Install and deploy Red Hat Trusted Artifact Signer

You can deploy Red Hat Trusted Artifact Signer (RHTAS) by using the Operator Lifecycle Manager (OLM) on Red Hat OpenShift. During this process, you will configure RHTAS with Google Cloud as the OpenID Connect (OIDC) provider. This enables you to utilize keyless signing to sign and verify container images.

In this lesson, you will:

• Create a Google Cloud OAuth client identifier.
• Install the RHTAS Operator using the OLM.
• Deploy the RHTAS service. 
• Download the Cosign binary.

Create a Google Cloud OAuth client ID

You can use your Google Cloud account as your OIDC provider to create a Google OAuth client identifier.

1. Open a web browser, go to the Google Cloud Console, and log in with your Google user account.
2. Expand the APIs & Services navigational menu, and select Credentials.
3. Select an existing project or create a new project for your credentials.
4. Click + Create credentials, and select OAuth client ID.
5. If you have configured your consent already, then you can skip this step.
   If you have not configured your consent, then click the Configure consent screen button, and follow these steps:
   1. On the Branding page, click the Get started button.
   2. On the Project configuration page, provide your App Information and click Next. 
   3. Select the intended Audience and click Next. 
   4. Provide your Contact Information and click Next. 
   5. Agree to the Google API User Data Policy and click Continue, and finally click the Create button.
   6. On the OAuth Overview page, click the Create OAuth client button.
6. From the drop-down menu, select Web application and set the application type to Web Application.
7. Give a name to your OAuth client.
8. Under the Authorized redirect URIs section, click the + Add URI button.
   1. Add the following URI address to the URI field: http://localhost/auth/callback.
   2. Click the Create button.
9. Make a note of your Client ID for use later on.
10. On the Credentials page, click on your new OAuth 2.0 Client ID from the list.
11. Under the Client secrets section, click the download icon to save the client secret into a local file on your workstation, name the file “my-google-secret”. This secret file will be used later when signing the container image using Cosign.

Install the RHTAS Operator

Follow these steps to install the RHTAS Operator:

1. Log into the OpenShift web console with a user that has the cluster-admin role.
2. From the Administrator perspective, expand the Operators navigation menu and click OperatorHub.
3. In the search field, type trusted, and click the Red Hat Trusted Artifact Signer tile.

4. Click the Install button to show the operator details.
5. Accept the default values, click Install on the Install Operator page, and wait for the installation to finish.
   
   The RHTAS Operator installs into the openshift-operators namespace, and all dependencies are automatically installed. Once the installation finishes, a new project is automatically created for you. The new project name is trusted-artifact-signer.

Deploy a RHTAS service

Once the RHTAS Operator installation finishes, you need to deploy the Red Hat Trusted Artifact Signer service. To deploy the Red Hat Trusted Artifact Signer service:

1. Expand Operators from the navigation menu, and click Installed Operators.
2. Select the trusted-artifact-signer project from the project drop-down box, which is automatically created when you install the RHTAS Operator.
3. Click Red Hat Trusted Artifact Signer.
4. Click the Securesign tab, and then click Create Securesign.
5. On the Create Securesign page, select YAML view.

6. Under the spec.fulcio.config.OIDCIssuers section, update the OIDCIssuers section with your Google Cloud OAuth client identifier (ClientID) information. For example:

   ...
        OIDCIssuers:
          - ClientID: 313xxx-xxx.apps.googleusercontent.com
            Issuer: 'https://accounts.google.com'
            IssuerURL: 'https://accounts.google.com'
            Type: email
   ...

7. Click Create.
8. Click the All instances tab to watch the deployment status until the CTlog, Fulcio, Rekor, Trillian, and TUF instances are ready.

Congratulations! You have installed the RHTAS Operator, and deployed the RHTAS service running on Red Hat OpenShift. You are ready to sign a container image, and verify its signature.