Proof of Concept - Deploying Red Hat Quay

Procedure

1. Install the latest RHEL 9 server. You can do a minimal, shell-access only install, or Server plus GUI if you want a desktop.
2. Register and subscribe your RHEL server system as described in How to register and subscribe a RHEL system to the Red Hat Customer Portal using Red Hat Subscription-Manager

3. Enter the following commands to register your system and list available subscriptions. Choose an available RHEL server subscription, attach to its pool ID, and upgrade to the latest software:

   # subscription-manager register --username=<user_name> --password=<password>
   # subscription-manager refresh
   # subscription-manager list --available
   # subscription-manager attach --pool=<pool_id>
   # yum update -y

Procedure

1. Set up authentication to registry.redhat.io by following the Red Hat Container Registry Authentication procedure. Setting up authentication allows you to pull the Quay container.

   Note

   This differs from earlier versions of Red Hat Quay, when the images were hosted on Quay.io.

2. Enter the following command to log in to the registry:

   $ sudo podman login registry.redhat.io

   You are prompted to enter your username and password.

Procedure

1. Enter the following command to obtain your static IP address for your host system:

   $ ip a

   Example output

   ---
       link/ether 6c:6a:77:eb:09:f1 brd ff:ff:ff:ff:ff:ff
       inet 192.168.1.132/24 brd 192.168.1.255 scope global dynamic noprefixroute wlp82s0
   ---

2. Add the IP address and a local hostname, for example, quay-server.example.com to your /etc/hosts file that will be used to reach the Red Hat Quay endpoint. You can confirm that the IP address and hostname have been added to the /etc/hosts file by entering the following command:

   $ cat /etc/hosts

   Example output

   192.168.1.138 quay-server.example.com

Procedure

1. In the installation folder, denoted here by the $QUAY variable, create a directory for the database data by entering the following command:

   $ mkdir -p $QUAY/postgres-quay

2. Set the appropriate permissions by entering the following command:

   $ setfacl -m u:26:-wx $QUAY/postgres-quay

3. Start the Postgres container, specifying the username, password, and database name and port, with the volume definition for database data:

   $ sudo podman run -d --rm --name postgresql-quay \
     -e POSTGRESQL_USER=quayuser \
     -e POSTGRESQL_PASSWORD=quaypass \
     -e POSTGRESQL_DATABASE=quay \
     -e POSTGRESQL_ADMIN_PASSWORD=adminpass \
     -p 5432:5432 \
     -v $QUAY/postgres-quay:/var/lib/pgsql/data:Z \
     registry.redhat.io/rhel8/postgresql-13:1-109

4. Ensure that the Postgres pg_trgm module is installed by running the following command:

   $ sudo podman exec -it postgresql-quay /bin/bash -c 'echo "CREATE EXTENSION IF NOT EXISTS pg_trgm" | psql -d quay -U postgres'

   Note

   The pg_trgm module is required for the Quay container.

Procedure

1. Enter the following command to create a minimal config.yaml file that is used to deploy the Red Hat Quay container:

   $ touch config.yaml

2. Copy and paste the following YAML configuration into the config.yaml file:

   BUILDLOGS_REDIS:
       host: quay-server.example.com
       password: strongpassword
       port: 6379
   CREATE_NAMESPACE_ON_PUSH: true
   DATABASE_SECRET_KEY: a8c2744b-7004-4af2-bcee-e417e7bdd235
   DB_URI: postgresql://quayuser:quaypass@quay-server.example.com:5432/quay
   DISTRIBUTED_STORAGE_CONFIG:
       default:
           - LocalStorage
           - storage_path: /datastorage/registry
   DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
   DISTRIBUTED_STORAGE_PREFERENCE:
       - default
   FEATURE_MAILING: false
   SECRET_KEY: e9bd34f4-900c-436a-979e-7530e5d74ac8
   SERVER_HOSTNAME: quay-server.example.com
   SETUP_COMPLETE: true
   USER_EVENTS_REDIS:
       host: quay-server.example.com
       password: strongpassword
       port: 6379

