Chapter 2. Configuration fields

2.1. Required configuration fields
Copy link

Required fields are covered in the following sections:

2.2. Automation options
Copy link

2.3. Optional configuration fields
Copy link

Optional fields are covered in the following sections:

2.4. General required fields
Copy link

Expand

Table 2.1. General required fields
Field	Type	Description
AUTHENTICATION_TYPE (Required)	String	The authentication engine to use for credential authentication Values: One of `Database`, `LDAP`, `JWT`, `Keystone`, `OIDC` Default: `Database`
PREFERRED_URL_SCHEME (Required)	String	The URL scheme to use when accessing Red Hat Quay Values: One of `http`, `https` Default: `http`
SERVER_HOSTNAME (Required)	String	The URL at which Red Hat Quay is accessible, without the scheme Example: `quay-server.example.com`
DATABASE_SECRET_KEY (Required)	String	Key used to encrypt sensitive fields within the database. This value should never be changed once set, otherwise all reliant fields, for example, repository mirror username and password configurations, are invalidated.
SECRET_KEY (Required)	String	Key used to encrypt sensitive fields within the database and at run time. his value should never be changed once set, otherwise all reliant fields, for example, encrypted password credentials, are invalidated.
SETUP_COMPLETE (Required)	Boolean	This is an artefact left over from earlier versions of the software and currently it must be specified with a value of `true`.

2.5. Database configuration
Copy link

You configure the connection to the database using the required DB_URI field and optional connection arguments in the DB_CONNECTION_ARGS structure. Some key-value pairs defined under DB_CONNECTION_ARGS are generic while others are database-specific. In particular, SSL configuration depends on the database you are deploying, and examples for PostgreSQL and MySQL are given below.

2.5.1. Database URI
Copy link

Expand

Table 2.2. Database URI
Field	Type	Description
DB_URI (Required)	String	The URI for accessing the database, including any credentials

Example:

postgresql://quayuser:quaypass@quay-server.example.com:5432/quay

postgresql://quayuser:quaypass@quay-server.example.com:5432/quay

Copy to Clipboard

Toggle word wrap

2.5.2. Database connection arguments
Copy link

Expand

Table 2.3. Database connection arguments
Field	Type	Description
DB_CONNECTION_ARGS	Object	Optional connection arguments for the database, such as timeouts and SSL
.autorollback	Boolean	Whether to use thread-local connections Should ALWAYS be `true`
.threadlocals	Boolean	Whether to use auto-rollback connections Should ALWAYS be `true`

2.5.2.1. PostgreSQL SSL connection arguments
Copy link

A sample PostgreSQL SSL configuration is given below:

DB_CONNECTION_ARGS:
  sslmode: verify-ca
  sslrootcert: /path/to/cacert

DB_CONNECTION_ARGS:
  sslmode: verify-ca
  sslrootcert: /path/to/cacert

Copy to Clipboard

Toggle word wrap

The sslmode option determines whether or with what priority a secure SSL TCP/IP connection will be negotiated with the server. There are six modes:

disable: only try a non-SSL connection
allow: first try a non-SSL connection; if that fails, try an SSL connection
prefer: (default) first try an SSL connection; if that fails, try a non-SSL connection
require: only try an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified
verify-ca: only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority (CA)
verify-full: only try an SSL connection, verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate

More information on the valid arguments for PostgreSQL is available at https://www.postgresql.org/docs/current/libpq-connect.html.

2.5.2.2. MySQL SSL connection arguments
Copy link

A sample MySQL SSL configuration follows:

DB_CONNECTION_ARGS:
  ssl:
    ca: /path/to/cacert

DB_CONNECTION_ARGS:
  ssl:
    ca: /path/to/cacert

Copy to Clipboard

Toggle word wrap

Information on the valid connection arguments for MySQL is available at https://dev.mysql.com/doc/refman/8.0/en/connecting-using-uri-or-key-value-pairs.html.

2.6. Image storage
Copy link

2.6.1. Image storage features
Copy link

Expand

Table 2.4. Storage config features
Field	Type	Description
FEATURE_REPO_MIRROR	Boolean	If set to true, enables repository mirroring Default: `False`
FEATURE_PROXY_STORAGE	Boolean	Whether to proxy all direct download URLs in storage via the registry nginx Default: `False`
FEATURE_STORAGE_REPLICATION	Boolean	Whether to automatically replicate between storage engines Default: `False`

2.6.2. Image storage configuration fields
Copy link

You specify a list of all storage engines using the DISTRIBUTED_STORAGE_CONFIG field, and choose you preferred storage engine(s) using the DISTRIBUTED_STORAGE_PREFERENCE field.

The DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS field is used to control which locations will have their images replicated by default.

Expand

Table 2.5. Storage config fields
Field	Type	Description
DISTRIBUTED_STORAGE_CONFIG (Required)	Object	Configuration for storage engine(s) to use in Red Hat Quay. Each key represents an unique identifier for a storage engine. The value consists of a tuple of (key, value) forming an object describing the storage engine parameters. Default: `[]`
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS (Required)	Array of string	The list of storage engine(s) (by ID in DISTRIBUTED_STORAGE_CONFIG) whose images should be fully replicated, by default, to all other storage engines.
DISTRIBUTED_STORAGE_PREFERENCE (Required)	Array of string	The preferred storage engine(s) (by ID in DISTRIBUTED_STORAGE_CONFIG) to use. A preferred engine means it is first checked for pulling and images are pushed to it. Default: `false`
MAXIMUM_LAYER_SIZE	String	Maximum allowed size of an image layer Pattern: `^[0-9]+(G\|M)$` Example: `100G` Default: `20G`

2.6.3. Local storage
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  default:
    - LocalStorage
    - storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - default

DISTRIBUTED_STORAGE_CONFIG:
  default:
    - LocalStorage
    - storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - default

Copy to Clipboard

Toggle word wrap

2.6.4. OCS/NooBaa
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  rhocsStorage:
    - RHOCSStorage
    - access_key: access_key_here
      secret_key: secret_key_here
      bucket_name: quay-datastore-9b2108a3-29f5-43f2-a9d5-2872174f9a56
      hostname: s3.openshift-storage.svc.cluster.local
      is_secure: 'true'
      port: '443'
      storage_path: /datastorage/registry

DISTRIBUTED_STORAGE_CONFIG:
  rhocsStorage:
    - RHOCSStorage
    - access_key: access_key_here
      secret_key: secret_key_here
      bucket_name: quay-datastore-9b2108a3-29f5-43f2-a9d5-2872174f9a56
      hostname: s3.openshift-storage.svc.cluster.local
      is_secure: 'true'
      port: '443'
      storage_path: /datastorage/registry

Copy to Clipboard

Toggle word wrap

2.6.5. Ceph / RadosGW Storage / Hitachi HCP
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  radosGWStorage:
    - RadosGWStorage
    - access_key: access_key_here
      secret_key: secret_key_here
      bucket_name: bucket_name_here
      hostname: hostname_here
      is_secure: 'true'
      port: '443'
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - default

DISTRIBUTED_STORAGE_CONFIG:
  radosGWStorage:
    - RadosGWStorage
    - access_key: access_key_here
      secret_key: secret_key_here
      bucket_name: bucket_name_here
      hostname: hostname_here
      is_secure: 'true'
      port: '443'
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - default

Copy to Clipboard

Toggle word wrap

2.6.6. AWS S3 storage
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  s3Storage:
    - S3Storage
    - host: s3.us-east-2.amazonaws.com
      s3_access_key: ABCDEFGHIJKLMN
      s3_secret_key: OL3ABCDEFGHIJKLMN
      s3_bucket: quay_bucket
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - s3Storage

