Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

components/pipelines-operator/overlays/chains/kustomization.yaml

@@ -0,0 +1,68 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+- ../../base
+- openshift-pipelines-namespace.yaml
+- oidc-token-refresh-sa.yaml
+# - signing-cert-external.yaml
+- oidc-info-secret.yaml
+- oidc-token-refresher-deploy.yaml
+
+patches:
+  - target:
+      kind: TektonConfig
+      name: config
+    patch: |
+      - op: replace
+        path: /spec/chain
+        value:
+          signers.x509.fulcio.enabled: true
+          artifacts.taskrun.storage: oci
+          artifacts.pipelinerun.storage: oci
+          artifacts.pipelinerun.format: in-toto
+          transparency.enabled: 'true'
+          artifacts.taskrun.format: in-toto
+          signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com'
+          artifacts.oci.signer: x509
+          signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com'
+          artifacts.oci.storage: oci
+          signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab'
+          transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com'
+          disabled: false
+          artifacts.oci.format: simplesigning
+          options:
+            deployments:
+              tekton-chains-controller:
+                metadata:
+                  creationTimestamp: null
+                spec:
+                  selector: null
+                  strategy: {}
+                  template:
+                    metadata:
+                      creationTimestamp: null
+                    spec:
+                      containers:
+                        - env:
+                            - name: TUF_ROOT
+                              value: /tuf
+                          name: tekton-chains-controller
+                          resources: {}
+                          volumeMounts:
+                            - mountPath: /tuf
+                              name: tuf
+                            - mountPath: /var/run/sigstore/cosign
+                              name: oidc-info
+                      volumes:
+                        - name: tuf
+                        - name: oidc-info
+                          secret:
+                            items:
+                              - key: id-token
+                                path: oidc-token
+                            secretName: oidc-token
+                status: {}
+            disabled: false
+          signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token
+          artifacts.taskrun.signer: x509