Securing Red Hat Quay

Procedure

1. Copy the certificate file and primary key file to your configuration directory, ensuring they are named ssl.cert and ssl.key respectively:

   cp ~/ssl.cert ~/ssl.key /path/to/configuration_directory

   Copy to Clipboard Toggle word wrap

2. Navigate to the configuration directory by entering the following command:

   $ cd /path/to/configuration_directory

   Copy to Clipboard Toggle word wrap

3. Edit the config.yaml file and specify that you want Red Hat Quay to handle SSL/TLS:

   Example config.yaml file

   # ...
   SERVER_HOSTNAME: <quay-server.example.com>
   ...
   PREFERRED_URL_SCHEME: https
   # ...

   Copy to Clipboard Toggle word wrap

4. Optional: Append the contents of the rootCA.pem file to the end of the ssl.cert file by entering the following command:

   $ cat rootCA.pem >> ssl.cert

   Copy to Clipboard Toggle word wrap

5. Stop the Quay container by entering the following command:

   $ sudo podman stop <quay_container_name>

   Copy to Clipboard Toggle word wrap

6. Restart the registry by entering the following command:

   $ sudo podman run -d --rm -p 80:8080 -p 443:8443 \
     --name=quay \
     -v $QUAY/config:/conf/stack:Z \
     -v $QUAY/storage:/datastorage:Z \
     registry.redhat.io/quay/quay-rhel8:v3.13.7

   Copy to Clipboard Toggle word wrap

Procedure

1. Copy the root CA file to one of /etc/containers/certs.d/ or /etc/docker/certs.d/. Use the exact path determined by the server hostname, and name the file ca.crt:

   $ sudo cp rootCA.pem /etc/containers/certs.d/quay-server.example.com/ca.crt

   Copy to Clipboard Toggle word wrap

2. Verify that you no longer need to use the --tls-verify=false option when logging in to your Red Hat Quay registry:

   $ sudo podman login quay-server.example.com

   Copy to Clipboard Toggle word wrap

   Example output

   Login Succeeded!

   Copy to Clipboard Toggle word wrap

Procedure

1. Enter the following command to copy the rootCA.pem file to the consolidated system-wide trust store:

   $ sudo cp rootCA.pem /etc/pki/ca-trust/source/anchors/

   Copy to Clipboard Toggle word wrap

2. Enter the following command to update the system-wide trust store configuration:

   $ sudo update-ca-trust extract

   Copy to Clipboard Toggle word wrap

3. Optional. You can use the trust list command to ensure that the Quay server has been configured:

   $ trust list | grep quay
       label: quay-server.example.com

   Copy to Clipboard Toggle word wrap

   Now, when you browse to the registry at https://quay-server.example.com, the lock icon shows that the connection is secure:

   

4. To remove the rootCA.pem file from system-wide trust, delete the file and update the configuration:

   $ sudo rm /etc/pki/ca-trust/source/anchors/rootCA.pem

   Copy to Clipboard Toggle word wrap

   $ sudo update-ca-trust extract

   Copy to Clipboard Toggle word wrap

   $ trust list | grep quay

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new YAML file, for example, custom-ssl-config-bundle-secret.yaml:

   $ touch custom-ssl-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

2. Create the custom-ssl-config-bundle-secret resource.

   1. Create the resource by entering the following command:

      $ oc -n <namespace> create secret generic custom-ssl-config-bundle-secret \
        --from-file=config.yaml=</path/to/config.yaml> \ 

      1

      
        --from-file=ssl.cert=</path/to/ssl.cert> \ 

      2

      
        --from-file=extra_ca_cert_<name-of-certificate>.crt=ca-certificate-bundle.crt
       \ 

      3

      
        --from-file=ssl.key=</path/to/ssl.key> \ 

      4

      
        --dry-run=client -o yaml > custom-ssl-config-bundle-secret.yaml

      Copy to Clipboard Toggle word wrap

      1

      Where <config.yaml> is your base64 decoded config.yaml file.

      2

      Where <ssl.cert> is your ssl.cert file.