DISTRIBUTED_STORAGE_CONFIG:
  s3Storage:
    - S3Storage
    - host: s3.us-east-2.amazonaws.com
      s3_access_key: ABCDEFGHIJKLMN
      s3_secret_key: OL3ABCDEFGHIJKLMN
      s3_bucket: quay_bucket
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - s3Storage

Copy to Clipboard

Toggle word wrap

2.6.7. Google cloud storage
Copy link

DISTRIBUTED_STORAGE_CONFIG:
    googleCloudStorage:
        - GoogleCloudStorage
        - access_key: GOOGQIMFB3ABCDEFGHIJKLMN
          bucket_name: quay-bucket
          secret_key: FhDAYe2HeuAKfvZCAGyOioNaaRABCDEFGHIJKLMN
          storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - googleCloudStorage

DISTRIBUTED_STORAGE_CONFIG:
    googleCloudStorage:
        - GoogleCloudStorage
        - access_key: GOOGQIMFB3ABCDEFGHIJKLMN
          bucket_name: quay-bucket
          secret_key: FhDAYe2HeuAKfvZCAGyOioNaaRABCDEFGHIJKLMN
          storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - googleCloudStorage

Copy to Clipboard

Toggle word wrap

2.6.8. Azure storage
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  azureStorage:
    - AzureStorage
    - azure_account_name: azure_account_name_here
      azure_account_key: azure_account_key_here
      azure_container: azure_container_here
      sas_token: some/path/
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - azureStorage

DISTRIBUTED_STORAGE_CONFIG:
  azureStorage:
    - AzureStorage
    - azure_account_name: azure_account_name_here
      azure_account_key: azure_account_key_here
      azure_container: azure_container_here
      sas_token: some/path/
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - azureStorage

Copy to Clipboard

Toggle word wrap

2.6.9. Swift storage
Copy link

DISTRIBUTED_STORAGE_CONFIG:
  swiftStorage:
    - SwiftStorage
    - swift_user: swift_user_here
      swift_password: swift_password_here
      swift_container: swift_container_here
      auth_url: https://example.org/swift/v1/quay
      auth_version: 1
      ca_cert_path: /conf/stack/swift.cert"
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - swiftStorage

DISTRIBUTED_STORAGE_CONFIG:
  swiftStorage:
    - SwiftStorage
    - swift_user: swift_user_here
      swift_password: swift_password_here
      swift_container: swift_container_here
      auth_url: https://example.org/swift/v1/quay
      auth_version: 1
      ca_cert_path: /conf/stack/swift.cert"
      storage_path: /datastorage/registry
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
DISTRIBUTED_STORAGE_PREFERENCE:
    - swiftStorage

Copy to Clipboard

Toggle word wrap

2.7. Redis configuration fields
Copy link

2.7.1. Build logs
Copy link

Expand

Table 2.6. Build logs configuration
Field	Type	Description
BUILDLOGS_REDIS (Required)	Object	Redis connection details for build logs caching
.host (Required)	String	The hostname at which Redis is accessible Example: `quay-server.example.com`
.port (Required)	Number	The port at which Redis is accessible Example: `6379`
.password	String	The port at which Redis is accessible Example: `strongpassword`

2.7.2. User events
Copy link

Expand

Table 2.7. User events config
Field	Type	Description
USER_EVENTS_REDIS (Required)	Object	Redis connection details for user event handling
.host (Required)	String	The hostname at which Redis is accessible Example: `quay-server.example.com`
.port (Required)	Number	The port at which Redis is accessible Example: `6379`
.password	String	The port at which Redis is accessible Example: `strongpassword`

2.7.3. Example redis configuration
Copy link

BUILDLOGS_REDIS:
    host: quay-server.example.com
    password: strongpassword
    port: 6379

USER_EVENTS_REDIS:
    host: quay-server.example.com
    password: strongpassword
    port: 6379

BUILDLOGS_REDIS:
    host: quay-server.example.com
    password: strongpassword
    port: 6379

USER_EVENTS_REDIS:
    host: quay-server.example.com
    password: strongpassword
    port: 6379

Copy to Clipboard

Toggle word wrap

2.8. Tag expiration options
Copy link

Expand

Table 2.8. Tag expiration configuration
Field	Type	Description
FEATURE_GARBAGE_COLLECTION	Boolean	Whether garbage collection of repositories is enabled Default: True

TAG_EXPIRATION_OPTIONS (Required)	Array of string	The options that users can select for expiration of tags in their namespace (if enabled) Pattern: `^[0-9]+(w\|m\|d\|h\|s)$`
DEFAULT_TAG_EXPIRATION (Required)	String	The default, configurable tag expiration time for time machine. Pattern: `^[0-9]+(w\|m\|d\|h\|s)$` Default: `2w`

FEATURE_CHANGE_TAG_EXPIRATION	Boolean	Whether users and organizations are allowed to change the tag expiration for tags in their namespace Default: True

Example:

DEFAULT_TAG_EXPIRATION: 2w
TAG_EXPIRATION_OPTIONS:
    - 0s
    - 1d
    - 1w
    - 2w
    - 4w

DEFAULT_TAG_EXPIRATION: 2w
TAG_EXPIRATION_OPTIONS:
    - 0s
    - 1d
    - 1w
    - 2w
    - 4w

Copy to Clipboard

Toggle word wrap

2.9. Pre-configuring Quay for automation
Copy link

Quay has a number of configuration options that support automation. These options can be set before deployment, to minimize the need to interact with the user interface.

2.9.1. Allowing the API to create the first user
Copy link

Set the config option FEATURE_USER_INITIALIZE to true, so that you can use the API /api/v1/user/initialize to create the first user. This API endpoint does not require authentication, unlike all other registry API calls which require an OAuth token which is generated by an OAuth application in an existing organization.

Once you have deployed Quay, you can use the API to create a user, for example, quayadmin, provided no other users have already been created. For more information, see the section on Creating the first user using the API

2.9.2. Enabling general API access
Copy link

Set the config option BROWSER_API_CALLS_XHR_ONLY to false, to allow general access to the Quay registry API.

2.9.3. Adding a super user
Copy link

While you cannot create a user until after deployment, it is convenient to ensure that first user is an administrator with full permissions. It is easier to configure this in advance, using the SUPER_USER configuration object.

2.9.4. Restricting user creation
Copy link

Once you have configured a super user, you can restrict the ability to create new users to the super user group. Set the FEATURE_USER_CREATION to false to restrict user creation.

2.9.5. Suggested configuration for automation
Copy link

Create a config.yaml configuration file that includes the appropriate settings:

config.yaml

...
FEATURE_USER_INITIALIZE: true
BROWSER_API_CALLS_XHR_ONLY: false
SUPER_USERS:
- quayadmin
FEATURE_USER_CREATION: false
...

...
FEATURE_USER_INITIALIZE: true
BROWSER_API_CALLS_XHR_ONLY: false
SUPER_USERS:
- quayadmin
FEATURE_USER_CREATION: false
...

