Managing access and permissions

Procedure

1. Click the name of an organization.
2. Click Default permissions.
3. Click Create default permissions. A toggle drawer appears.

4. Select either Anyone or Specific user to create a default permission when a repository is created.

   1. If selecting Anyone, the following information must be provided:

      • Applied to. Search, invite, or add a user/robot/team.
      • Permission. Set the permission to one of Read, Write, or Admin.

   2. If selecting Specific user, the following information must be provided:

      • Repository creator. Provide either a user or robot account.
      • Applied to. Provide a username, robot account, or team name.
      • Permission. Set the permission to one of Read, Write, or Admin.
5. Click Create default permission. A confirmation box appears, returning the following alert: Successfully created default permission for creator.

Procedure

1. Enter the following command to create a default permission with the POST /api/v1/organization/{orgname}/prototypes endpoint:

   $ curl -X POST   -H "Authorization: Bearer <bearer_token>"   -H "Content-Type: application/json"   --data '{
       "role": "<admin_read_or_write>",
       "delegate": {
         "name": "<username>",
         "kind": "user"
       },
       "activating_user": {
         "name": "<robot_name>"
       }
     }'   https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes

   Example output

   {"activating_user": {"name": "test-org+test", "is_robot": true, "kind": "user", "is_org_member": true, "avatar": {"name": "test-org+test", "hash": "aa85264436fe9839e7160bf349100a9b71403a5e9ec684d5b5e9571f6c821370", "color": "#8c564b", "kind": "robot"}}, "delegate": {"name": "testuser", "is_robot": false, "kind": "user", "is_org_member": false, "avatar": {"name": "testuser", "hash": "f660ab912ec121d1b1e928a0bb4bc61b15f5ad44d5efdc4e1c92a25e99b8e44a", "color": "#6b6ecf", "kind": "user"}}, "role": "admin", "id": "977dc2bc-bc75-411d-82b3-604e5b79a493"}

2. Enter the following command to update a default permission using the PUT /api/v1/organization/{orgname}/prototypes/{prototypeid} endpoint, for example, if you want to change the permission type. You must include the ID that was returned when you created the policy.

   $ curl -X PUT \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Content-Type: application/json" \
     --data '{
       "role": "write"
     }' \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes/<prototypeid>

   Example output

   {"activating_user": {"name": "test-org+test", "is_robot": true, "kind": "user", "is_org_member": true, "avatar": {"name": "test-org+test", "hash": "aa85264436fe9839e7160bf349100a9b71403a5e9ec684d5b5e9571f6c821370", "color": "#8c564b", "kind": "robot"}}, "delegate": {"name": "testuser", "is_robot": false, "kind": "user", "is_org_member": false, "avatar": {"name": "testuser", "hash": "f660ab912ec121d1b1e928a0bb4bc61b15f5ad44d5efdc4e1c92a25e99b8e44a", "color": "#6b6ecf", "kind": "user"}}, "role": "write", "id": "977dc2bc-bc75-411d-82b3-604e5b79a493"}

3. You can delete the permission by entering the DELETE /api/v1/organization/{orgname}/prototypes/{prototypeid} command:

   curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes/<prototype_id>

   This command does not return an output. Instead, you can obtain a list of all permissions by entering the GET /api/v1/organization/{orgname}/prototypes command:

   $ curl -X GET \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes

   Example output

   {"prototypes": []}

Procedure

1. Log into Red Hat Quay.
2. On the v2 UI, click Repositories.
3. Click the name of a repository, for example, quayadmin/busybox.
4. Click the Settings tab.

5. Optional. Click User and robot permissions. You can adjust the settings for a user or robot account by clicking the dropdown menu option under Permissions. You can change the settings to Read, Write, or Admin.

   • Read. The User or Robot Account can view and pull from the repository.
   • Write. The User or Robot Account can read (pull) from and write (push) to the repository.
   • Admin. The User or Robot account has access to pull from, and push to, the repository, plus the ability to do administrative tasks associated with the repository.

Procedure

1. Enter the following PUT /api/v1/repository/{repository}/permissions/user/{username} command to change the permissions of a user:

   $ curl -X PUT \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Content-Type: application/json" \
     -d '{"role": "admin"}' \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>

   Example output

   {"role": "admin", "name": "quayadmin+test", "is_robot": true, "avatar": {"name": "quayadmin+test", "hash": "ca9afae0a9d3ca322fc8a7a866e8476dd6c98de543decd186ae090e420a88feb", "color": "#8c564b", "kind": "robot"}}

2. To delete the current permission, you can enter the DELETE /api/v1/repository/{repository}/permissions/user/{username} command:

   $ curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>

   This command does not return any output in the CLI. Instead, you can check that the permissions were deleted by entering the GET /api/v1/repository/{repository}/permissions/user/ command:

   $ curl -X GET \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>/

   Example output

   {"message":"User does not have permission for repo."}

Procedure

1. On the Red Hat Quay UI, click Repositories in the navigation pane.
2. Click the name of a repository.
3. Click Settings in the navigation pane.
4. Click Repository visibility.
5. Click Make private. The repository is made private, and only users on the permissions list can view and interact with it.

