Deploying the Red Hat Quay Operator on OpenShift Container Platform

Procedure

1. Create a NooBaa Object Bucket Claim in the console at Storage → Object Bucket Claims.
2. Retrieve the Object Bucket Claim Data details including the Access Key, Bucket Name, Endpoint (hostname), and Secret Key.

3. Create a config.yaml configuration file using the information for the Object Bucket Claim. For example:

   Copy to Clipboard Toggle word wrap

   DISTRIBUTED_STORAGE_CONFIG:
     default:
       - RHOCSStorage
       - access_key: WmrXtSGk8B3nABCDEFGH
         bucket_name: my-noobaa-bucket-claim-8b844191-dc6c-444e-9ea4-87ece0abcdef
         hostname: s3.openshift-storage.svc.cluster.local
         is_secure: true
         port: "443"
         secret_key: X9P5SDGJtmSuHFCMSLMbdNCMfUABCDEFGH+C5QD
         storage_path: /datastorage/registry
   DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
   DISTRIBUTED_STORAGE_PREFERENCE:
     - default

Procedure

1. Create a config.yaml file using the following Redis fields:

   Copy to Clipboard Toggle word wrap

   # ...
   BUILDLOGS_REDIS:
       host: <quay-server.example.com>
       port: 6379
       ssl: false
   # ...
   USER_EVENTS_REDIS:
       host: <quay-server.example.com>
       port: 6379
       ssl: false
   # ...

2. Enter the following command to create a secret using the configuration file:

   Copy to Clipboard Toggle word wrap

   $ oc create secret generic --from-file config.yaml=./config.yaml config-bundle-secret

3. Create a quayregistry.yaml file that sets the Redis component to unmanaged and references the created secret:

   Copy to Clipboard Toggle word wrap

   apiVersion: quay.redhat.com/v1
   kind: QuayRegistry
   metadata:
     name: example-registry
     namespace: quay-enterprise
   spec:
     configBundleSecret: config-bundle-secret
     components:
       - kind: redis
         managed: false
   # ...

4. Deploy the Red Hat Quay registry.

Procedure

1. Set the component as managed: false in the quayregistry.yaml file:

   Copy to Clipboard Toggle word wrap

   apiVersion: quay.redhat.com/v1
   kind: QuayRegistry
   metadata:
     name: example-registry
     namespace: quay-enterprise
   spec:
     components:
       - kind: route
         managed: false

2. Edit the config.yaml file to specify that Red Hat Quay handles SSL/TLS. For example:

   Copy to Clipboard Toggle word wrap

   # ...
   EXTERNAL_TLS_TERMINATION: false
   # ...
   SERVER_HOSTNAME: example-registry-quay-quay-enterprise.apps.user1.example.com
   # ...
   PREFERRED_URL_SCHEME: https
   # ...

   If you do not configure the unmanaged route correctly, the following error is returned:

   Copy to Clipboard Toggle word wrap

   {
     {
       "kind":"QuayRegistry",
       "namespace":"quay-enterprise",
       "name":"example-registry",
       "uid":"d5879ba5-cc92-406c-ba62-8b19cf56d4aa",
       "apiVersion":"quay.redhat.com/v1",
       "resourceVersion":"2418527"
     },
     "reason":"ConfigInvalid",
     "message":"required component `route` marked as unmanaged, but `configBundleSecret` is missing necessary fields"
   }

1. Open your Red Hat Quay configuration file and update the following configuration fields:

   Copy to Clipboard Toggle word wrap

   FEATURE_USER_INITIALIZE: true
   SUPER_USERS:
        -  quayadmin

2. Stop the Red Hat Quay service by entering the following command:

   Copy to Clipboard Toggle word wrap

   $ sudo podman stop quay

3. Start the Red Hat Quay service by entering the following command:

   Copy to Clipboard Toggle word wrap

   $ sudo podman run -d -p 80:8080 -p 443:8443 --name=quay -v $QUAY/config:/conf/stack:Z  -v $QUAY/storage:/datastorage:Z {productrepo}/{quayimage}:{productminv}

4. Run the following CURL command to generate a new user with a username, password, email, and access token:

   Copy to Clipboard Toggle word wrap

   $ curl -X POST -k  http://quay-server.example.com/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"quaypass12345", "email": "quayadmin@example.com", "access_token": true}'

