Scott Rosenberg vrabbi

Step 1 - create the secret

kubectl apply -f PRISMA_OVERLAY_FIX.yaml

Step 2 - Add the following annotation to the package install resource in the prisma doc in gitlab

annotations:
  ext.packaging.carvel.dev/ytt-paths-from-secret-name.0: grype-prisma-sec-context-overlay

Tanzu Application Platform AzureAD authentication

ref: https://docs.vmware.com/en/VMware-Tanzu-Application-Platform/1.4/tap/tap-gui-auth.html

1. AzureAD Authentication Provider

In order to allow GUI authentication to Tanzu Application Platform via AzureAD, we will implement AzureAD Authentication Provider for Backstage.

ref: https://backstage.io/docs/auth/microsoft/provider

Tanzu Application Platform GitHub authentication & integration

ref: https://docs.vmware.com/en/VMware-Tanzu-Application-Platform/1.4/tap/tap-gui-auth.html

Tanzu Application Platform GitHub authentication & integration
- 1. GitHub Authentication Provider
  - 1.1. Create an OAuth App on GitHub
  - 1.2. Configuration
2. Add a GitHub provider integration

Update the overlay

You need to update values for http_proxy, https_proxy and no_proxy at the top of the overlay file to fix the environment specific values.

Update the package install

kctrl package installed update -n tap-install -i prisma -p scanning.apps.tanzu.vmware.com --version 0.1.4-alpha.12 --ytt-overlay-file prisma-overlay.yaml

Create ns

kubectl create ns tap-install

Add Package repository

tanzu package repository add tanzu-tap-repository \
  --url ${INSTALL_REGISTRY_HOSTNAME}/tap/tap-packages:1.4.0 \
  --namespace tap-install

Deploy External DNS

Microsoft DNS

Secure Updates Using RFC3645 (GSS-TSIG)

Prerequisites:

Create a DNS zone
Enable secure dynamic updates for the zone

TAP Production Supply Chain Diagram

flowchart TD
subgraph "Legend"
    red("Custom - Not officially supported")
    style red fill:red,color:black
    blue{A Choice}
    style blue fill:blue,color:white
    black(Supported - Not Default)

	apiVersion: v1
	stringData:
	password:
	username: tap
	kind: Secret
	metadata:
	annotations:
	tekton.dev/git-0: https://REPLACE_ME
	name: git-creds
	namespace: tap-install

	apiVersion: v1
	kind: Secret
	metadata:
	name: git-private-ca-overlay
	namespace: tap-install
	type: Opaque
	stringData:
	git-private-ca-overlay.yaml: \|
	#@ load("@ytt:data", "data")
	#@ load("@ytt:overlay","overlay")

	apiVersion: tekton.dev/v1beta1
	kind: ClusterTask
	metadata:
	name: git-writer
	spec:
	description: \|-
	A task that writes a given set of files (provided as a json base64-encoded)
	to git repository under a specified directory.
	params:
	- description: The repository path