Chapter 4. Configuring Red Hat Quay

Procedure

1. On the first Red Hat Quay node, for example quay01, create a directory for the configuration bundle:

   # mkdir -p /mnt/quay/config

2. Create a config.yaml file in that directory. The following example shows the minimum fields for a high availability deployment that uses the PostgreSQL database, Redis, and Ceph Object Gateway resources from earlier procedures:

   AUTHENTICATION_TYPE: Database
   PREFERRED_URL_SCHEME: https
   SERVER_HOSTNAME: quay.example.com 

   1

   
   SECRET_KEY: <secret_key_value>
   DATABASE_SECRET_KEY: <database_secret_key_value>
   SETUP_COMPLETE: true
   DB_URI: postgresql://quayuser:quaypass@db01:5432/quaydb 

   2

   
   BUILDLOGS_REDIS:
     host: db01 

   3

   
     port: 6379
   USER_EVENTS_REDIS:
     host: db01 

   4

   
     port: 6379
   DISTRIBUTED_STORAGE_CONFIG:
     radosGWStorage:
       - RadosGWStorage
       - access_key: <access_key>
         bucket_name: <bucket_name>
         hostname: db01 

   5

   
         is_secure: false
         port: '7480'
         secret_key: <secret_key>
         storage_path: /datastorage/registry
   DISTRIBUTED_STORAGE_PREFERENCE:
     - radosGWStorage
   DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
   SUPER_USERS:
     - quayadmin 

   6

   1

   Use the hostname or IP address that clients use to reach the Red Hat Quay service, typically the load balancer front end.

   2

   Match the database user, password, host, and database name from Setting up the HAProxy load balancer and the PostgreSQL database.

   3 4

   Use the load balancer hostname that exposes Redis on port 6379.

   5

   Use the load balancer hostname that exposes the Ceph RADOS gateway on port 7480. For additional RadosGW fields, see Ceph Object Gateway (RadosGW) storage example.

   6

   Optional. Adds an initial superuser account. You can also add superusers after deployment by editing config.yaml.

3. Configure additional registry settings as needed. The following fields are commonly updated for production high availability deployments:

   • TLS certificates: Place ssl.cert and ssl.key in /mnt/quay/config and set PREFERRED_URL_SCHEME: https. See Using SSL to protect connections to Red Hat Quay.

     Important

     Using SSL certificates is recommended for production deployments. If you do not use SSL, configure your container clients to treat the registry as an insecure registry, as described in Test an Insecure Registry.

   • Clair image scanning: Configure security scanner settings before enabling Clair. See Clair Security Scanning.
   • Repository mirroring: Set FEATURE_REPO_MIRROR: true and related fields in config.yaml. See Enabling repository mirroring for Red Hat Quay.
   • Action log storage, authentication, and access control: See Configure Red Hat Quay for the complete list of supported configuration fields.
4. Copy the configuration directory, including config.yaml and any TLS certificate files, to each Red Hat Quay node in the cluster, for example quay02 and quay03.