Chapter 9. Integrating Red Hat Quay into OpenShift Container Platform with the Quay Bridge Operator
Using the Quay Bridge Operator, you can replace the integrated container registry in OpenShift Container Platform with a Red Hat Quay registry. By doing this, your integrated OpenShift Container Platform registry becomes a highly available, enterprise-grade Red Hat Quay registry with enhanced role based access control (RBAC) features.
The primary goal of the Quay Bridge Operator is to duplicate the features of the integrated OpenShift Container Platform registry in the new Red Hat Quay registry. The features enabled with the Quay Bridge Operator include:
- Synchronizing OpenShift Container Platform namespaces as Red Hat Quay organizations.
- Creating robot accounts for each default namespace service account.
-
Creating secrets for each created robot account, and associating each robot secret to a service account as
Mountable
andImage Pull Secret
. - Synchronizing OpenShift Container Platform image streams as Red Hat Quay repositories.
- Automatically rewriting new builds making use of image streams to output to Red Hat Quay.
- Automatically importing an image stream tag once a build completes.
By using the following procedures, you will enable bi-directional communication between your Red Hat Quay and OpenShift Container Platform clusters.
9.1. Setting up Red Hat Quay for the Quay Bridge Operator
In this procedure, you will create a dedicated Red Hat Quay organization, and from a new application created within that organization you will generate an OAuth token to be used with the Quay Bridge Operator in OpenShift Container Platform.
Procedure
- Log in to Red Hat Quay through the web UI.
- Select the organization for which the external application will be configured.
- On the navigation pane, select Applications.
-
Select Create New Application and enter a name for the new application, for example,
openshift
. -
On the OAuth Applications page, select your application, for example,
openshift
. - On the navigation pane, select Generate Token.
Select the following fields:
- Administer Organization
- Administer Repositories
- Create Repositories
- View all visible repositories
- Read/Write to any accessible repositories
- Administer User
- Read User Information
- Review the assigned permissions.
- Select Authorize Application and then confirm confirm the authorization by selecting Authorize Application.
Save the generated access token.
ImportantRed Hat Quay does not offer token management. You cannot list tokens, delete tokens, or modify tokens. The generated access token is only shown once and cannot be re-obtained after closing the page.
9.2. Installing the Quay Bridge Operator on OpenShift Container Platform
In this procedure, you will install the Quay Bridge Operator on OpenShift Container Platform.
Prerequiites
- You have set up Red Hat Quay and obtained an Access Token.
- An OpenShift Container Platform 4.6 or greater environment for which you have cluster administrator permissions.
Procedure
-
Open the Administrator perspective of the web console and navigate to Operators
OperatorHub on the navigation pane. -
Search for
Quay Bridge Operator
, click the Quay Bridge Operator title, and then click Install. - Select the version to install, for example, stable-3.7, and then click Install.
-
Click View Operator when the installation finishes to go to the Quay Bridge Operator’s Details page. Alternatively, you can click Installed Operators
Red Hat Quay Bridge Operator to go to the Details page.
9.3. Creating an OpenShift Container Platform secret for the OAuth token
In this procedure, you will add the previously obtained access token to communicate with your Red Hat Quay deployment. The access token will be stored within OpenShift Container Platform as a secret.
Prerequisites
- You have set up Red Hat Quay and obtained an access token.
- You have deployed the Quay Bridge Operator on OpenShift Container Platform.
- An OpenShift Container Platform 4.6 or greater environment for which you have cluster administrator permissions.
- You have installed the OpenShift CLI (oc).
Procedure
Create a secret that contains the access token in the
openshift-operators
namespace:$ oc create secret -n openshift-operators generic <secret-name> --from-literal=token=<access_token>
9.4. Creating the QuayIntegration custom resource
In this procedure, you will create a QuayIntegration
custom resource, which can be completed from either the web console or from the command line.
Prerequisites
- You have set up Red Hat Quay and obtained an access token.
- You have deployed the Quay Bridge Operator on OpenShift Container Platform.
- An OpenShift Container Platform 4.6 or greater environment for which you have cluster administrator permissions.
- Optional: You have installed the OpenShift CLI (oc).
9.4.1. Optional: Creating the QuayIntegration custom resource using the CLI
Follow this procedure to create the QuayIntegration
custom resource using the command line.
Procedure
Create a
quay-integration.yaml
:$ touch quay-integration.yaml
Use the following configuration for a minimal deployment of the
QuayIntegration
custom resource:apiVersion: quay.redhat.com/v1 kind: QuayIntegration metadata: name: example-quayintegration spec: clusterID: openshift 1 credentialsSecret: namespace: openshift-operators name: quay-integration2 quayHostname: https://<QUAY_URL> 3 insecureRegistry: false 4
- 1
- The clusterID value should be unique across the entire ecosystem. This value is required and defaults to
openshift
. - 2
- The
credentialsSecret
property refers to the namespace and name of the secret containing the token that was previously created. - 3
- Replace the
QUAY_URL
with the hostname of your Red Hat Quay instance. - 4
- If Red Hat Quay is using self signed certificates, set the property to
insecureRegistry: true
.
For a list of all configuration fields, see "QuayIntegration configuration fields".
Create the
QuayIntegration
custom resource:$ oc create -f quay-integration.yaml
9.4.2. Optional: Creating the QuayIntegration custom resource using the web console
Follow this procedure to create the QuayIntegration
custom resource using the web console.
Procedure
-
Open the Administrator perspective of the web console and navigate to Operators
Installed Operators. - Click Red Hat Quay Bridge Operator.
- On the Details page of the Quay Bridge Operator, click Create Instance on the Quay Integration API card.
On the Create QuayIntegration page, enter the following required information in either Form view or YAML view:
-
Name: The name that will refer to the
QuayIntegration
custom resource object. -
Cluster ID: The ID associated with this cluster. This value should be unique across the entire ecosystem. Defaults to
openshift
if left unspecified. - Credentials secret: Refers to the namespace and name of the secret containing the token that was previously created.
Quay hostname: The hostname of the Quay registry.
For a list of all configuration fields, see "QuayIntegration configuration fields".
-
Name: The name that will refer to the
After the QuayIntegration
custom resource is created, your OpenShift Container Platform cluster will be linked to your Red Hat Quay instance. Organizations within your Red Hat Quay registry should be created for the related namespace for the OpenShift Container Platform environment.
9.5. QuayIntegration configuration fields
The following configuration fields are available for the QuayIntegration custom resource:
Name | Description | Schema |
---|---|---|
allowlistNamespaces | A list of namespaces to include. | Array |
clusterID | The ID associated with this cluster. | String |
credentialsSecret.key | The secret containing credentials to communicate with the Quay registry. | Object |
denylistNamespaces | A list of namespaces to exclude. | Array |
insecureRegistry | Whether to skip TLS verification to the Quay registry | Boolean |
quayHostname | The hostname of the Quay registry. | String |
scheduledImageStreamImport | Whether to enable image stream importing. | Boolean |