Chapter 1. Red Hat Quay release notes

With this release, NetApp ONTAP S3 object storage is now supported. For more information, see NetApp ONTAP S3 object storage.

When using NetApp ONTAP S3 object storage, images with large layer sizes fail to push. This is a known issue and will be fixed in a future version of Red Hat Quay. (PROJQUAY-7462).

For information about upgrading standalone Red Hat Quay deployments, see Standalone upgrade.

For information about upgrading Red Hat Quay on OpenShift Container Platform, see Upgrading the Red Hat Quay Operator.

With this update, Red Hat Quay administrators can configure their deployment to forward action logs directly to a Splunk HTTP Event Collector (HEC). This enhancement enables seamless integration with Splunk for comprehensive log management and analysis.

For more information, see Configuring action log storage for Splunk.

Previously, when a Red Hat Quay organization owner created an API OAuth token, and that API OAuth token was used by another organization member, the action was logged to the creator of the token. This was undesirable for auditing purpose, notably in restricted environments where only dedicated registry administrators are organization owners.

With this release, organization administrators can now assign OAuth API tokens to be created by other users with specific permissions. This allows the audit logs to be reflected accurately when the token is used by a user that has no organization administrative permissions to create an OAuth API token.

For more information, see Reassigning an OAuth access token.

Previously, Red Hat Quay administrators and users had no way of being alerted when an image was about to expire. With this update, an event can be configured to notify users when an image is about to expire. This helps Red Hat Quay users avoid unexpected pull failures.

Image expiration event triggers can be configured to notify users through email, Slack, webhooks, and so on, and can be configured at the repository level. Triggers can be set for images expiring in any amount of days, and can work in conjunction with the auto-pruning feature.

For more information, see Creating an image expiration notification.

With the release of Red Hat Quay 3.10, a new auto-pruning feature was released. With that feature, Red Hat Quay administrators could set up auto-pruning policies on namespaces for both users and organizations so that image tags were automatically deleted based on specified criteria. In Red Hat Quay 3.11, this feature was enhanced so that auto-pruning policies could be set up on specified repositories.

With this release, default auto-pruning policies can now be set up at the registry level. Default auto-pruning policies set up at the registry level can be configured on new and existing organizations. This feature saves Red Hat Quay administrators time, effort, and storage by enforcing registry-wide rules.

Red Hat Quay administrators must enable this feature by updating their config.yaml file to include the DEFAULT_NAMESPACE_AUTOPRUNE_POLICY configuration field and one of number_of_tags or creation_date methods. Currently, this feature cannot be enabled by using the v2 UI or the API.

For more information, see Red Hat Quay auto-pruning overview.

Red Hat Quay now supports the Open Container Initiative (OCI) 1.1 distribution spec version 1.1. Key highlights of this update include support for the following areas:

For more information about OCI spec 1.1, see OCI Distribution Specification.

For more information about OCI support and Red Hat Quay, see Open Container Initiative support.

Some OCI media types do not utilize labels and, as such, critical information such as expiration timestamps are not included. With this release, Red Hat Quay now supports metadata passed through annotations to accommodate OCI media types that do not include these labels for metadata transmission. Tools such as ORAS (OCI Registry as Storage) can now be used to embed information with artifact types to help ensure that images operate properly, for example, to expire.

For more information about OCI media types and how adding an annotation with ORAS works, see Open Container Initiative support.

The following enhancements have been made to the Red Hat Quay v2 UI.

The following configuration field has been added for reassigning OAuth access tokens:

# ...
FEATURE_ASSIGN_OAUTH_TOKEN: true
# ...

The following configuration field has been added to enhance Red Hat Quay notifications:

# ...
NOTIFICATION_TASK_RUN_MINIMUM_INTERVAL_MINUTES: 10
# ...

The following configuration fields have been added to Red Hat Quay auto-pruning feature:

DEFAULT_NAMESPACE_AUTOPRUNE_POLICY:
  method: number_of_tags
  value: 10

DEFAULT_NAMESPACE_AUTOPRUNE_POLICY:
  method: creation_date
  value: 1y

The following configuration field has been added to notify users on detected vulnerabilities based on security level:

NOTIFICATION_MIN_SEVERITY_ON_NEW_INDEX: High

The following configuration field allows users to list OCI referrers of a manifest under a repository by using the v2 API:

# ...
FEATURE_REFERRERS_API: True
# ...

The following configuration field has been added to address when external systems like Splunk or ElasticSearch are configured as audit log destinations but are intermittently unavailable. When set to True, the logging event is logged to the stdout instead.

# ...
ALLOW_WITHOUT_STRICT_LOGGING: True
# ...

The following configuration field has been added for the Clair security scanner, which allows Red Hat Quay administrators to set a maximum layer size allowed for indexing.

The following optional API field has been added to the changeOrganizationQuota and createOrganizationQuota endpoints:

Use this field to set specific limits when creating or changing an organization’s quote limit. For more information about these endpoints, see changeOrganizationQuota and createOrganizationQuota.

The following API endpoint allows use to obtain referrer artifact information:

To use this field, you must generate a v2 API OAuth token and set FEATURE_REFERRERS_API: true in your config.yaml file. For more information, see Creating an OCI referrers OAuth access token.

The Red Hat Quay team is aware of the following known issues on the v2 UI:

The following features are not supported on IBM Power (ppc64le) or IBM Z (s390x):