| name | tpa-deployment |
| metadata | {"author":"rhoai3-coding-demo","version":"1.0.0","platform-family":"tpa","platform-baseline":"repo","ocp-baseline":"repo","skill-group":"Trusted Software Supply Chain"} |
| description | Use when deploying Red Hat Trusted Profile Analyzer 2.2 on Red Hat Enterprise Linux or Red Hat OpenShift, including prerequisites, operator installation, and self-hosted configuration. Do NOT use for the managed service quick start (use tpa-quick-start), release notes (use tpa-release-notes), or administration (use tpa-admin).
|
TPA Deployment
Use this skill for deploying Red Hat Trusted Profile Analyzer (RHTPA) 2.2 on
the active platform baseline in docs/PLATFORM_BASELINE.md.
Source Grounding
Read references/source-capture.md before using product configuration details.
Official Red Hat docs are product authority. This skill covers installation
platform selection, Ansible-based RHEL deployment, OLM Operator deployment, and
Helm-based OpenShift deployment with AWS or Red Hat service backends.
Installation Platforms
RHTPA supports two target platforms:
- Red Hat Enterprise Linux — installed via Ansible playbook from Automation
Hub (
rhtpa collection, tpa_single_node role).
- Red Hat OpenShift Container Platform 4.17+ — installed via OLM Operator
or Helm chart.
OpenShift deployments support two infrastructure backends:
- AWS: Cognito (OIDC), S3 (storage), RDS (PostgreSQL).
- Red Hat services: Red Hat SSO (OIDC), ODF (S3-compatible storage),
self-managed PostgreSQL.
Prerequisites
RHEL (Ansible)
- RHEL 9.3 or later.
- Red Hat Hybrid Cloud Console account.
- Configured OIDC provider (Red Hat SSO or AWS Cognito).
- Storage provider (ODF or AWS S3).
- Available PostgreSQL or Amazon RDS instance.
OpenShift (OLM or Helm)
- OpenShift Container Platform 4.17 or later.
cluster-admin role on the web console (OLM) or oc CLI access.- Configured OIDC provider (Red Hat SSO or AWS Cognito).
- Storage provider (ODF or AWS S3) with a bucket named
trustify-UNIQUE_ID.
- Available PostgreSQL or Amazon RDS instance.
- Ingress with publicly trusted HTTPS certificates (Helm path).
Resource Recommendations (OpenShift)
| Resource | Baseline |
|---|
| CPU | 4 cores |
| Memory | 8 GB RAM |
| DB storage | 45 GB |
| Object storage | 45 GB (scale by SBOM volume) |
Workflow
- Read
references/source-capture.md and confirm the product baseline.
- Select an installation platform (RHEL Ansible, OLM Operator, or Helm).
- Read
references/official-doc-extraction.md for the chosen path.
- Provision prerequisites (OIDC, storage, database).
- Create required Kubernetes Secrets (storage, OIDC, PostgreSQL credentials).
- Deploy using the selected method.
- Validate deployment.
OLM Operator Path
- Install the RHTPA Operator from OperatorHub.
- Create a
TrustedProfileAnalyzer CR instance (YAML view).
- Paste OIDC, storage, and importer config under
spec.
- Click Create.
Helm Path
- Create project:
oc new-project trusted-profile-analyzer.
- Create Secrets:
storage-credentials, oidc-cli,
postgresql-credentials, postgresql-admin-credentials.
- Prepare
values-rhtpa.yaml and values-importers.yaml.
- Add Helm repo:
helm repo add openshift-helm-charts https://charts.openshift.io/.
- Install:
helm upgrade --install redhat-trusted-profile-analyzer ....
Validation
# Verify pods are running
oc -n trusted-profile-analyzer get pods
# Get console URL
oc -n $NAMESPACE get route --selector app.kubernetes.io/name=server \
-o jsonpath='https://{.items[0].status.ingress[0].host}'
Required Secrets (OpenShift)
All deployment paths require these Secrets in the target namespace:
| Secret | Keys | Purpose |
|---|
storage-credentials | aws_access_key_id, aws_secret_access_key (AWS) or user, password (RH) | S3 storage access |
oidc-cli | client-secret | OIDC CLI client secret |
postgresql-credentials | db.host, db.name, db.user, db.password, db.port | Standard DB access |
postgresql-admin-credentials | db.host, db.name, db.user, db.password, db.port | Admin DB access (migrations) |
CRDs
| Kind | API Group | Installation method |
|---|
TrustedProfileAnalyzer | (OLM Operator) | OLM |
Related Skills
tpa-quick-start — managed service quick start on Red Hat Hybrid Cloud Console.tpa-release-notes — RHTPA 2.2 release notes, known issues, fixes.tpa-admin — post-deployment administration, user management, configuration.tpa-integration — SBOM/VEX ingestion, importer configuration, API usage.
References
references/source-capture.mdreferences/official-doc-extraction.md
