| name | tpa-admin |
| metadata | {"author":"rhoai3-coding-demo","version":"1.0.0","platform-family":"tpa","platform-baseline":"repo","ocp-baseline":"repo","skill-group":"Trusted Software Supply Chain"} |
| description | Use when administering Red Hat Trusted Profile Analyzer 2.2, including service configuration, user management, data management, API usage, and operational tasks. Do NOT use for deployment (use tpa-deployment), quick start (use tpa-quick-start), or release notes (use tpa-release-notes).
|
TPA Administration
Use this skill to ground Red Hat Trusted Profile Analyzer (RHTPA) 2.2
administration guidance in the official Administration Guide. RHTPA is part
of the Red Hat Trusted Software Supply Chain suite and provides centralized
SBOM management, vulnerability analysis, and advisory tracking.
Source Grounding
Read references/source-capture.md before using product behavior. Official
Red Hat documentation is product authority.
Key Administration Areas
Data Importers
RHTPA ships with five importer sources: Red Hat CSAFs, Red Hat SBOMs, CVE
list v5, GitHub advisory database, and Quay. By default Red Hat CSAF, Red Hat
SBOM, and Quay importers are disabled. Each enabled importer runs on a 24-hour
schedule. Default resource request: 1 CPU / 8 GB RAM per importer and API
server deployment; no resource limits by default.
SBOM Lifecycle
- Create: generate CycloneDX (1.3-1.6) or SPDX (2.2-2.3) SBOMs using
Syft from container images or local filesystems
- Scan: upload SBOMs via the RHTPA console for vulnerability analysis;
supports standard SBOM, AIBOM (language models), and CBOM (cryptographic
materials); Red Hat does not retain uploaded SBOMs
- Search: find SBOM documents, packages, CVEs, advisories, and license
expressions; filter by date range, SBOM format, and license
- Labels: add or remove custom labels on SBOMs and advisories for
organization
- Delete: remove SBOM documents and advisories via the console
- License export: download CSV license information from SPDX-formatted
SBOMs
OIDC / Microsoft Entra ID Integration
RHTPA supports Microsoft Entra ID as an OpenID Connect provider. The
integration requires:
- An API application registration with scopes:
create:document,
read:document, update:document, delete:document
- Application roles:
App.Read.Document, App.Create.Document,
App.Update.Document, App.Delete.Document
- A frontend SPA application registration with delegated permissions
- Token version set to
accessTokenAcceptedVersion: 2
auth.yaml ConfigMap with scopeMappings for both frontend and CLI clients- Helm values in
values-rhtpa.yaml under the oidc section with
loadUser: false
Prerequisites: OCP 4.16+, Microsoft Azure account with app registration
permissions, Entra ID tenant.
Helm Upgrade for Configuration Changes
Post-deployment configuration changes require a Helm upgrade:
helm upgrade --install redhat-trusted-profile-analyzer \
openshift-helm-charts/redhat-trusted-profile-analyzer \
-n $NAMESPACE \
--values values-rhtpa.yaml \
--values values-importers.yaml \
--set-string appDomain=$APP_DOMAIN_URL
Supported Formats
| Format | Versions |
|---|
| CycloneDX | 1.3, 1.4, 1.5, 1.6 |
| SPDX | 2.2, 2.3 |
Syft binary is Technology Preview only.
Workflow
- Confirm the target RHTPA version (2.2) and deployment platform (RHEL or
OCP).
- Read
references/official-doc-extraction.md for admin procedures.
- Identify the task: importer management, SBOM operations, OIDC
configuration, or Helm upgrade.
- Follow the documented procedure; verify prerequisites.
- For OIDC integration, collect Tenant ID, API Client ID, Frontend Client
ID, Client Secret, and Scopes before starting.
- Validate with
references/source-capture.md boundaries.
Related Skills
- Use
tpa-deployment for installing and deploying RHTPA on RHEL or OCP.
- Use
tpa-quick-start for getting started with RHTPA quickly.
- Use
tpa-release-notes for version-specific changes and known issues.
- Use
ocp-pipelines-cicd for integrating SBOM generation into CI/CD
pipelines.
References
references/source-capture.mdreferences/official-doc-extraction.md