Copy to Clipboard

Toggle word wrap

2.9.6. Deploying the Operator using the initial configuration
Copy link

Create a Secret using the configuration file

oc create secret generic --from-file config.yaml=./config.yaml init-config-bundle-secret

$ oc create secret generic --from-file config.yaml=./config.yaml init-config-bundle-secret

Copy to Clipboard

Toggle word wrap

Create a QuayRegistry YAML file quayregistry.yaml, identifying the unmanaged components and also referencing the created Secret, for example:

quayregistry.yaml

apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: example-registry
  namespace: quay-enterprise
spec:
  configBundleSecret: init-config-bundle-secret

apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: example-registry
  namespace: quay-enterprise
spec:
  configBundleSecret: init-config-bundle-secret

Copy to Clipboard

Toggle word wrap

Deploy the registry:
```
oc create -f quayregistry.yaml
```
```
$ oc create -f quayregistry.yaml
```
Copy to Clipboard Toggle word wrap
Create the first user, quayadmin, using the API

2.9.7. Using the API to create the first user
Copy link

When using the API to create the first user, the following conditions must be met:

The config option FEATURE_USER_INITIALIZE must be set to true
No users can already exist in the database

For more information on pre-configuring the deployment, see the section Pre-configuring Quay for automation

2.9.7.1. Invoking the API
Copy link

Using the status.registryEndpoint URL, invoke the /api/v1/user/initialize API, passing in the username, password and email address. You can also request an OAuth token by specifying "access_token": true.

 curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"quaypass123", "email": "quayadmin@example.com", "access_token": true}'

$  curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"quaypass123", "email": "quayadmin@example.com", "access_token": true}'

Copy to Clipboard

Toggle word wrap

{"access_token":"6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED", "email":"quayadmin@example.com","encrypted_password":"1nZMLH57RIE5UGdL/yYpDOHLqiNCgimb6W9kfF8MjZ1xrfDpRyRs9NUnUuNuAitW","username":"quayadmin"}

{"access_token":"6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED", "email":"quayadmin@example.com","encrypted_password":"1nZMLH57RIE5UGdL/yYpDOHLqiNCgimb6W9kfF8MjZ1xrfDpRyRs9NUnUuNuAitW","username":"quayadmin"}

Copy to Clipboard

Toggle word wrap

If successful, the method returns an object with the username, email and encrypted password. If a user already exists in the database, an error is returned:

 curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayuser2", "password":"quaypass123", "email": "quayuser2@example.com"}'

$  curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayuser2", "password":"quaypass123", "email": "quayuser2@example.com"}'

Copy to Clipboard

Toggle word wrap

{"message":"Cannot initialize user in a non-empty database"}

{"message":"Cannot initialize user in a non-empty database"}

Copy to Clipboard

Toggle word wrap

The password must be at least 8 characters and contain no whitespace:

 curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"pass123", "email": "quayadmin@example.com"}'

 $  curl -X POST -k  https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/user/initialize --header 'Content-Type: application/json' --data '{ "username": "quayadmin", "password":"pass123", "email": "quayadmin@example.com"}'

Copy to Clipboard

Toggle word wrap

{"message":"Failed to initialize user: Invalid password, password must be at least 8 characters and contain no whitespace."}

{"message":"Failed to initialize user: Invalid password, password must be at least 8 characters and contain no whitespace."}

Copy to Clipboard

Toggle word wrap

2.9.7.2. Using the OAuth token
Copy link

You can now invoke the rest of the Quay API specifying the returned OAuth code. For example, to get a list of the current users:

curl -X GET -k -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/superuser/users/

$ curl -X GET -k -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/superuser/users/

Copy to Clipboard

Toggle word wrap

{
    "users": [
        {
            "kind": "user",
            "name": "quayadmin",
            "username": "quayadmin",
            "email": "quayadmin@example.com",
            "verified": true,
            "avatar": {
                "name": "quayadmin",
                "hash": "3e82e9cbf62d25dec0ed1b4c66ca7c5d47ab9f1f271958298dea856fb26adc4c",
                "color": "#e7ba52",
                "kind": "user"
            },
            "super_user": true,
            "enabled": true
        }
    ]
}

{
    "users": [
        {
            "kind": "user",
            "name": "quayadmin",
            "username": "quayadmin",
            "email": "quayadmin@example.com",
            "verified": true,
            "avatar": {
                "name": "quayadmin",
                "hash": "3e82e9cbf62d25dec0ed1b4c66ca7c5d47ab9f1f271958298dea856fb26adc4c",
                "color": "#e7ba52",
                "kind": "user"
            },
            "super_user": true,
            "enabled": true
        }
    ]
}

Copy to Clipboard

Toggle word wrap

In this instance, the details for the quayadmin user are returned as it is the only user that has been created so far.

2.9.7.2.1. Create organization
Copy link

To create an organization, use a POST call to api/v1/organization/ endpoint:

curl -X POST -k --header 'Content-Type: application/json' -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/organization/ --data '{"name": "testorg", "email": "testorg@example.com"}'

$ curl -X POST -k --header 'Content-Type: application/json' -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://example-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/organization/ --data '{"name": "testorg", "email": "testorg@example.com"}'

Copy to Clipboard

Toggle word wrap

"Created"

"Created"

Copy to Clipboard

Toggle word wrap

2.9.7.2.2. Get organization details
Copy link

To retrieve the details of the organization you created:

curl -X GET -k --header 'Content-Type: application/json' -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://min-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/organization/testorg

$ curl -X GET -k --header 'Content-Type: application/json' -H "Authorization: Bearer 6B4QTRSTSD1HMIG915VPX7BMEZBVB9GPNY2FC2ED" https://min-registry-quay-quay-enterprise.apps.docs.quayteam.org/api/v1/organization/testorg

Copy to Clipboard

Toggle word wrap

{
    "name": "testorg",
    "email": "testorg@example.com",
    "avatar": {
        "name": "testorg",
        "hash": "5f113632ad532fc78215c9258a4fb60606d1fa386c91b141116a1317bf9c53c8",
        "color": "#a55194",
        "kind": "user"
    },
    "is_admin": true,
    "is_member": true,
    "teams": {
        "owners": {
            "name": "owners",
            "description": "",
            "role": "admin",
            "avatar": {
                "name": "owners",
                "hash": "6f0e3a8c0eb46e8834b43b03374ece43a030621d92a7437beb48f871e90f8d90",
                "color": "#c7c7c7",
                "kind": "team"
            },
            "can_view": true,
            "repo_count": 0,
            "member_count": 1,
            "is_synced": false
        }
    },
    "ordered_teams": [
        "owners"
    ],
    "invoice_email": false,
    "invoice_email_address": null,
    "tag_expiration_s": 1209600,
    "is_free_account": true
}

{
    "name": "testorg",
    "email": "testorg@example.com",
    "avatar": {
        "name": "testorg",
        "hash": "5f113632ad532fc78215c9258a4fb60606d1fa386c91b141116a1317bf9c53c8",
        "color": "#a55194",
        "kind": "user"
    },
    "is_admin": true,
    "is_member": true,
    "teams": {
        "owners": {
            "name": "owners",
            "description": "",
            "role": "admin",
            "avatar": {
                "name": "owners",
                "hash": "6f0e3a8c0eb46e8834b43b03374ece43a030621d92a7437beb48f871e90f8d90",
                "color": "#c7c7c7",
                "kind": "team"
            },
            "can_view": true,
            "repo_count": 0,
            "member_count": 1,
            "is_synced": false
        }
    },
    "ordered_teams": [
        "owners"
    ],
    "invoice_email": false,
    "invoice_email_address": null,
    "tag_expiration_s": 1209600,
    "is_free_account": true
}

Copy to Clipboard

Toggle word wrap

2.10. Basic configuration
Copy link

Expand

Table 2.9. Basic configuration
Field	Type	Description
REGISTRY_TITLE	String	If specified, the long-form title for the registry Default: `Quay Enterprise`
REGISTRY_TITLE_SHORT	String	If specified, the short-form title for the registry. Default: `Quay Enterprise`

BRANDING	Object	Custom branding for logos and URLs in the Red Hat Quay UI.
.logo (Required)	String	Main logo image URL Example: `/static/img/quay-horizontal-color.svg`
.footer_img	String	Logo for UI footer Example: `/static/img/RedHat.svg`
.footer_url	String	Link for footer image Example: `https://redhat.com`

CONTACT_INFO	Array of String	If specified, contact information to display on the contact page. If only a single piece of contact information is specified, the contact footer will link directly.
[0]	String	Adds a link to send an e-mail Pattern: `^mailto:(.)+$` Example: `mailto:support@quay.io`
[1]	String	Adds a link to visit an IRC chat room Pattern: `^irc://(.)+$` Example: `irc://chat.freenode.net:6665/quay`
[2]	String	Adds a link to call a phone number+ Pattern: `^tel:(.)+$` Example: `tel:+1-888-930-3475`
[3]	String	Adds a link to a defined URL Pattern: `^http(s)?://(.)+$` Example: `https://twitter.com/quayio`