   If successful, the command returns an object with the username, email, and encrypted password. For example:

   Copy to Clipboard Toggle word wrap

   {"access_token":"6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED", "email":"quayadmin@example.com","encrypted_password":"1nZMLH57RIE5UGdL/yYpDOHLqiNCgimb6W9kfF8MjZ1xrfDpRyRs9NUnUuNuAitW","username":"quayadmin"} # gitleaks:allow

   If a user already exists in the database, an error is returned:

   Copy to Clipboard Toggle word wrap

   {"message":"Cannot initialize user in a non-empty database"}

   If your password is not at least eight characters or contains whitespace, an error is returned:

   Copy to Clipboard Toggle word wrap

   {"message":"Failed to initialize user: Invalid password, password must be at least 8 characters and contain no whitespace."}

5. Log in to your Red Hat Quay deployment by entering the following command:

   Copy to Clipboard Toggle word wrap

   $ sudo podman login -u quayadmin -p quaypass12345 http://quay-server.example.com --tls-verify=false

   Example output

   Copy to Clipboard Toggle word wrap

   Login Succeeded!

Procedure

1. Enter the following command to view the deployed components:

   Copy to Clipboard Toggle word wrap

   $ oc get pods -n quay-enterprise

   Example output

   Copy to Clipboard Toggle word wrap

   NAME                                                   READY   STATUS      RESTARTS   AGE
   example-registry-clair-app-5ffc9f77d6-jwr9s            1/1     Running     0          3m42s
   example-registry-clair-app-5ffc9f77d6-wgp7d            1/1     Running     0          3m41s
   example-registry-clair-postgres-54956d6d9c-rgs8l       1/1     Running     0          3m5s
   example-registry-quay-app-79c6b86c7b-8qnr2             1/1     Running     4          3m42s
   example-registry-quay-app-79c6b86c7b-xk85f             1/1     Running     4          3m41s
   example-registry-quay-app-upgrade-5kl5r                0/1     Completed   4          3m50s
   example-registry-quay-database-b466fc4d7-tfrnx         1/1     Running     2          3m42s
   example-registry-quay-mirror-6d9bd78756-6lj6p          1/1     Running     0          2m58s
   example-registry-quay-mirror-6d9bd78756-bv6gq          1/1     Running     0          2m58s
   example-registry-quay-postgres-init-dzbmx              0/1     Completed   0          3m43s
   example-registry-quay-redis-8bd67b647-skgqx            1/1     Running     0          3m42s

Procedure

1. Enter the following command to check the status of your deployment:

   Copy to Clipboard Toggle word wrap

   $ oc get quayregistry -n quay-enterprise -o yaml

   Example output

   Immediately after deployment, the QuayRegistry object will show the basic configuration:

   Copy to Clipboard Toggle word wrap

   apiVersion: v1
   items:
   - apiVersion: quay.redhat.com/v1
     kind: QuayRegistry
     metadata:
       creationTimestamp: "2021-09-14T10:51:22Z"
       generation: 3
       name: example-registry
       namespace: quay-enterprise
       resourceVersion: "50147"
       selfLink: /apis/quay.redhat.com/v1/namespaces/quay-enterprise/quayregistries/example-registry
       uid: e3fc82ba-e716-4646-bb0f-63c26d05e00e
     spec:
       components:
       - kind: postgres
         managed: true
       - kind: clair
         managed: true
       - kind: redis
         managed: true
       - kind: horizontalpodautoscaler
         managed: true
       - kind: objectstorage
         managed: true
       - kind: route
         managed: true
       - kind: mirror
         managed: true
       - kind: monitoring
         managed: true
       - kind: tls
         managed: true
       configBundleSecret: example-registry-config-bundle-kt55s
   kind: List
   metadata:
     resourceVersion: ""
     selfLink: ""

