Chapter 13. Open Container Initiative support and Red Hat Quay

Procedure

1. As a Red Hat Quay administrators, enable support for Helm by setting FEATURE_GENERAL_OCI_SUPPORT to true in your config.yaml file:

   FEATURE_GENERAL_OCI_SUPPORT: true

2. Add a chart repository:

   $ helm repo add redhat-cop https://redhat-cop.github.io/helm-charts

3. Update the information of available charts locally from the chart repository:

   $ helm repo update

4. Download a chart from a repository:

   $ helm pull redhat-cop/etherpad --version=0.0.4 --untar

5. Package the chart into a chart archive:

   $ helm package ./etherpad

   Example output

   Successfully packaged chart and saved it to: /home/user/linux-amd64/etherpad-0.0.4.tgz

6. Log in to your Quay repository using helm registry login:

   $ helm registry login quay370.apps.quayperf370.perfscale.devcluster.openshift.com

7. Push the chart to your Quay repository using the helm push command:

   $ helm push etherpad-0.0.4.tgz oci://quay370.apps.quayperf370.perfscale.devcluster.openshift.com

   Example output:

   Pushed: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:a6667ff2a0e2bd7aa4813db9ac854b5124ff1c458d170b70c2d2375325f2451b

8. Ensure that the push worked by deleting the local copy, and then pulling the chart from the repository:

   $ rm -rf etherpad-0.0.4.tgz

   $ helm pull oci://quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad --version 0.0.4

   Example output:

   Pulled: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:4f627399685880daf30cf77b6026dc129034d68c7676c7e07020b70cf7130902

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

2. Generate a keypair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

3. Sign the keypair by entering the following command:

   $ cosign sign -key cosign.key quay-server.example.com/user1/busybox:test

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay-server.example.com

   Example output

   Username:
   Password:
   Login Succeeded!

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

Procedure

1. In your config.yaml file, add the ALLOWED_OCI_ARTIFACT_TYPES configuration field. For example:

   FEATURE_GENERAL_OCI_SUPPORT: true
   ALLOWED_OCI_ARTIFACT_TYPES:
     <oci config type 1>:
     - <oci layer type 1>
     - <oci layer type 2>
   
     <oci config type 2>:
     - <oci layer type 3>
     - <oci layer type 4>

2. Add support for your desired artifact type, for example, Singularity Image Format (SIF), by adding the following to your config.yaml file:

   ALLOWED_OCI_ARTIFACT_TYPES:
     application/vnd.oci.image.config.v1+json:
     - application/vnd.dev.cosign.simplesigning.v1+json
     application/vnd.cncf.helm.config.v1+json:
     - application/tar+gzip
     application/vnd.sylabs.sif.config.v1+json:
     - application/vnd.sylabs.sif.layer.v1+tar

   Important

   When adding artifact types that are not configured by default, Red Hat Quay administrators will also need to manually add support for Cosign and Helm if desired.

   Now, users can tag SIF images for their Red Hat Quay registry.