3. Create a directory to copy the Red Hat Quay configuration bundle to:

   $ mkdir $QUAY/config

4. Copy the Red Hat Quay configuration file to the directory:

   $ cp -v config.yaml $QUAY/config

Procedure

1. Create a local directory that will store registry images by entering the following command:

   $ mkdir $QUAY/storage

2. Set the directory to store registry images:

   $ setfacl -m u:1001:-wx $QUAY/storage

Procedure

1. Enter the following command to start the Quay registry container, specifying the appropriate volumes for configuration data and local storage for image data:

   $ sudo podman run -d --rm -p 80:8080 -p 443:8443  \
      --name=quay \
      -v $QUAY/config:/conf/stack:Z \
      -v $QUAY/storage:/datastorage:Z \
      registry.redhat.io/quay/quay-rhel8:v3.12.8

Procedure

1. To test pushing and pulling images from the Red Hat Quay registry, first pull a sample image from an external registry:

   $ sudo podman pull busybox

   Example output

   Trying to pull docker.io/library/busybox...
   Getting image source signatures
   Copying blob 4c892f00285e done
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures
   22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9

2. Enter the following command to see the local copy of the image:

   $ sudo podman images

   Example output

   REPOSITORY                          TAG      IMAGE ID       CREATED         SIZE
   docker.io/library/busybox           latest   22667f53682a   14 hours ago    1.45 MB

3. Enter the following command to tag this image, which prepares the image for pushing it to the registry:

   $ sudo podman tag docker.io/library/busybox quay-server.example.com/quayadmin/busybox:test

4. Push the image to your registry. Following this step, you can use your browser to see the tagged image in your repository.

   $ sudo podman push --tls-verify=false quay-server.example.com/quayadmin/busybox:test

   Example output

   Getting image source signatures
   Copying blob 6b245f040973 done
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures

5. To test access to the image from the command line, first delete the local copy of the image:

   $ sudo podman rmi quay-server.example.com/quayadmin/busybox:test

   Example output

   Untagged: quay-server.example.com/quayadmin/busybox:test

6. Pull the image again, this time from your Red Hat Quay registry:

   $ sudo podman pull --tls-verify=false quay-server.example.com/quayadmin/busybox:test

   Example output

   Trying to pull quay-server.example.com/quayadmin/busybox:test...
   Getting image source signatures
   Copying blob 6ef22a7134ba [--------------------------------------] 0.0b / 0.0b
   Copying config 22667f5368 done
   Writing manifest to image destination
   Storing signatures
   22667f53682a2920948d19c7133ab1c9c3f745805c14125859d20cede07f11f9

Procedure

1. Access the Superuser Admin Panel on the Red Hat Quay UI by clicking on the current user’s name or avatar in the navigation pane of the UI. Then, click Superuser Admin Panel.

   

   On this page, you can manage users, your organization, service keys, view change logs, view usage logs, and create global messages for your organization.

Procedure

1. Copy the root CA file to one of /etc/containers/certs.d/ or /etc/docker/certs.d/. Use the exact path determined by the server hostname, and name the file ca.crt:

   $ sudo cp rootCA.pem /etc/containers/certs.d/quay-server.example.com/ca.crt

2. Verify that you no longer need to use the --tls-verify=false option when logging in to your Red Hat Quay registry:

   $ sudo podman login quay-server.example.com

   Example output

   Login Succeeded!

Procedure

1. Enter the following command to copy the rootCA.pem file to the consolidated system-wide trust store:

   $ sudo cp rootCA.pem /etc/pki/ca-trust/source/anchors/

2. Enter the following command to update the system-wide trust store configuration:

   $ sudo update-ca-trust extract

3. Optional. You can use the trust list command to ensure that the Quay server has been configured:

   $ trust list | grep quay
       label: quay-server.example.com

   Now, when you browse to the registry at https://quay-server.example.com, the lock icon shows that the connection is secure:

   

4. To remove the rootCA.pem file from system-wide trust, delete the file and update the configuration:

   $ sudo rm /etc/pki/ca-trust/source/anchors/rootCA.pem

   $ sudo update-ca-trust extract

   $ trust list | grep quay