apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization

resources:
- ../../base
- openshift-pipelines-namespace.yaml
- oidc-token-refresh-sa.yaml
# - signing-cert-external.yaml
- oidc-info-secret.yaml
- oidc-token-refresher-deploy.yaml

patches:
  - target:
      kind: TektonConfig
      name: config
    patch: |
      - op: replace
        path: /spec/chain
        value:
          signers.x509.fulcio.enabled: true
          artifacts.taskrun.storage: oci
          artifacts.pipelinerun.storage: oci
          artifacts.pipelinerun.format: in-toto
          transparency.enabled: 'true'
          artifacts.taskrun.format: in-toto
          signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com'
          artifacts.oci.signer: x509
          signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com'
          artifacts.oci.storage: oci
          signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab'
          transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com'
          disabled: false
          artifacts.oci.format: simplesigning
          options:
            deployments:
              tekton-chains-controller:
                metadata:
                  creationTimestamp: null
                spec:
                  selector: null
                  strategy: {}
                  template:
                    metadata:
                      creationTimestamp: null
                    spec:
                      containers:
                        - env:
                            - name: TUF_ROOT
                              value: /tuf
                          name: tekton-chains-controller
                          resources: {}
                          volumeMounts:
                            - mountPath: /tuf
                              name: tuf
                            - mountPath: /var/run/sigstore/cosign
                              name: oidc-info
                      volumes:
                        - name: tuf
                        - name: oidc-info
                          secret:
                            items:
                              - key: id-token
                                path: oidc-token
                            secretName: oidc-token
                status: {}
            disabled: false
          signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token
          artifacts.taskrun.signer: x509