts/trusted-artifact-signer -n sigstore --create-namespace --values -
63-
```
6492

6593
### Monitor Sigstore Components with Grafana
6694

‎docs/quick-start-with-sigstore-issuer.md

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
## Quick Start with Sigstore Public OIDC Issuer
2+
3+
1. Use the installer's `install` command to install the required signing keys and root certificate for keyless signing and install the sigstore stack.
4+
5+
To build the installer
6+
7+
```
8+
go build -C tas-installer -o ../tas-install
9+
```
10+
11+
The installer expects a `kubeconfig` file at `$HOME/.kube/config`,, or that the flag `--kubeconfig /path/to/kubeconfig` is provided.
12+
By default, the fulcio server is configured to use the upstream public OIDC issuer at `oauth2.sigstore.dev/auth`. An interactive browser
13+
based flow in which you will authenticate with Google, GitHub, or MicroSoft will be initiated when signing artifacts..
14+
15+
First, the user is prompted for information in order to create rekor and fulcio signing keys as well as the fulcio root certificate.
16+
Then, the Trusted Artifact Signer resources will be created. The stack is ready to use when all jobs have been completed. The job
17+
in the `tuf-system` namespace will be the last to complete, and can take several minutes.
18+
19+
```shell
20+
./tas-install install
21+
```
22+
23+
Watch `oc get jobs -A` and when the `tuf-system` job is complete, the TAS stack should be ready to sign & verify artifacts.
24+
25+
Once complete, move to the [Sign & Verify document](sign-verify.md) to test the Sigstore stack.
26+
27+
If there is already a helm release `trusted-artifact-signer` installed, the command `./tas-install install` will perform an upgrade.
28+
In this case, it will reuse the signing keys and certificate secrets from the connected cluster's `fulcio-system` and `rekor-system`
29+
namespaces.
30+

‎docs/tas-install.md

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
## Trusted Artifact Signer Installer
2+
3+
The `tas-install` command is experimental. To build it, run the following from the repository root.
4+
5+
```
6+
go build -C tas-installer -o ../tas-install
7+
```
8+
9+
### Install
10+
11+
```
12+
$ ./tas-install install -h
13+
Installs Trusted Artifact Signer (TAS) on a Kubernetes cluster.
14+
15+
This command performs a series of actions:
16+
1. Initializes the Kubernetes client to interact with your cluster
17+
2. Sets up necessary certificates
18+
3. Configures secrets
19+
4. Deploys TAS to openshift
20+
21+
Usage:
22+
tas-installer install [flags]
23+
24+
Flags:
25+
--chart-location string /local/path/to/chart or oci://registry/repo location of Helm chart (default "./charts/trusted-artifact-signer")
26+
--chart-version string Version of the Helm chart (default "0.1.29")
27+
-h, --help help for install
28+
--oidc-client-id string Specify the OIDC client ID
29+
--oidc-issuer-url string Specify the OIDC issuer URL e.g for keycloak: https://[keycloak-domain]/auth/realms/[realm-name]
30+
--oidc-type string Specify the OIDC type
31+
--values string path to custom values file for chart configuration
32+
33+
Global Flags:
34+
--kubeconfig string Specify the kubeconfig path (default "$HOME/.kube/config")
35+
```
36+
37+
### Uninstall
38+
39+
```
40+
$ ./tas-install uninstall -h
41+
Removes installation of Trusted Artifact Signer (TAS) on a Kubernetes cluster.
42+
43+
Usage:
44+
tas-installer uninstall [flags]
45+
46+
Flags:
47+
-h, --help help for uninstall
48+
49+
Global Flags:
50+
--kubeconfig string Specify the kubeconfig path (default "$HOME/.kube/config")
51+
```

‎tas-installer/cmd/install.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ func installTas(tasNamespace string) error {
8686
}
8787

8888
func init() {
89-
installCmd.PersistentFlags().StringVar(&helmChartVersion, "chart-version", "0.1.29", "Version of the Helm chart")
89+
installCmd.PersistentFlags().StringVar(&helmChartVersion, "chart-version", "0.1.30", "Version of the Helm chart")
9090
installCmd.PersistentFlags().StringVar(&helmChartLocation, "chart-location", "./charts/trusted-artifact-signer", "/local/path/to/chart or oci://registry/repo location of Helm chart")
9191
installCmd.PersistentFlags().StringVar(&helmValuesFile, "values", "", "path to custom values file for chart configuration")
9292
installCmd.PersistentFlags().StringVar(&oidcConfig.IssuerURL, "oidc-issuer-url", "", "Specify the OIDC issuer URL e.g for keycloak: https://[keycloak-domain]/auth/realms/[realm-name]")

0 commit comments

Comments
 (0)