Chapter 5. Red Hat Quay Robot Account overview

Procedure

1. On the v2 UI, click Organizations.
2. Click the name of the organization that you will create the robot account for, for example, test-org.
3. Click the Robot accounts tab Create robot account.
4. In the Provide a name for your robot account box, enter a name, for example, robot1. The name of your Robot Account becomes a combination of your username plus the name of the robot, for example, quayadmin+robot1

5. Optional. The following options are available if desired:

   1. Add the robot account to a team.
   2. Add the robot account to a repository.
   3. Adjust the robot account’s permissions.

6. On the Review and finish page, review the information you have provided, then click Review and finish. The following alert appears: Successfully created robot account with robot name: <organization_name> + <robot_name>.

   Alternatively, if you tried to create a robot account with the same name as another robot account, you might receive the following error message: Error creating robot account.

7. Optional. You can click Expand or Collapse to reveal descriptive information about the robot account.
8. Optional. You can change permissions of the robot account by clicking the kebab menu Set repository permissions. The following message appears: Successfully updated repository permission.

9. Optional. You can click the name of your robot account to obtain the following information:

   • Robot Account: Select this obtain the robot account token. You can regenerate the token by clicking Regenerate token now.
   • Kubernetes Secret: Select this to download credentials in the form of a Kubernetes pull secret YAML file.
   • Podman: Select this to copy a full podman login command line that includes the credentials.
   • Docker Configuration: Select this to copy a full docker login command line that includes the credentials.

Procedure

1. On the Red Hat Quay v2 UI landing page, click Organizations in the navigation pane.
2. On the Organizations page, select the name of the organization that has multiple repositories. The number of repositories under a single organization can be found under the Repo Count column.
3. On your organization’s page, click Robot accounts.
4. For the robot account that will be added to multiple repositories, click the kebab icon Set repository permissions.

5. On the Set repository permissions page, check the boxes of the repositories that the robot account will be added to. For example:

   

6. Set the permissions for the robot account, for example, None, Read, Write, Admin.
7. Click save. An alert that says Success alert: Successfully updated repository permission appears on the Set repository permissions page, confirming the changes.
8. Return to the Organizations Robot accounts page. Now, the Repositories column of your robot account shows the number of repositories that the robot account has been added to.

Procedure

1. Update your config.yaml field to add the ROBOTS_DISALLOW variable, for example:

   ROBOTS_DISALLOW: true

2. Restart your Red Hat Quay deployment.

Verification: Creating a new robot account

1. Navigate to your Red Hat Quay repository.
2. Click the name of a repository.
3. In the navigation pane, click Robot Accounts.
4. Click Create Robot Account.
5. Enter a name for the robot account, for example, <organization-name/username>+<robot-name>.
6. Click Create robot account to confirm creation. The following message appears: Cannot create robot account. Robot accounts have been disabled. Please contact your administrator.

Verification: Logging into a robot account

1. On the command-line interface (CLI), attempt to log in as one of the robot accounts by entering the following command:

   $ podman login -u="<organization-name/username>+<robot-name>" -p="KETJ6VN0WT8YLLNXUJJ4454ZI6TZJ98NV41OE02PC2IQXVXRFQ1EJ36V12345678" <quay-server.example.com>

   The following error message is returned:

   Error: logging into "<quay-server.example.com>": invalid username/password

2. You can pass in the log-level=debug flag to confirm that robot accounts have been deactivated:

   $ podman login -u="<organization-name/username>+<robot-name>" -p="KETJ6VN0WT8YLLNXUJJ4454ZI6TZJ98NV41OE02PC2IQXVXRFQ1EJ36V12345678" --log-level=debug <quay-server.example.com>

   ...
   DEBU[0000] error logging into "quay-server.example.com": unable to retrieve auth token: invalid username/password: unauthorized: Robot accounts have been disabled. Please contact your administrator.

Procedure

1. Log into your Red Hat Quay registry:
2. Click the name of the Organization that has the robot account.
3. Click Robot accounts.
4. Check the box of the robot account to be deleted.
5. Click the kebab menu.
6. Click Delete.
7. Type confirm into the textbox, then click Delete.

Procedure

1. Enter the following command to delete a robot account for an organization using the DELETE /api/v1/organization/{orgname}/robots/{robot_shortname} endpoint:

   curl -X DELETE \
     -H "Authorization: Bearer lfV4lVf9qRsyoFnrgEno1umIOrsdp8lPyMnfUDYY" \
     "quay-server.example.com/api/v1/organization/<organization_name>/robots/<robot_shortname>"

2. The CLI does not return information when deleting a robot account with the API. To confirm deletion, you can check the Red Hat Quay UI, or you can enter the following GET /api/v1/organization/{orgname}/robots command to see if details are returned for the robot account:

   $ curl -X GET   -H "Authorization: Bearer <bearer_token>"   "https://<quay-server.example.com>/api/v1/organization/<organization_name>/robots"

   Example output

   {"robots": []}

   • Enter the following command to delete a robot account for the current user with the DELETE /api/v1/user/robots/{robot_shortname} endpoint:

     curl -X DELETE \
       -H "Authorization: Bearer lfV4lVf9qRsyoFnrgEno1umIOrsdp8lPyMnfUDYY" \
       "quay-server.example.com/api/v1/user/robots/<robot_shortname>"

3. The CLI does not return information when deleting a robot account for the current user with the API. To confirm deletion, you can check the Red Hat Quay UI, or you can enter the following GET /api/v1/user/robots/{robot_shortname} command to see if details are returned for the robot account:

   $ curl -X GET \
     -H "Authorization: Bearer lfV4lVf9qRsyoFnrgEno1umIOrsdp8lPyMnfUDYY" \
     "quay-server.example.com/api/v1/user/robots/<robot_shortname>"

   Example output

   {"message":"Could not find robot with specified username"}