| name | rhads-install |
| metadata | {"author":"rhoai3-coding-demo","version":"1.0.0","platform-family":"rhads","platform-baseline":"repo","ocp-baseline":"repo","skill-group":"Trusted Software Supply Chain"} |
| description | Use when installing Red Hat Trusted Application Pipeline / RHADS-SSC on OpenShift, including prerequisites, operator installation, and verification: downloading the tssc CLI container, creating and customizing config.yaml, integrating external services (GitHub, GitLab, Bitbucket, Quay, JFrog, Nexus, RHACS, RHTAS, RHTPA, Jenkins, Azure Pipelines), deploying with tssc deploy, retrieving credentials, and understanding hardware requirements and component versions for RHADS-SSC 1.9. Do NOT use for CI/CD pipeline authoring or integration workflows (use rhads-cicd-*), customization beyond config.yaml (use rhads-customize), or compliance policy configuration (use rhads-compliance).
|
RHADS-SSC Install
Use this skill to ground RHADS-SSC installation guidance in the official
Red Hat Advanced Developer Suite - software supply chain 1.9 installing guide.
Source Grounding
Read references/source-capture.md before using product behavior. Official
Red Hat documentation is product authority. This skill covers the installer
workflow, hardware requirements, service integrations, deployment, upgrade
posture, credentials reference, and component list.
Product Overview
RHADS-SSC is a suite that deploys a secure, automated CI/CD platform on
OpenShift. It includes:
- Red Hat Advanced Cluster Security (RHACS)
- Red Hat Developer Hub (RHDH)
- Conforma (policy engine)
- OpenShift GitOps (Argo CD)
- OpenShift Pipelines (Tekton)
- Red Hat Trusted Artifact Signer (RHTAS)
- Red Hat Trusted Profile Analyzer (RHTPA)
- Red Hat build of Keycloak (IAM)
Prerequisites
- Minimum 3-node OpenShift Container Platform cluster
cluster-admin access- Container management tool (Podman or Docker) on the workstation
- Default storage class with dynamic PV provisioning
- Worker nodes: minimum 5 CPU cores / 17 GiB RAM per node; recommended
8 cores / 24 GiB RAM per node
Installation Workflow
- Download: Pull the installer image
quay.io/redhat-tssc/cli:1.9.0 and start an interactive container.
- Login:
oc login to the target cluster inside the container.
- Create config:
tssc config --create generates the default
config.yaml ConfigMap.
- Customize: Edit
config.yaml to disable/enable products, set IAM
provider (github or gitlab), configure RBAC, namespace prefixes, and
manageSubscription.
- Integrate: Run
tssc integration <provider> commands for Git,
registry, and pre-existing product instances (RHACS, RHTAS, RHTPA).
- Deploy:
tssc deploy installs all enabled components. Typical
deployment takes ~1 hour. Re-run on failure before contacting support.
Upgrade Posture
The installer does not support upgrades. After initial deployment, upgrade
each component individually via its Operator or Helm chart. RHADS-SSC 1.9
targets: RHDH Operator 1.9, RHACS Operator 4.10, RHTPA 2.2 Helm,
RHTAS Operator 2.2, OpenShift Pipelines Operator 1.21.
Key Integrations
| Provider | Command | Purpose |
|---|
| GitHub | tssc integration github-app | IAM + source repos |
| GitLab | tssc integration gitlab | IAM + source repos + CI |
| Quay | tssc integration quay | Container image registry |
| JFrog | tssc integration artifactory | Artifact registry |
| Nexus | tssc integration nexus | Artifact registry |
| RHACS | tssc integration acs | Pre-existing ACS instance |
| RHTAS | tssc integration trusted-artifact-signer | Pre-existing signing |
| RHTPA | tssc integration trustification | Pre-existing SBOM analysis |
| Jenkins | tssc integration jenkins | CI provider |
| Azure | tssc integration azure | CI provider (Tech Preview) |
An image registry (Quay, JFrog, or Nexus) must be integrated or
installation will fail.
Credentials Reference
After deployment, retrieve component credentials with oc from their
namespaces. See references/official-doc-extraction.md for the full
credentials table covering RHACS (tssc-acs), GitOps (tssc-gitops),
Keycloak (tssc-keycloak), RHTAS (tssc-tas), RHTPA (tssc-tpa), and
RHDH (tssc-dh).
Verification
# Confirm the tssc container is running
podman ps | grep cli:1.9.0
# After deploy, verify component health
oc get pods -n tssc
oc get routes -n tssc-dh
oc get routes -n tssc-acs
oc get routes -n tssc-gitops
Workflow
- Confirm the active OpenShift baseline in
docs/PLATFORM_BASELINE.md.
- Read
references/official-doc-extraction.md.
- Identify whether the task concerns prerequisites, config creation,
integration, deployment, credentials, or upgrade.
- For GitOps manifests, verify all API versions and fields before committing.
- For live operations, use the repo environment guard.
Related Skills
- Use future
rhads-cicd-* for CI/CD pipeline authoring and integration.
- Use future
rhads-customize for post-install component customization.
- Use future
rhads-compliance for Conforma policy configuration.
- Use
ocp-pipelines-install-config for standalone OpenShift Pipelines
installation outside RHADS-SSC.
- Use
rhdh-install-ocp for standalone RHDH installation outside RHADS-SSC.
References
references/source-capture.mdreferences/official-doc-extraction.md