2. Use the oc get pods command to view the current state of the deployed components:

   Copy to Clipboard Toggle word wrap

   $ oc get pods -n quay-enterprise

   Example output

   Copy to Clipboard Toggle word wrap

   NAME                                                   READY   STATUS              RESTARTS   AGE
   example-registry-clair-app-86554c6b49-ds7bl            0/1     ContainerCreating   0          2s
   example-registry-clair-app-86554c6b49-hxp5s            0/1     Running             1          17s
   example-registry-clair-postgres-68d8857899-lbc5n       0/1     ContainerCreating   0          17s
   example-registry-quay-app-upgrade-h2v7h                0/1     ContainerCreating   0          9s
   example-registry-quay-database-66f495c9bc-wqsjf        0/1     ContainerCreating   0          17s
   example-registry-quay-mirror-854c88457b-d845g          0/1     Init:0/1            0          2s
   example-registry-quay-mirror-854c88457b-fghxv          0/1     Init:0/1            0          17s
   example-registry-quay-postgres-init-bktdt              0/1     Terminating         0          17s
   example-registry-quay-redis-f9b9d44bf-4htpz            0/1     ContainerCreating   0          17s

3. While the deployment is in progress, the QuayRegistry object will show the current status. In this instance, database migrations are taking place, and other components are waiting until completion:

   Copy to Clipboard Toggle word wrap

     status:
       conditions:
       - lastTransitionTime: "2021-09-14T10:52:04Z"
         lastUpdateTime: "2021-09-14T10:52:04Z"
         message: all objects created/updated successfully
         reason: ComponentsCreationSuccess
         status: "False"
         type: RolloutBlocked
       - lastTransitionTime: "2021-09-14T10:52:05Z"
         lastUpdateTime: "2021-09-14T10:52:05Z"
         message: running database migrations
         reason: MigrationsInProgress
         status: "False"
         type: Available
       lastUpdated: 2021-09-14 10:52:05.371425635 +0000 UTC
       unhealthyComponents:
         clair:
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-clair-postgres: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-clair-app: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available
         mirror:
         - lastTransitionTime: "2021-09-14T10:51:32Z"
           lastUpdateTime: "2021-09-14T10:51:32Z"
           message: 'Deployment example-registry-quay-mirror: Deployment does not have minimum availability.'
           reason: MinimumReplicasUnavailable
           status: "False"
           type: Available

4. When the deployment process finishes successfully, the status in the QuayRegistry object shows no unhealthy components:

   Copy to Clipboard Toggle word wrap

     status:
       conditions:
       - lastTransitionTime: "2021-09-14T10:52:36Z"
         lastUpdateTime: "2021-09-14T10:52:36Z"
         message: all registry component healthchecks passing
         reason: HealthChecksPassing
         status: "True"
         type: Available
       - lastTransitionTime: "2021-09-14T10:52:46Z"
         lastUpdateTime: "2021-09-14T10:52:46Z"
         message: all objects created/updated successfully
         reason: ComponentsCreationSuccess
         status: "False"
         type: RolloutBlocked
       currentVersion: {producty}
       lastUpdated: 2021-09-14 10:52:46.104181633 +0000 UTC
       registryEndpoint: https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org
       unhealthyComponents: {}

Procedure

1. In the OpenShift Container Platform console, navigate to Operators → Installed Operators, with the appropriate namespace / project.

2. Click on the newly installed QuayRegistry object to view the details. For example:

   

3. After the Registry Endpoint has a value, navigate to this URL in your browser.

4. Select Create Account in the Red Hat Quay registry UI to create a user. For example:

   

5. Enter the details for Username, Password, Email, and then click Create Account. For example:

   

Procedure

1. Obtain the secret data by entering the following command:

   Copy to Clipboard Toggle word wrap

   $ oc get secret -n quay-enterprise init-config-bundle-secret -o jsonpath='{.data}'

   Example output

   Copy to Clipboard Toggle word wrap

   {
       "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo="
   }

2. Enter the following command to decode the data:

   Copy to Clipboard Toggle word wrap

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode

   Example output

   Copy to Clipboard Toggle word wrap

   FEATURE_USER_INITIALIZE: true
   BROWSER_API_CALLS_XHR_ONLY: false
   SUPER_USERS:
   - quayadmin
   FEATURE_USER_CREATION: false
   FEATURE_QUOTA_MANAGEMENT: true
   FEATURE_PROXY_CACHE: true
   FEATURE_BUILD_SUPPORT: true
   DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000