2.11. SSL configuration fields
Copy link

Expand

Table 2.10. SSL configuration
Field	Type	Description
PREFERRED_URL_SCHEME	String	One of `http`, `https` Default: `http`
SERVER_HOSTNAME (Required)	String	The URL at which Red Hat Quay is accessible, without the scheme Example: `quay-server.example.com`
SSL_CIPHERS	Array of String	If specified, the nginx-defined list of SSL ciphers to enabled and disabled Example: [`CAMELLIA`, `!3DES`]
SSL_PROTOCOLS	Array of String	If specified, nginx is configured to enabled a list of SSL protocols defined in the list. Removing an SSL protocol from the list disables the protocol during Red Hat Quay startup. Example: `['TLSv1','TLSv1.1','TLSv1.2']`
SESSION_COOKIE_SECURE	Boolean	Whether the `secure` property should be set on session cookies Default: False Recommendation: Set to True for all installations using SSL

2.11.1. Configuring SSL
Copy link

Copy the certificate file and primary key file to your configuration directory, ensuring they are named ssl.cert and ssl.key respectively:
```
cp ~/ssl.cert $QUAY/config
cp ~/ssl.key $QUAY/config
cd $QUAY/config
```
```
$ cp ~/ssl.cert $QUAY/config
$ cp ~/ssl.key $QUAY/config
$ cd $QUAY/config
```
Copy to Clipboard Toggle word wrap

Edit the config.yaml file and specify that you want Quay to handle TLS:

config.yaml

...
SERVER_HOSTNAME: quay-server.example.com
...
PREFERRED_URL_SCHEME: https
...

...
SERVER_HOSTNAME: quay-server.example.com
...
PREFERRED_URL_SCHEME: https
...

Copy to Clipboard

Toggle word wrap

Stop the Quay container and restart the registry

2.12. Adding TLS Certificates to the Red Hat Quay Container
Copy link

To add custom TLS certificates to Red Hat Quay, create a new directory named extra_ca_certs/ beneath the Red Hat Quay config directory. Copy any required site-specific TLS certificates to this new directory.

2.12.1. Add TLS certificates to Red Hat Quay
Copy link

View certificate to be added to the container

cat storage.crt
-----BEGIN CERTIFICATE-----
MIIDTTCCAjWgAwIBAgIJAMVr9ngjJhzbMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNV
[...]
-----END CERTIFICATE-----

$ cat storage.crt
-----BEGIN CERTIFICATE-----
MIIDTTCCAjWgAwIBAgIJAMVr9ngjJhzbMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNV
[...]
-----END CERTIFICATE-----

Copy to Clipboard

Toggle word wrap

Create certs directory and copy certificate there

mkdir -p quay/config/extra_ca_certs
cp storage.crt quay/config/extra_ca_certs/
tree quay/config/

$ mkdir -p quay/config/extra_ca_certs
$ cp storage.crt quay/config/extra_ca_certs/
$ tree quay/config/
├── config.yaml
├── extra_ca_certs
│   ├── storage.crt

Copy to Clipboard

Toggle word wrap

Obtain the Quay container’s CONTAINER ID with podman ps:

sudo podman ps

$ sudo podman ps
CONTAINER ID        IMAGE                                COMMAND                  CREATED             STATUS              PORTS
5a3e82c4a75f        <registry>/<repo>/quay:v3.6.8 "/sbin/my_init"          24 hours ago        Up 18 hours         0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 443/tcp   grave_keller

Copy to Clipboard

Toggle word wrap

Restart the container with that ID:
```
sudo podman restart 5a3e82c4a75f
```
```
$ sudo podman restart 5a3e82c4a75f
```
Copy to Clipboard Toggle word wrap

Examine the certificate copied into the container namespace:

sudo podman exec -it 5a3e82c4a75f cat /etc/ssl/certs/storage.pem
-----BEGIN CERTIFICATE-----
MIIDTTCCAjWgAwIBAgIJAMVr9ngjJhzbMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNV

$ sudo podman exec -it 5a3e82c4a75f cat /etc/ssl/certs/storage.pem
-----BEGIN CERTIFICATE-----
MIIDTTCCAjWgAwIBAgIJAMVr9ngjJhzbMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNV

Copy to Clipboard

Toggle word wrap

2.13. LDAP configuration fields
Copy link

Expand

Table 2.11. LDAP configuration
Field	Type	Description
AUTHENTICATION_TYPE (Required)	String	Must be set to `LDAP`
FEATURE_TEAM_SYNCING	Boolean	Whether to allow for team membership to be synced from a backing group in the authentication engine (LDAP or Keystone) Default: `true`
FEATURE_NONSUPERUSER_TEAM_SYNCING_SETUP	Boolean	If enabled, non-superusers can setup syncing on teams using LDAP Default: `false`

LDAP_ADMIN_DN	String	The admin DN for LDAP authentication.
LDAP_ADMIN_PASSWD	String	The admin password for LDAP authentication.
LDAP_ALLOW_INSECURE_FALLBACK	Boolean	Whether or not to allow SSL insecure fallback for LDAP authentication.
LDAP_BASE_DN	Array of String	The base DN for LDAP authentication.
LDAP_EMAIL_ATTR	String	The email attribute for LDAP authentication.
LDAP_UID_ATTR	String	The uid attribute for LDAP authentication.
LDAP_URI	String	The LDAP URI.
LDAP_USER_FILTER	String	The user filter for LDAP authentication.
LDAP_USER_RDN	Array of String	The user RDN for LDAP authentication.
TEAM_RESYNC_STALE_TIME	String	If team syncing is enabled for a team, how often to check its membership and resync if necessary Pattern: `^[0-9]+(w\|m\|d\|h\|s)$` Example: `2h` Default: `30m`

2.13.1. LDAP configuration example
Copy link

$QUAY/config/config.yaml

AUTHENTICATION_TYPE: LDAP
...
LDAP_ADMIN_DN: uid=testuser,ou=Users,o=orgid,dc=jumpexamplecloud,dc=com
LDAP_ADMIN_PASSWD: samplepassword
LDAP_ALLOW_INSECURE_FALLBACK: false
LDAP_BASE_DN:
    - o=orgid
    - dc=example
    - dc=com
LDAP_EMAIL_ATTR: mail
LDAP_UID_ATTR: uid
LDAP_URI: ldap://ldap.example.com:389
LDAP_USER_RDN:
    - ou=Users

AUTHENTICATION_TYPE: LDAP
...
LDAP_ADMIN_DN: uid=testuser,ou=Users,o=orgid,dc=jumpexamplecloud,dc=com
LDAP_ADMIN_PASSWD: samplepassword
LDAP_ALLOW_INSECURE_FALLBACK: false
LDAP_BASE_DN:
    - o=orgid
    - dc=example
    - dc=com
LDAP_EMAIL_ATTR: mail
LDAP_UID_ATTR: uid
LDAP_URI: ldap://ldap.example.com:389
LDAP_USER_RDN:
    - ou=Users

Copy to Clipboard

Toggle word wrap

2.14. Mirroring configuration fields
Copy link

Expand

Table 2.12. Mirroring configuration
Field	Type	Description
FEATURE_REPO_MIRROR	Boolean	Enable or disable repository mirroring Default: `false`

REPO_MIRROR_INTERVAL	Number	The number of seconds between checking for repository mirror candidates Default: 30
REPO_MIRROR_SERVER_HOSTNAME	String	Replaces the `SERVER_HOSTNAME` as the destination for mirroring. Default: None Example: `openshift-quay-service`
REPO_MIRROR_TLS_VERIFY	Boolean	Require HTTPS and verify certificates of Quay registry during mirror. Default: `false`