      3

      Optional. The --from-file=extra_ca_cert_<name-of-certificate>.crt=ca-certificate-bundle.crt field allows Red Hat Quay to recognize custom Certificate Authority (CA) files. If you are using LDAP, OIDC, or another service that uses custom CAs, you must add them via the extra_ca_cert path. For more information, see "Adding additional Certificate Authorities to Red Hat Quay on OpenShift Container Platform."

      4

      Where <ssl.key> is your ssl.key file.

3. Optional. You can check the content of the custom-ssl-config-bundle-secret.yaml file by entering the following command:

   $ cat custom-ssl-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

   Example output

   apiVersion: v1
   data:
     config.yaml: QUxMT1dfUFVMTFNfV0lUSE9VVF9TVFJJQ1RfTE9HR0lORzogZmFsc2UKQVVUSEVOVElDQVRJT05fVFlQRTogRGF0YWJhc2UKREVGQVVMVF9UQUdfRVhQSVJBVElPTjogMncKRElTVFJJQlVURURfU1R...
     ssl.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVYakNDQTBhZ0F3SUJBZ0lVTUFBRk1YVWlWVHNoMGxNTWI3U1l0eFV5eTJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZZ3hDekFKQmdOVkJBWVR...
     extra_ca_cert_<name-of-certificate>:LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVYakNDQTBhZ0F3SUJBZ0lVTUFBRk1YVWlWVHNoMGxNTWI3U1l0eFV5eTJjd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2dZZ3hDe...
     ssl.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2c0VWxZOVV1SVJPY1oKcFhpZk9MVEdqaS9neUxQMlpiMXQ...
   kind: Secret
   metadata:
     creationTimestamp: null
     name: custom-ssl-config-bundle-secret
     namespace: <namespace>

   Copy to Clipboard Toggle word wrap

4. Create the configBundleSecret resource by entering the following command:

   $ oc create -n <namespace> -f custom-ssl-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

   Example output

   secret/custom-ssl-config-bundle-secret created

   Copy to Clipboard Toggle word wrap

5. Update the QuayRegistry YAML file to reference the custom-ssl-config-bundle-secret object by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"configBundleSecret":"custom-ssl-config-bundle-secret"}}'

   Copy to Clipboard Toggle word wrap

   Example output

   quayregistry.quay.redhat.com/example-registry patched

   Copy to Clipboard Toggle word wrap

6. Set the tls component of the QuayRegistry YAML to false by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"components":[{"kind":"tls","managed":false}]}}'

   Copy to Clipboard Toggle word wrap

   Example output

   quayregistry.quay.redhat.com/example-registry patched

   Copy to Clipboard Toggle word wrap

7. Ensure that your QuayRegistry YAML file has been updated to use the custom SSL configBundleSecret resource, and that your and tls resource is set to false by entering the following command:

   $ oc get quayregistry <registry_name> -n <namespace> -o yaml

   Copy to Clipboard Toggle word wrap

   Example output

   # ...
     configBundleSecret: custom-ssl-config-bundle-secret
   # ...
   spec:
     components:
     - kind: tls
       managed: false
   # ...

   Copy to Clipboard Toggle word wrap

Procedure

1. Describe the QuayRegistry resource by entering the following command:

   $ oc describe quayregistry -n <quay_namespace>

   Copy to Clipboard Toggle word wrap

   # ...
     Config Bundle Secret:  example-registry-config-bundle-v123x
   # ...

   Copy to Clipboard Toggle word wrap

2. Obtain the secret data by entering the following command:

   $ oc get secret -n <quay_namespace> <example-registry-config-bundle-v123x> -o jsonpath='{.data}'

   Copy to Clipboard Toggle word wrap

   Example output

   {
       "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo="
   }

   Copy to Clipboard Toggle word wrap

3. Decode the data by entering the following command:

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode

   Copy to Clipboard Toggle word wrap

   Example output

   FEATURE_USER_INITIALIZE: true
   BROWSER_API_CALLS_XHR_ONLY: false
   SUPER_USERS:
   - quayadmin
   FEATURE_USER_CREATION: false
   FEATURE_QUOTA_MANAGEMENT: true
   FEATURE_PROXY_CACHE: true
   FEATURE_BUILD_SUPPORT: true
   DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 102400000

