69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
|
|
resources:
|
|
- ../../base
|
|
- openshift-pipelines-namespace.yaml
|
|
- oidc-token-refresh-sa.yaml
|
|
# - signing-cert-external.yaml
|
|
- oidc-info-secret.yaml
|
|
- oidc-token-refresher-deploy.yaml
|
|
|
|
patches:
|
|
- target:
|
|
kind: TektonConfig
|
|
name: config
|
|
patch: |
|
|
- op: replace
|
|
path: /spec/chain
|
|
value:
|
|
signers.x509.fulcio.enabled: true
|
|
artifacts.taskrun.storage: oci
|
|
artifacts.pipelinerun.storage: oci
|
|
artifacts.pipelinerun.format: in-toto
|
|
transparency.enabled: 'true'
|
|
artifacts.taskrun.format: in-toto
|
|
signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com'
|
|
artifacts.oci.signer: x509
|
|
signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com'
|
|
artifacts.oci.storage: oci
|
|
signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab'
|
|
transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com'
|
|
disabled: false
|
|
artifacts.oci.format: simplesigning
|
|
options:
|
|
deployments:
|
|
tekton-chains-controller:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
selector: null
|
|
strategy: {}
|
|
template:
|
|
metadata:
|
|
creationTimestamp: null
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: TUF_ROOT
|
|
value: /tuf
|
|
name: tekton-chains-controller
|
|
resources: {}
|
|
volumeMounts:
|
|
- mountPath: /tuf
|
|
name: tuf
|
|
- mountPath: /var/run/sigstore/cosign
|
|
name: oidc-info
|
|
volumes:
|
|
- name: tuf
|
|
- name: oidc-info
|
|
secret:
|
|
items:
|
|
- key: id-token
|
|
path: oidc-token
|
|
secretName: oidc-token
|
|
status: {}
|
|
disabled: false
|
|
signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token
|
|
artifacts.taskrun.signer: x509
|