apiVersion: rhtas.redhat.com/v1alpha1
kind: Securesign
metadata:
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
    argocd.argoproj.io/sync-wave: "10"
  labels:
    app.kubernetes.io/instance: securesign
    app.kubernetes.io/name: securesign
    app.kubernetes.io/part-of: trusted-artifact-signer
  name: securesign
  namespace: trusted-artifact-signer
spec:
  fulcio:
    certificate:
      commonName: fulcio.hostname
      organizationEmail: jdoe@redhat.com
      organizationName: Red Hat
    config:
      OIDCIssuers:
      - ClientID: trusted-artifact-signer
        Issuer: <replaceme>
        IssuerURL: <replaceme>
        Type: email
    externalAccess:
      enabled: true
    monitoring:
      enabled: false
  rekor:
    backFillRedis:
      enabled: true
      schedule: 0 0 * * *
    externalAccess:
      enabled: true
    monitoring:
      enabled: false
    pvc:
      retain: true
      size: 5Gi
    rekorSearchUI:
      enabled: true
    signer:
      kms: secret
  trillian:
    database:
      create: true
      pvc:
        retain: true
        size: 5Gi
  tuf:
    externalAccess:
      enabled: true
    keys:
    - name: rekor.pub
    - name: ctfe.pub
    - name: fulcio_v1.crt.pem
    port: 80