   Copy to Clipboard Toggle word wrap

4. Optional. You can export the data into a YAML file into the current directory by passing in the >> config.yaml flag. For example:

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode >> config.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a new YAML file, for example, extra-ca-certificate-config-bundle-secret.yaml:

   $ touch extra-ca-certificate-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

2. Create the extra-ca-certificate-config-bundle-secret resource.

   1. Create the resource by entering the following command:

      $ oc -n <namespace> create secret generic extra-ca-certificate-config-bundle-secret \
        --from-file=config.yaml=</path/to/config.yaml> \ 

      1

      
        --from-file=extra_ca_cert_<name-of-certificate-one>=<path/to/certificate_one> \ 

      2

      
        --from-file=extra_ca_cert_<name-of-certificate-two>=<path/to/certificate_two> \ 

      3

      
        --from-file=extra_ca_cert_<name-of-certificate-three>=<path/to/certificate_three> \ 

      4

      
        --dry-run=client -o yaml > extra-ca-certificate-config-bundle-secret.yaml

      Copy to Clipboard Toggle word wrap

      1

      Where <config.yaml> is your base64 decoded config.yaml file.

      2

      The extra CA file to be added to into the system trust bundle.

      3

      Optional. A second CA file to be added into the system trust bundle.

      4

      Optional. A third CA file to be added into the system trust bundle.

3. Optional. You can check the content of the extra-ca-certificate-config-bundle-secret.yaml file by entering the following command:

   $ cat extra-ca-certificate-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

   Example output

   apiVersion: v1
   data:
     config.yaml: QUxMT1dfUFVMTFNfV0lUSE9VVF9TVFJJQ1RfTE9HR0lORzogZmFsc2UKQVVUSEVOVElDQVRJT05fVFlQRTogRGF0YWJhc2UKREVGQVVMVF9UQUdfRVhQSVJBVElPTjogMncKUFJFRkVSU...
     extra_ca_cert_certificate-one: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQyVENDQXNHZ0F3SUJBZ0lVS2xOai90VUJBZHBkNURjYkdRQUo4anRuKzd3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
     extra_ca_cert_certificate-three: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ0ekNDQXN1Z0F3SUJBZ0lVQmJpTXNUeExjM0s4ODNWby9GTThsWXlOS2lFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
     extra_ca_cert_certificate-two: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ0ekNDQXN1Z0F3SUJBZ0lVVFVPTXZ2YVdFOFRYV3djYTNoWlBCTnV2QjYwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
   kind: Secret
   metadata:
     creationTimestamp: null
     name: custom-ssl-config-bundle-secret
     namespace: <namespace>

   Copy to Clipboard Toggle word wrap

4. Create the configBundleSecret resource by entering the following command:

   $ oc create -n <namespace> -f extra-ca-certificate-config-bundle-secret.yaml

   Copy to Clipboard Toggle word wrap

   Example output

   secret/extra-ca-certificate-config-bundle-secret created

   Copy to Clipboard Toggle word wrap

5. Update the QuayRegistry YAML file to reference the extra-ca-certificate-config-bundle-secret object by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"configBundleSecret":"extra-ca-certificate-config-bundle-secret"}}'

   Copy to Clipboard Toggle word wrap

   Example output

   quayregistry.quay.redhat.com/example-registry patched

   Copy to Clipboard Toggle word wrap

6. Ensure that your QuayRegistry YAML file has been updated to use the extra CA certificate configBundleSecret resource by entering the following command:

   $ oc get quayregistry <registry_name> -n <namespace> -o yaml

   Copy to Clipboard Toggle word wrap

   Example output

   # ...
     configBundleSecret: extra-ca-certificate-config-bundle-secret
   # ...

   Copy to Clipboard Toggle word wrap