1. Home
  2. Red Hat Interactive Learning Portal
  3. Deploy Red Hat Trusted Artifact Signer using Google Cloud and Cosign

Deploy Red Hat Trusted Artifact Signer using Google Cloud and Cosign

Learning path | 4 resources | 20 mins | Published on March 27, 2024
Veda Shankar

Learn how to install the Red Hat Trusted Artifact Signer using Google identity provider. Once installed, explore how to sign and verify a container image using Cosign.

  1. Overview: Deploy Red Hat Trusted Artifact Signer using Google Cloud and Cosign
  2. Install and deploy Red Hat Trusted Artifact Signer Page | 15 mins
  3. Sign and verify container image using Red Hat Trusted Artifact Signer Page | 5 mins
  4. A developer’s guide to setting supply chain security in DevSecOps E-books

Overview: Deploy Red Hat Trusted Artifact Signer using Google Cloud and Cosign

Trusted artifact learning path feature image

Organizations can face significant challenges in validating the authenticity of their deployed container images within their production environments. Cryptographic signing of container images helps to verify the integrity of the container and ensures that it has not been tampered with since its deployment into production. Verification of the container image signature also confirms that the expected software owner, whose identity was certified at the moment of signing, is the published container image running in production. Red Hat Trusted Artifact Signer (RHTAS), a cryptographic signature and validation tool based on the Sigstore project, helps confront these challenges.

In this learning path, we will install the Red Hat Trusted Artifact Signer Operator, configure Google Cloud as our OpenID Connect (OIDC) provider, and sign and verify a container image. We will use code-signed certificates with short-lived signing keys bound to Google Cloud OAuth accounts. This keyless signing approach offers simplicity due to the lack of a key management infrastructure.

Prerequisites:

  • Red Hat OpenShift Container Platform 4.17 or later.
  • A Google Cloud user account to sign and verify a container image.
  • A workstation with command-line access to use the oc, and podman binaries.

In this learning path, you will:

  • Learn how to install the RHTAS Operator on Red Hat OpenShift.
  • Deploy the RHTAS service with Google Cloud OAuth as the OIDC provider.
  • Create a Google Cloud OAuth client identifier.
  • Sign and verify a container image by using cosign.

How long will this activity take?

  • About 15–20 minutes