2.15. Security scanner configuration fields
Copy link

Expand

Table 2.13. Security scanner configuration
Field	Type	Description
FEATURE_SECURITY_SCANNER	Boolean	Enable or disable the security scanner Default: `false`
FEATURE_SECURITY_NOTIFICATIONS	Boolean	If the security scanner is enabled, turn on or turn off security notifications Default: `false`
SECURITY_SCANNER_V4_REINDEX_THRESHOLD	String	This parameter is used to determine the minimum time, in seconds, to wait before re-indexing a manifest that has either previously failed or has changed states since the last indexing. The data is calculated from the `last_indexed datetime` in the manifestsecuritystatus table. This parameter is used to avoid trying to re-index every failed manifest on every indexing run. The default time to re-index is 300 seconds.
SECURITY_SCANNER_V4_ENDPOINT	String	The endpoint for the V4 security scanner Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.101:6060`
SECURITY_SCANNER_V4_PSK	String	The generated pre-shared key (PSK) for Clair
SECURITY_SCANNER_INDEXING_INTERVAL	Number	The number of seconds between indexing intervals in the security scanner Default: 30
SECURITY_SCANNER_ENDPOINT	String	The endpoint for the V2 security scanner Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.100:6060`
SECURITY_SCANNER_INDEXING_INTERVAL	String	This parameter is used to determine the number of seconds between indexing intervals in the security scanner. When indexing is triggered, Red Hat Quay will query its database for manifests that must be indexed by Clair. These include manifests that have not yet been indexed and manifests that previously failed indexing.

The following is a special case for re-indexing:

When Clair v4 indexes a manifest, the result should be deterministic. For example, the same manifest should produce the same index report. This is true until the scanners are changed, as using different scanners will produce different information relating to a specific manifest to be returned in the report. Because of this, Clair v4 exposes a state representation of the indexing engine (/indexer/api/v1/index_state) to determine whether the scanner configuration has been changed.

Red Hat Quay leverages this index state by saving it to the index report when parsing to Quay’s database. If this state has changed since the manifest was previously scanned, Quay will attempt to re-index that manifest during the periodic indexing process.

By default this parameter is set to 30 seconds. Users might decrease the time if they want the indexing process to run more frequently, for example, if they did not want to wait 30 seconds to see security scan results in the UI after pushing a new tag. Users can also change the parameter if they want more control over the request pattern to Clair and the pattern of database operations being performed on the Quay database.

2.16. OCI and Helm configuration
Copy link

Support for Helm is now supported under the FEATURE_GENERAL_OCI_SUPPORT property. If you need to explicitly enable the feature, for example, if it has previously been disabled or if you have upgraded from a version where it is not enabled by default, you need to add two properties in the Quay configuration to enable the use of OCI artifacts:

FEATURE_GENERAL_OCI_SUPPORT: true
FEATURE_HELM_OCI_SUPPORT: true

FEATURE_GENERAL_OCI_SUPPORT: true
FEATURE_HELM_OCI_SUPPORT: true

Copy to Clipboard

Toggle word wrap

Expand

Table 2.14. OCI and Helm configuration
Field	Type	Description
FEATURE_GENERAL_OCI_SUPPORT	Boolean	Enable support for OCI artifacts Default: True
FEATURE_HELM_OCI_SUPPORT	Boolean	Enable support for Helm artifacts Default: True

Important

As of Red Hat Quay 3.6, FEATURE_HELM_OCI_SUPPORT has been deprecated and will be removed in a future version of Red Hat Quay. In Red Hat Quay 3.6, Helm artifacts are supported by default and included under the FEATURE_GENERAL_OCI_SUPPORT property. Users are no longer required to update their config.yaml files to enable support.

2.17. Action log configuration fields
Copy link

2.17.1. Action log storage configuration
Copy link

Expand

Table 2.15. Action log storage configuration
Field	Type	Description
FEATURE_LOG_EXPORT	Boolean	Whether to allow exporting of action logs Default: `True`

LOGS_MODEL	String	Enable or disable the security scanner Values: One of `database`, `transition_reads_both_writes_es`, `elasticsearch` Default: `database`
LOGS_MODEL_CONFIG	Object	Logs model config for action logs

LOGS_MODEL_CONFIG [object]: Logs model config for action logs
- elasticsearch_config [object]: Elasticsearch cluster configuration
  - access_key [string]: Elasticsearch user (or IAM key for AWS ES)
    Example: some_string
  - host [string]: Elasticsearch cluster endpoint
    Example: host.elasticsearch.example
  - index_prefix [string]: Elasticsearch’s index prefix
    Example: logentry_
  - index_settings [object]: Elasticsearch’s index settings
  - use_ssl [boolean]: Use ssl for Elasticsearch. Defaults to True
    Example: True
  - secret_key [string]: Elasticsearch password (or IAM secret for AWS ES)
    Example: some_secret_string
  - aws_region [string]: Amazon web service region
    Example: us-east-1
  - port [number]: Elasticsearch cluster endpoint port
    Example: 1234
- kinesis_stream_config [object]: AWS Kinesis Stream configuration
  - aws_secret_key [string]: AWS secret key
    Example: some_secret_key
  - stream_name [string]: Kinesis stream to send action logs to
    Example: logentry-kinesis-stream
  - aws_access_key [string]: AWS access key
    Example: some_access_key
  - retries [number]: Max number of attempts made on a single request
    Example: 5
  - read_timeout [number]: Number of seconds before timeout when reading from a connection
    Example: 5
  - max_pool_connections [number]: The maximum number of connections to keep in a connection pool
    Example: 10
  - aws_region [string]: AWS region
    Example: us-east-1
  - connect_timeout [number]: Number of seconds before timeout when attempting to make a connection
    Example: 5
- producer [string]: Logs producer if logging to Elasticsearch
  - enum: kafka, elasticsearch, kinesis_stream
  - Example: kafka
- kafka_config [object]: Kafka cluster configuration
  - topic [string]: Kafka topic to publish log entries to
    Example: logentry
  - bootstrap_servers [array]: List of Kafka brokers to bootstrap the client from
  - max_block_seconds [number]: Max number of seconds to block during a send(), either because the buffer is full or metadata unavailable
    Example: 10

2.17.2. Action log rotation and archiving configuration
Copy link

Expand

Table 2.16. Action log rotation and archiving configuration
Field	Type	Description
FEATURE_ACTION_LOG_ROTATION	Boolean	Enabling log rotation and archival will move all logs older than 30 days to storage Default: `false`

ACTION_LOG_ARCHIVE_LOCATION	String	If action log archiving is enabled, the storage engine in which to place the archived data Example:: `s3_us_east`
ACTION_LOG_ARCHIVE_PATH	String	If action log archiving is enabled, the path in storage in which to place the archived data Example: `archives/actionlogs`
ACTION_LOG_ROTATION_THRESHOLD	String	The time interval after which to rotate logs Example: `30d`

2.18. Build logs
Copy link

Expand

Table 2.17. Build logs
Field	Type	Description
FEATURE_READER_BUILD_LOGS	Boolean	If set to true, build logs may be read by those with read access to the repo, rather than only write access or admin access. Default: `False`

LOG_ARCHIVE_LOCATION	String	The storage location, defined in DISTRIBUTED_STORAGE_CONFIG, in which to place the archived build logs Example: `s3_us_east`
LOG_ARCHIVE_PATH	String	The path under the configured storage engine in which to place the archived build logs in JSON form Example: `archives/buildlogs`

