Chapter 8. Customizing Red Hat Quay on OpenShift Container Platform
Chapter 8. Customizing Red Hat Quay on OpenShift Container Platform After deployment, you can customize the Red Hat Quay application by editing the Red Hat Quay configuration bundle secret spec.configBundleSecret . You can also change the managed status of components in the spec.components object of the QuayRegistry resource. 8.1. Editing the config bundle secret in the OpenShift Container Platform console Use the following procedure to edit the config bundle secret in the OpenShift Container Platform console. Procedure On the Red Hat Quay Registry overview screen, click the link for the Config Bundle Secret . To edit the secret, click Actions Edit Secret . Modify the configuration and save the changes. Monitor the deployment to ensure successful completion and that the configuration changes have taken effect. 8.2. Determining QuayRegistry endpoints and secrets Use the following procedure to find QuayRegistry endpoints and secrets. Procedure You can examine the QuayRegistry resource, using oc describe quayregistry or oc get quayregistry -o yaml , to find the current endpoints and secrets by entering the following command: USD oc get quayregistry example-registry -n quay-enterprise -o yaml Example output apiVersion: quay.redhat.com/v1 kind: QuayRegistry metadata: ... name: example-registry namespace: quay-enterprise ... spec: components: - kind: quay managed: true ... - kind: clairpostgres managed: true configBundleSecret: init-config-bundle-secret 1 status: currentVersion: 3.7.0 lastUpdated: 2022-05-11 13:28:38.199476938 +0000 UTC registryEndpoint: https://example-registry-quay-quay-enterprise.apps.docs.gcp.quaydev.org 2 1 The config bundle secret, containing the config.yaml file and any SSL/TLS certificates. 2 The URL for your registry, for browser access to the registry UI, and for the registry API endpoint. 8.3. Downloading the existing configuration The following procedures detail how to download the existing configuration using different strategies. 8.3.1. Using the config bundle secret to download the existing configuration You can use the config bundle secret to download the existing configuration. Procedure Obtain the secret data by entering the following command: USD oc get secret -n quay-enterprise init-config-bundle-secret -o jsonpath='{.data}' Example output { "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo=" } Enter the following command to decode the data: USD echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode Example output FEATURE_USER_INITIALIZE: true BROWSER_API_CALLS_XHR_ONLY: false SUPER_USERS: - quayadmin FEATURE_USER_CREATION: false FEATURE_QUOTA_MANAGEMENT: true FEATURE_PROXY_CACHE: true FEATURE_BUILD_SUPPORT: true DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000 8.4. Using the config bundle to configure custom SSL/TLS certs You can configure custom SSL/TLS certificates before the initial deployment, or after Red Hat Quay is deployed on OpenShift Container Platform. This is done by creating or updating the config bundle secret. If you are adding the certificates to an existing deployment, you must include the existing config.yaml file in the new config bundle secret, even if you are not making any configuration changes. Use the following procedure to add custom SSL/TLS certificates. Procedure In your QuayRegistry YAML file, set kind: tls to managed:false , for example: - kind: tls managed: false Navigate to the Events page, which should reveal that the change is blocked until you set up the appropriate config. For example: - lastTransitionTime: '2022-03-28T12:56:49Z' lastUpdateTime: '2022-03-28T12:56:49Z' message: >- required component `tls` marked as unmanaged, but `configBundleSecret` is missing necessary fields reason: ConfigInvalid status: 'True' Create the secret using embedded data or by using files. Embed the configuration details directly in the Secret resource YAML file. For example: custom-ssl-config-bundle.yaml apiVersion: v1 kind: Secret metadata: name: custom-ssl-config-bundle-secret namespace: quay-enterprise data: config.yaml: | FEATURE_USER_INITIALIZE: true BROWSER_API_CALLS_XHR_ONLY: false SUPER_USERS: - quayadmin FEATURE_USER_CREATION: false FEATURE_QUOTA_MANAGEMENT: true FEATURE_PROXY_CACHE: true FEATURE_BUILD_SUPPORT: true DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000 extra_ca_cert_my-custom-ssl.crt: | -----BEGIN CERTIFICATE----- MIIDsDCCApigAwIBAgIUCqlzkHjF5i5TXLFy+sepFrZr/UswDQYJKoZIhvcNAQEL BQAwbzELMAkGA1UEBhMCSUUxDzANBgNVBAgMBkdBTFdBWTEPMA0GA1UEBwwGR0FM .... -----END CERTIFICATE----- Create the secret from the YAML file: .. Alternatively, you can create files containing the desired information, and then create the secret from those files. Enter the following command to create a generic Secret object that contains the config.yaml file and a custom-ssl.crt file: Create or update the QuayRegistry YAML file, referencing the created Secret , for example: Example QuayRegistry YAML file apiVersion: quay.redhat.com/v1 kind: QuayRegistry metadata: name: example-registry namespace: quay-enterprise spec: configBundleSecret: custom-ssl-config-bundle-secret Deploy or update the registry using the YAML file by entering the following command:
oc get quayregistry example-registry -n quay-enterprise -o yaml apiVersion: quay.redhat.com/v1 kind: QuayRegistry metadata: name: example-registry namespace: quay-enterprise spec: components: - kind: quay managed: true - kind: clairpostgres managed: true configBundleSecret: init-config-bundle-secret 1 status: currentVersion: 3.7.0 lastUpdated: 2022-05-11 13:28:38.199476938 +0000 UTC registryEndpoint: https://example-registry-quay-quay-enterprise.apps.docs.gcp.quaydev.org 2 oc get secret -n quay-enterprise init-config-bundle-secret -o jsonpath='{.data}' { "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo=" } echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode FEATURE_USER_INITIALIZE: true BROWSER_API_CALLS_XHR_ONLY: false SUPER_USERS: - quayadmin FEATURE_USER_CREATION: false FEATURE_QUOTA_MANAGEMENT: true FEATURE_PROXY_CACHE: true FEATURE_BUILD_SUPPORT: true DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000 - kind: tls managed: false - lastTransitionTime: '2022-03-28T12:56:49Z' lastUpdateTime: '2022-03-28T12:56:49Z' message: >- required component `tls` marked as unmanaged, but `configBundleSecret` is missing necessary fields reason: ConfigInvalid status: 'True' apiVersion: v1 kind: Secret metadata: name: custom-ssl-config-bundle-secret namespace: quay-enterprise data: config.yaml: | FEATURE_USER_INITIALIZE: true BROWSER_API_CALLS_XHR_ONLY: false SUPER_USERS: - quayadmin FEATURE_USER_CREATION: false FEATURE_QUOTA_MANAGEMENT: true FEATURE_PROXY_CACHE: true FEATURE_BUILD_SUPPORT: true DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000 extra_ca_cert_my-custom-ssl.crt: | -----BEGIN CERTIFICATE----- MIIDsDCCApigAwIBAgIUCqlzkHjF5i5TXLFy+sepFrZr/UswDQYJKoZIhvcNAQEL BQAwbzELMAkGA1UEBhMCSUUxDzANBgNVBAgMBkdBTFdBWTEPMA0GA1UEBwwGR0FM . -----END CERTIFICATE----- oc create -f custom-ssl-config-bundle.yaml oc create secret generic custom-ssl-config-bundle-secret --from-file=config.yaml --from-file=extra_ca_cert_my-custom-ssl.crt=my-custom-ssl.crt apiVersion: quay.redhat.com/v1 kind: QuayRegistry metadata: name: example-registry namespace: quay-enterprise spec: configBundleSecret: custom-ssl-config-bundle-secret apply -f quayregistry.yaml