Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/pipelines-operator/overlays/chains/kustomization.yaml

@@ -0,0 +1,68 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+- openshift-pipelines-namespace.yaml
+- oidc-token-refresh-sa.yaml
+# - signing-cert-external.yaml
+- oidc-info-secret.yaml
+- oidc-token-refresher-deploy.yaml
+
+patches:
+  - target:
+      kind: TektonConfig
+      name: config
+    patch: |
+      - op: replace
+        path: /spec/chain
+        value:
+          signers.x509.fulcio.enabled: true
+          artifacts.taskrun.storage: oci
+          artifacts.pipelinerun.storage: oci
+          artifacts.pipelinerun.format: in-toto
+          transparency.enabled: 'true'
+          artifacts.taskrun.format: in-toto
+          signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com'
+          artifacts.oci.signer: x509
+          signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com'
+          artifacts.oci.storage: oci
+          signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab'
+          transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com'
+          disabled: false
+          artifacts.oci.format: simplesigning
+          options:
+            deployments:
+              tekton-chains-controller:
+                metadata:
+                  creationTimestamp: null
+                spec:
+                  selector: null
+                  strategy: {}
+                  template:
+                    metadata:
+                      creationTimestamp: null
+                    spec:
+                      containers:
+                        - env:
+                            - name: TUF_ROOT
+                              value: /tuf
+                          name: tekton-chains-controller
+                          resources: {}
+                          volumeMounts:
+                            - mountPath: /tuf
+                              name: tuf
+                            - mountPath: /var/run/sigstore/cosign
+                              name: oidc-info
+                      volumes:
+                        - name: tuf
+                        - name: oidc-info
+                          secret:
+                            items:
+                              - key: id-token
+                                path: oidc-token
+                            secretName: oidc-token
+                status: {}
+            disabled: false
+          signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token
+          artifacts.taskrun.signer: x509

cluster-config/components/pipelines-operator/overlays/chains/oidc-info-secret.yaml

@@ -0,0 +1,18 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+  name: oidc-info
+  namespace: openshift-pipelines
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: oidc-info
+    creationPolicy: Owner
+  dataFrom:
+  - extract:
+      key: OIDC_INFO

cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresh-sa.yaml

@@ -0,0 +1,36 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: oidc-token-refresher
+  namespace: openshift-pipelines
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - create
+  - patch
+  - update
+  - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: oidc-token-refresher
+  namespace: openshift-pipelines
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: oidc-token-refresher
+subjects:
+- kind: ServiceAccount
+  name: oidc-token-refresher
+  namespace: openshift-pipelines
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: oidc-token-refresher
+  namespace: openshift-pipelines

cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresher-deploy.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oidc-token-refresher
+  namespace: openshift-pipelines
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 1
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app: oidc-token-refresher
+  strategy:
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app: oidc-token-refresher
+        deployment: oidc-token-refresher
+    spec:
+      containers:
+      - command:
+        - sh
+        - -c
+        - |
+          #!/bin/bash
+          set -o pipefail
+          while true; do
+            JWT_TOKEN=$(curl -sL --location "${OIDC_TOKEN_ENDPOINT}" \
+            --header "Content-Type: application/x-www-form-urlencoded" \
+            --data-urlencode "grant_type=client_credentials" \
+            --data-urlencode "client_id=${OIDC_CLIENT_ID}" \
+            --data-urlencode "client_secret=${OIDC_CLIENT_SECRET}" \
+            --data-urlencode "scope=openid" | jq -r '.id_token')
+            kubectl create secret generic oidc-token --from-literal=id-token=${JWT_TOKEN} --dry-run=client -o yaml | kubectl apply -f-
+            sleep 120
+          done
+        envFrom:
+        - secretRef:
+            name: oidc-info
+        image: quay.io/openshiftdemos/rollouts-terminal-tooling:latest
+        imagePullPolicy: Always
+        name: oidc-token-refresher
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccount: oidc-token-refresher
+      serviceAccountName: oidc-token-refresher
+      terminationGracePeriodSeconds: 30

cluster-config/components/pipelines-operator/overlays/chains/openshift-pipelines-namespace.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/instance: default
+    app.kubernetes.io/part-of: tekton-pipelines
+    kubernetes.io/metadata.name: openshift-pipelines
+    openshift.io/cluster-monitoring: "true"
+    operator.tekton.dev/disable-proxy: "true"
+  name: openshift-pipelines

cluster-config/components/pipelines-operator/overlays/chains/signing-cert-external.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: signing-secrets
+  namespace: openshift-pipelines
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: doppler-cluster
+  target:
+    name: signing-secrets
+    # prevent fighting with tekton over ownership
+    creationPolicy: Orphan
+  dataFrom:
+  - extract:
+      key: COSIGN