2.19. Dockerfile build triggers fields
Copy link

Expand

Table 2.18. Dockerfile build support
Field	Type	Description
FEATURE_BUILD_SUPPORT	Boolean	Whether to support Dockerfile build. Default: False
SUCCESSIVE_TRIGGER_FAILURE_DISABLE_THRESHOLD	Number	If not None, the number of successive failures that can occur before a build trigger is automatically disabled Default: 100
SUCCESSIVE_TRIGGER_INTERNAL_ERROR_DISABLE_THRESHOLD	Number	If not None, the number of successive internal errors that can occur before a build trigger is automatically disabled Default: 5

2.19.1. GitHub build triggers
Copy link

Expand

Table 2.19. GitHub build triggers
Field	Type	Description
FEATURE_GITHUB_BUILD	Boolean	Whether to support GitHub build triggers Default: False

GITHUB_TRIGGER_CONFIG	Object	Configuration for using GitHub (Enterprise) for build triggers
.GITHUB_ENDPOINT (Required)	String	The endpoint for GitHub (Enterprise) Example: `https://github.com/`
.API_ENDPOINT	String	The endpoint of the GitHub (Enterprise) API to use. Must be overridden for `github.com` Example: `https://api.github.com/`
.CLIENT_ID (Required)	String	The registered client ID for this Red Hat Quay instance; this cannot be shared with GITHUB_LOGIN_CONFIG.
.CLIENT_SECRET (Required)	String	The registered client secret for this Red Hat Quay instance.

2.19.2. BitBucket build triggers
Copy link

Expand

Table 2.20. BitBucket build triggers
Field	Type	Description
FEATURE_BITBUCKET_BUILD	Boolean	Whether to support Bitbucket build triggers Default: False

BITBUCKET_TRIGGER_CONFIG	Object	Configuration for using BitBucket for build triggers
.CONSUMER_KEY (Required)	String	The registered consumer key (client ID) for this Quay instance
.CONSUMER_SECRET (Required)	String	The registered consumer secret (client secret) for this Quay instance

2.19.3. GitLab build triggers
Copy link

Expand

Table 2.21. GitLab build triggers
Field	Type	Description
FEATURE_GITLAB_BUILD	Boolean	Whether to support GitLab build triggers Default: False

GITLAB_TRIGGER_CONFIG	Object	Configuration for using Gitlab for build triggers
.GITLAB_ENDPOINT (Required)	String	The endpoint at which Gitlab (Enterprise) is running
.CLIENT_ID (Required)	String	The registered client ID for this Quay instance
.CLIENT_SECRET (Required)	String	The registered client secret for this Quay instance

2.20. OAuth configuration
Copy link

Expand

Table 2.22. OAuth fields
Field	Type	Description
DIRECT_OAUTH_CLIENTID_WHITELIST	Array of String	A list of client IDs for Quay-managed applications that are allowed to perform direct OAuth approval without user approval.

2.20.1. GitHub OAuth
Copy link

Expand

Table 2.23. GitHub OAuth fields
Field	Type	Description
FEATURE_GITHUB_LOGIN	Boolean	Whether GitHub login is supported **Default: `False`
GITHUB_LOGIN_CONFIG	Object	Configuration for using GitHub (Enterprise) as an external login provider.
.ALLOWED_ORGANIZATIONS	Array of String	The names of the GitHub (Enterprise) organizations whitelisted to work with the ORG_RESTRICT option.
.API_ENDPOINT	String	The endpoint of the GitHub (Enterprise) API to use. Must be overridden for github.com Example: `https://api.github.com/`
.CLIENT_ID (Required)	String	The registered client ID for this Red Hat Quay instance; cannot be shared with GITHUB_TRIGGER_CONFIG Example: `0e8dbe15c4c7630b6780`
.CLIENT_SECRET (Required)	String	The registered client secret for this Red Hat Quay instance Example: `e4a58ddd3d7408b7aec109e85564a0d153d3e846`
.GITHUB_ENDPOINT (Required)	String	The endpoint for GitHub (Enterprise) Example: `https://github.com/`
.ORG_RESTRICT	Boolean	If true, only users within the organization whitelist can login using this provider.

2.20.2. Google OAuth
Copy link

Expand

Table 2.24. Google OAuth fields
Field	Type	Description
FEATURE_GOOGLE_LOGIN	Boolean	Whether Google login is supported **Default: `False`
GOOGLE_LOGIN_CONFIG	Object	Configuration for using Google for external authentication
.CLIENT_ID (Required)	String	The registered client ID for this Red Hat Quay instance Example: `0e8dbe15c4c7630b6780`
.CLIENT_SECRET (Required)	String	The registered client secret for this Red Hat Quay instance Example: e4a58ddd3d7408b7aec109e85564a0d153d3e846

2.21. Configuring nested repositories
Copy link

With Red Hat Quay 3.6, support for nested repository path names has been added under the FEATURE_EXTENDED_REPOSITORY_NAMES property. This optional configuration must be manually added to the config.yaml by the user to enable support. Enablement allows the use of / in repository names.

FEATURE_EXTENDED_REPOSITORY_NAMES: true

FEATURE_EXTENDED_REPOSITORY_NAMES: true

Copy to Clipboard

Toggle word wrap

Expand

Table 2.25. OCI and nested repositories configuration
Field	Type	Description
FEATURE_EXTENDED_REPOSITORY_NAMES	Boolean	Enable support for nested repositories Default: False

2.22. Adding other OCI media types to Quay
Copy link

Helm, cosign, and ztsd compression scheme artifacts are built into Red Hat Quay 3.6 by default. For any other OCI media type that is not supported by default, you can add them to the ALLOWED_OCI_ARTIFACT_TYPES configuration in Quay’s config.yaml using the following format:

ALLOWED_OCI_ARTIFACT_TYPES:
  <oci config type 1>:
  - <oci layer type 1>
  - <oci layer type 2>

  <oci config type 2>:
  - <oci layer type 3>
  - <oci layer type 4>
...

ALLOWED_OCI_ARTIFACT_TYPES:
  <oci config type 1>:
  - <oci layer type 1>
  - <oci layer type 2>

  <oci config type 2>:
  - <oci layer type 3>
  - <oci layer type 4>
...

Copy to Clipboard

Toggle word wrap

For example, you can add Singularity (SIF) support by adding the following to your config.yaml:

...
ALLOWED_OCI_ARTIFACT_TYPES:
  application/vnd.oci.image.config.v1+json
  - application/vnd.dev.cosign.simplesigning.v1+json
  application/vnd.cncf.helm.config.v1+json
  - application/tar+gzip
  application/vnd.sylabs.sif.config.v1+json
  - application/vnd.sylabs.sif.layer.v1+tar
...

...
ALLOWED_OCI_ARTIFACT_TYPES:
  application/vnd.oci.image.config.v1+json
  - application/vnd.dev.cosign.simplesigning.v1+json
  application/vnd.cncf.helm.config.v1+json
  - application/tar+gzip
  application/vnd.sylabs.sif.config.v1+json
  - application/vnd.sylabs.sif.layer.v1+tar
...

Copy to Clipboard

Toggle word wrap

Note

When adding OCI media types that are not configured by default, users will also need to manually add support for cosign and Helm if desired. The ztsd compression scheme is supported by default, so users will not need to add that OCI media type to their config.yaml to enable support.