Procedure

1. On the v2 UI, click Organizations.
2. Click the name of the organization that you will create the robot account for, for example, test-org.
3. Click the Robot accounts tab → Create robot account.
4. In the Provide a name for your robot account box, enter a name, for example, robot1. The name of your Robot Account becomes a combination of your username plus the name of the robot, for example, quayadmin+robot1

5. Optional. The following options are available if desired:

   1. Add the robot account to a team.
   2. Add the robot account to a repository.
   3. Adjust the robot account’s permissions.

6. On the Review and finish page, review the information you have provided, then click Review and finish. The following alert appears: Successfully created robot account with robot name: <organization_name> + <robot_name>.

   Alternatively, if you tried to create a robot account with the same name as another robot account, you might receive the following error message: Error creating robot account.

7. Optional. You can click Expand or Collapse to reveal descriptive information about the robot account.
8. Optional. You can change permissions of the robot account by clicking the kebab menu → Set repository permissions. The following message appears: Successfully updated repository permission.

9. Optional. You can click the name of your robot account to obtain the following information:

   • Robot Account: Select this obtain the robot account token. You can regenerate the token by clicking Regenerate token now.
   • Kubernetes Secret: Select this to download credentials in the form of a Kubernetes pull secret YAML file.
   • Podman: Select this to copy a full podman login command line that includes the credentials.
   • Docker Configuration: Select this to copy a full docker login command line that includes the credentials.

Procedure

1. On the Red Hat Quay v2 UI landing page, click Organizations in the navigation pane.
2. On the Organizations page, select the name of the organization that has multiple repositories. The number of repositories under a single organization can be found under the Repo Count column.
3. On your organization’s page, click Robot accounts.
4. For the robot account that will be added to multiple repositories, click the kebab icon → Set repository permissions.

5. On the Set repository permissions page, check the boxes of the repositories that the robot account will be added to. For example:

   

6. Set the permissions for the robot account, for example, None, Read, Write, Admin.
7. Click save. An alert that says Success alert: Successfully updated repository permission appears on the Set repository permissions page, confirming the changes.
8. Return to the Organizations → Robot accounts page. Now, the Repositories column of your robot account shows the number of repositories that the robot account has been added to.

Procedure

1. Update your config.yaml field to add the ROBOTS_DISALLOW variable, for example:

   ROBOTS_DISALLOW: true

2. Restart your Red Hat Quay deployment.

Verification: Creating a new robot account

1. Navigate to your Red Hat Quay repository.
2. Click the name of a repository.
3. In the navigation pane, click Robot Accounts.
4. Click Create Robot Account.
5. Enter a name for the robot account, for example, <organization-name/username>+<robot-name>.
6. Click Create robot account to confirm creation. The following message appears: Cannot create robot account. Robot accounts have been disabled. Please contact your administrator.

Verification: Logging into a robot account

1. On the command-line interface (CLI), attempt to log in as one of the robot accounts by entering the following command:

   $ podman login -u="<organization-name/username>+<robot-name>" -p="KETJ6VN0WT8YLLNXUJJ4454ZI6TZJ98NV41OE02PC2IQXVXRFQ1EJ36V12345678" <quay-server.example.com>

   The following error message is returned:

   Error: logging into "<quay-server.example.com>": invalid username/password

2. You can pass in the log-level=debug flag to confirm that robot accounts have been deactivated:

   $ podman login -u="<organization-name/username>+<robot-name>" -p="KETJ6VN0WT8YLLNXUJJ4454ZI6TZJ98NV41OE02PC2IQXVXRFQ1EJ36V12345678" --log-level=debug <quay-server.example.com>

   ...
   DEBU[0000] error logging into "quay-server.example.com": unable to retrieve auth token: invalid username/password: unauthorized: Robot accounts have been disabled. Please contact your administrator.

Procedure

1. Log into your Red Hat Quay registry:
2. Click the name of the Organization that has the robot account.
3. Click Robot accounts.
4. Check the box of the robot account to be deleted.
5. Click the kebab menu.
6. Click Delete.
7. Type confirm into the textbox, then click Delete.

Procedure

1. Enter the following command to delete a robot account for an organization using the DELETE /api/v1/organization/{orgname}/robots/{robot_shortname} endpoint:

   curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     "<quay-server.example.com>/api/v1/organization/<organization_name>/robots/<robot_shortname>"

2. The CLI does not return information when deleting a robot account with the API. To confirm deletion, you can check the Red Hat Quay UI, or you can enter the following GET /api/v1/organization/{orgname}/robots command to see if details are returned for the robot account:

   $ curl -X GET   -H "Authorization: Bearer <bearer_token>"   "https://<quay-server.example.com>/api/v1/organization/<organization_name>/robots"

   Example output

   {"robots": []}

3. Enter the following command to delete a robot account for the current user with the DELETE /api/v1/user/robots/{robot_shortname} endpoint:

   $ curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     "<quay-server.example.com>/api/v1/user/robots/<robot_shortname>"

4. The CLI does not return information when deleting a robot account for the current user with the API. To confirm deletion, you can check the Red Hat Quay UI, or you can enter the following GET /api/v1/user/robots/{robot_shortname} command to see if details are returned for the robot account:

   $ curl -X GET \
     -H "Authorization: Bearer <bearer_token>" \
     "<quay-server.example.com>/api/v1/user/robots/<robot_shortname>"

   Example output

   {"message":"Could not find robot with specified username"}