2.23. Mail configuration
Copy link

Expand

Table 2.26. Mail fields
Field	Type	Description
FEATURE_MAILING	Boolean	Whether emails are enabled Default: `False`

MAIL_DEFAULT_SENDER	String	If specified, the e-mail address used as the `from` when Red Hat Quay sends e-mails. If none, defaults to `support@quay.io` Example: `support@example.com`
MAIL_PASSWORD	String	The SMTP password to use when sending e-mails
MAIL_PORT	Number	The SMTP port to use. If not specified, defaults to 587.
MAIL_SERVER	String	The SMTP server to use for sending e-mails. Only required if FEATURE_MAILING is set to true. Example: `smtp.example.com`
MAIL_USERNAME	String	The SMTP username to use when sending e-mails
MAIL_USE_TLS	Boolean	If specified, whether to use TLS for sending e-mails Default: `True`

2.24. User configuration fields
Copy link

Expand

Table 2.27. User configuration
Field	Type	Description
FEATURE_SUPER_USERS	Boolean	Whether superusers are supported Default: `true`
FEATURE_USER_CREATION	Boolean	Whether users can be created (by non-superusers) Default: `true`
FEATURE_USER_LAST_ACCESSED	Boolean	Whether to record the last time a user was accessed Default: `true`
FEATURE_USER_LOG_ACCESS	Boolean	If set to true, users will have access to audit logs for their namespace Default: `false`
FEATURE_USER_METADATA	Boolean	Whether to collect and support user metadata Default: `false`
FEATURE_USERNAME_CONFIRMATION	Boolean	If set to true, users can confirm their generated usernames Default: `true`
FEATURE_USER_RENAME	Boolean	If set to true, users can rename their own namespace Default: `false`
FEATURE_INVITE_ONLY_USER_CREATION	Boolean	Whether users being created must be invited by another user Default: `false`

FRESH_LOGIN_TIMEOUT	String	The time after which a fresh login requires users to re-enter their password Example: `5m`
USERFILES_LOCATION	String	ID of the storage engine in which to place user-uploaded files Example: `s3_us_east`
USERFILES_PATH	String	Path under storage in which to place user-uploaded files Example: `userfiles`
USER_RECOVERY_TOKEN_LIFETIME	String	The length of time a token for recovering a user accounts is valid Pattern: `^[0-9]+(w\|m\|d\|h\|s)$` Default: `30m`

2.25. Recaptcha configuration
Copy link

Expand

Table 2.28. Recaptcha fields
Field	Type	Description
FEATURE_RECAPTCHA	Boolean	Whether Recaptcha is necessary for user login and recovery Default: False

RECAPTCHA_SECRET_KEY	String	If recaptcha is enabled, the secret key for the Recaptcha service
RECAPTCHA_SITE_KEY	String	If recaptcha is enabled, the site key for the Recaptcha service

2.26. ACI configuration
Copy link

Expand

Table 2.29. ACI configuration
Field	Type	Description
FEATURE_ACI_CONVERSION	Boolean	Whether to enable conversion to ACIs Default: False

GPG2_PRIVATE_KEY_FILENAME	String	The filename of the private key used to decrypte ACIs
GPG2_PRIVATE_KEY_NAME	String	The name of the private key used to sign ACIs
GPG2_PUBLIC_KEY_FILENAME	String	The filename of the public key used to encrypt ACIs

2.27. JTW configuration
Copy link

Expand

Table 2.30. JWT configuration
Field	Type	Description
JWT_AUTH_ISSUER	String	The endpoint for JWT users Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.101:6060`
JWT_GETUSER_ENDPOINT	String	The endpoint for JWT users Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.101:6060`
JWT_QUERY_ENDPOINT	String	The endpoint for JWT queries Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.101:6060`
JWT_VERIFY_ENDPOINT	String	The endpoint for JWT verification Pattern: `^http(s)?://(.)+$` Example: `http://192.168.99.101:6060`

2.28. App tokens
Copy link

Expand

Table 2.31. App tokens configuration
Field	Type	Description
FEATURE_APP_SPECIFIC_TOKENS	Boolean	If enabled, users can create tokens for use by the Docker CLI Default: True

APP_SPECIFIC_TOKEN_EXPIRATION	String	The expiration for external app tokens. Default None Pattern: `^[0-9]+(w\|m\|d\|h\|s)$`
EXPIRED_APP_SPECIFIC_TOKEN_GC	String	Duration of time expired external app tokens will remain before being garbage collected Default: 1d

2.29. Miscellaneous fields
Copy link

Expand

Table 2.32. Miscellaneous fields
Field	Type	Description
ALLOW_PULLS_WITHOUT_STRICT_LOGGING	String	If true, pulls will still succeed even if the pull audit log entry cannot be written . This is useful if the database is in a read-only state and it is desired for pulls to continue during that time. Default: False
AVATAR_KIND	String	The types of avatars to display, either generated inline (local) or Gravatar (gravatar) Values: local, gravatar
BROWSER_API_CALLS_XHR_ONLY	Boolean	If enabled, only API calls marked as being made by an XHR will be allowed from browsers Default: True
DEFAULT_NAMESPACE_MAXIMUM_BUILD_COUNT	Number	The default maximum number of builds that can be queued in a namespace. Default: None
ENABLE_HEALTH_DEBUG_SECRET	String	If specified, a secret that can be given to health endpoints to see full debug info when not authenticated as a superuser
EXTERNAL_TLS_TERMINATION	Boolean	Set to true if TLS is supported, but terminated at a layer before Quay
FRESH_LOGIN_TIMEOUT	String	The time after which a fresh login requires users to re-enter their password Example: `5m`
HEALTH_CHECKER	String	The configured health check Example: `('RDSAwareHealthCheck', {'access_key': 'foo', 'secret_key': 'bar'})`
PROMETHEUS_NAMESPACE	String	The prefix applied to all exposed Prometheus metrics Default: `quay`
PUBLIC_NAMESPACES	Array of String	If a namespace is defined in the public namespace list, then it will appear on all users' repository list pages, regardless of whether the user is a member of the namespace. Typically, this is used by an enterprise customer in configuring a set of "well-known" namespaces.
REGISTRY_STATE	String	The state of the registry Values: `normal` or `read-only`
SEARCH_MAX_RESULT_PAGE_COUNT	Number	Maximum number of pages the user can paginate in search before they are limited Default: 10
SEARCH_RESULTS_PER_PAGE	Number	Number of results returned per page by search page Default: 10
V1_PUSH_WHITELIST	Array of String	The array of namespace names that support V1 push if FEATURE_RESTRICTED_V1_PUSH is set to true
V2_PAGINATION_SIZE	Number	The number of results returned per page in V2 registry APIs
WEBHOOK_HOSTNAME_BLACKLIST	Array of String	The set of hostnames to disallow from webhooks when validating, beyond localhost
CREATE_PRIVATE_REPO_ON_PUSH	Boolean	Whether new repositories created by push are set to private visibility Default: True
CREATE_NAMESPACE_ON_PUSH	Boolean	Whether new push to a non-existent organization creates it Default: False
NON_RATE_LIMITED_NAMESPACES	Array of String	If rate limiting has been enabled using `FEATURE_RATE_LIMITS`, you can override it for specific namespace that require unlimited access.

2.30. Legacy configuration fields
Copy link

Some fields are deprecated or obsolete:

Expand

Table 2.33. Legacy fields
Field	Type	Description
FEATURE_BLACKLISTED_EMAILS	Boolean	If set to true, no new User accounts may be created if their email domain is blacklisted
BLACKLISTED_EMAIL_DOMAINS	Array of String	The list of email-address domains that is used if FEATURE_BLACKLISTED_EMAILS is set to true Example: `"example.com", "example.org"`
BLACKLIST_V2_SPEC	String	The Docker CLI versions to which Red Hat Quay will respond that V2 is unsupported Example: `<1.8.0` Default: `<1.6.0`
DOCUMENTATION_ROOT	String	Root URL for documentation links
SECURITY_SCANNER_V4_NAMESPACE_WHITELIST	String	The namespaces for which the security scanner should be enabled

2.1. Required configuration fieldsCopy linkLink copied to clipboard!

2.2. Automation optionsCopy linkLink copied to clipboard!

2.3. Optional configuration fieldsCopy linkLink copied to clipboard!

2.4. General required fieldsCopy linkLink copied to clipboard!

2.5. Database configurationCopy linkLink copied to clipboard!

2.5.1. Database URICopy linkLink copied to clipboard!

2.5.2. Database connection argumentsCopy linkLink copied to clipboard!

2.5.2.1. PostgreSQL SSL connection argumentsCopy linkLink copied to clipboard!

2.5.2.2. MySQL SSL connection argumentsCopy linkLink copied to clipboard!

2.6. Image storageCopy linkLink copied to clipboard!

2.6.1. Image storage featuresCopy linkLink copied to clipboard!

2.6.2. Image storage configuration fieldsCopy linkLink copied to clipboard!

2.6.3. Local storageCopy linkLink copied to clipboard!

2.6.4. OCS/NooBaaCopy linkLink copied to clipboard!

2.6.5. Ceph / RadosGW Storage / Hitachi HCPCopy linkLink copied to clipboard!

2.6.6. AWS S3 storageCopy linkLink copied to clipboard!

2.6.7. Google cloud storageCopy linkLink copied to clipboard!

2.6.8. Azure storageCopy linkLink copied to clipboard!

2.6.9. Swift storageCopy linkLink copied to clipboard!

2.7. Redis configuration fieldsCopy linkLink copied to clipboard!

2.7.1. Build logsCopy linkLink copied to clipboard!

2.7.2. User eventsCopy linkLink copied to clipboard!

2.7.3. Example redis configurationCopy linkLink copied to clipboard!

2.8. Tag expiration optionsCopy linkLink copied to clipboard!

2.9. Pre-configuring Quay for automationCopy linkLink copied to clipboard!

2.9.1. Allowing the API to create the first userCopy linkLink copied to clipboard!

2.9.2. Enabling general API accessCopy linkLink copied to clipboard!

2.9.3. Adding a super userCopy linkLink copied to clipboard!

2.9.4. Restricting user creationCopy linkLink copied to clipboard!

2.9.5. Suggested configuration for automationCopy linkLink copied to clipboard!

2.9.6. Deploying the Operator using the initial configurationCopy linkLink copied to clipboard!

2.9.7. Using the API to create the first userCopy linkLink copied to clipboard!

2.9.7.1. Invoking the APICopy linkLink copied to clipboard!

2.9.7.2. Using the OAuth tokenCopy linkLink copied to clipboard!

2.9.7.2.1. Create organizationCopy linkLink copied to clipboard!

2.9.7.2.2. Get organization detailsCopy linkLink copied to clipboard!

2.10. Basic configurationCopy linkLink copied to clipboard!

2.11. SSL configuration fieldsCopy linkLink copied to clipboard!

2.11.1. Configuring SSLCopy linkLink copied to clipboard!

2.12. Adding TLS Certificates to the Red Hat Quay ContainerCopy linkLink copied to clipboard!

2.12.1. Add TLS certificates to Red Hat QuayCopy linkLink copied to clipboard!

2.13. LDAP configuration fieldsCopy linkLink copied to clipboard!

2.13.1. LDAP configuration exampleCopy linkLink copied to clipboard!

2.14. Mirroring configuration fieldsCopy linkLink copied to clipboard!

2.15. Security scanner configuration fieldsCopy linkLink copied to clipboard!

2.16. OCI and Helm configurationCopy linkLink copied to clipboard!

2.17. Action log configuration fieldsCopy linkLink copied to clipboard!

2.17.1. Action log storage configurationCopy linkLink copied to clipboard!

2.17.2. Action log rotation and archiving configurationCopy linkLink copied to clipboard!

2.18. Build logsCopy linkLink copied to clipboard!

2.19. Dockerfile build triggers fieldsCopy linkLink copied to clipboard!

2.19.1. GitHub build triggersCopy linkLink copied to clipboard!

2.19.2. BitBucket build triggersCopy linkLink copied to clipboard!

2.19.3. GitLab build triggersCopy linkLink copied to clipboard!

2.20. OAuth configurationCopy linkLink copied to clipboard!

2.20.1. GitHub OAuthCopy linkLink copied to clipboard!

2.20.2. Google OAuthCopy linkLink copied to clipboard!

2.21. Configuring nested repositoriesCopy linkLink copied to clipboard!

2.22. Adding other OCI media types to QuayCopy linkLink copied to clipboard!

2.23. Mail configurationCopy linkLink copied to clipboard!

2.24. User configuration fieldsCopy linkLink copied to clipboard!

2.25. Recaptcha configurationCopy linkLink copied to clipboard!

2.26. ACI configurationCopy linkLink copied to clipboard!

2.27. JTW configurationCopy linkLink copied to clipboard!

2.28. App tokensCopy linkLink copied to clipboard!

2.29. Miscellaneous fieldsCopy linkLink copied to clipboard!

2.30. Legacy configuration fieldsCopy linkLink copied to clipboard!

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

2.1. Required configuration fields
Copy link

2.2. Automation options
Copy link

2.3. Optional configuration fields
Copy link

2.4. General required fields
Copy link

2.5. Database configuration
Copy link

2.5.1. Database URI
Copy link

2.5.2. Database connection arguments
Copy link

2.5.2.1. PostgreSQL SSL connection arguments
Copy link

2.5.2.2. MySQL SSL connection arguments
Copy link

2.6. Image storage
Copy link

2.6.1. Image storage features
Copy link

2.6.2. Image storage configuration fields
Copy link

2.6.3. Local storage
Copy link

2.6.4. OCS/NooBaa
Copy link

2.6.5. Ceph / RadosGW Storage / Hitachi HCP
Copy link

2.6.6. AWS S3 storage
Copy link

2.6.7. Google cloud storage
Copy link

2.6.8. Azure storage
Copy link

2.6.9. Swift storage
Copy link

2.7. Redis configuration fields
Copy link

2.7.1. Build logs
Copy link

2.7.2. User events
Copy link

2.7.3. Example redis configuration
Copy link

2.8. Tag expiration options
Copy link

2.9. Pre-configuring Quay for automation
Copy link

2.9.1. Allowing the API to create the first user
Copy link

2.9.2. Enabling general API access
Copy link

2.9.3. Adding a super user
Copy link

2.9.4. Restricting user creation
Copy link

2.9.5. Suggested configuration for automation
Copy link

2.9.6. Deploying the Operator using the initial configuration
Copy link

2.9.7. Using the API to create the first user
Copy link

2.9.7.1. Invoking the API
Copy link

2.9.7.2. Using the OAuth token
Copy link

2.9.7.2.1. Create organization
Copy link

2.9.7.2.2. Get organization details
Copy link

2.10. Basic configuration
Copy link

2.11. SSL configuration fields
Copy link

2.11.1. Configuring SSL
Copy link

2.12. Adding TLS Certificates to the Red Hat Quay Container
Copy link

2.12.1. Add TLS certificates to Red Hat Quay
Copy link

2.13. LDAP configuration fields
Copy link

2.13.1. LDAP configuration example
Copy link

2.14. Mirroring configuration fields
Copy link

2.15. Security scanner configuration fields
Copy link

2.16. OCI and Helm configuration
Copy link

2.17. Action log configuration fields
Copy link

2.17.1. Action log storage configuration
Copy link

2.17.2. Action log rotation and archiving configuration
Copy link

2.18. Build logs
Copy link

2.19. Dockerfile build triggers fields
Copy link

2.19.1. GitHub build triggers
Copy link

2.19.2. BitBucket build triggers
Copy link

2.19.3. GitLab build triggers
Copy link

2.20. OAuth configuration
Copy link

2.20.1. GitHub OAuth
Copy link

2.20.2. Google OAuth
Copy link

2.21. Configuring nested repositories
Copy link

2.22. Adding other OCI media types to Quay
Copy link

2.23. Mail configuration
Copy link

2.24. User configuration fields
Copy link

2.25. Recaptcha configuration
Copy link

2.26. ACI configuration
Copy link

2.27. JTW configuration
Copy link

2.28. App tokens
Copy link

2.29. Miscellaneous fields
Copy link

2.30. Legacy configuration fields
Copy link