Chapter 1. Red Hat Quay permissions model

Procedure

1. Click the name of an organization.
2. Click Default permissions.
3. Click Create default permissions. A toggle drawer appears.

4. Select either Anyone or Specific user to create a default permission when a repository is created.

   1. If selecting Anyone, the following information must be provided:

      • Applied to. Search, invite, or add a user/robot/team.
      • Permission. Set the permission to one of Read, Write, or Admin.

   2. If selecting Specific user, the following information must be provided:

      • Repository creator. Provide either a user or robot account.
      • Applied to. Provide a username, robot account, or team name.
      • Permission. Set the permission to one of Read, Write, or Admin.
5. Click Create default permission. A confirmation box appears, returning the following alert: Successfully created default permission for creator.

Procedure

1. Enter the following command to create a default permission with the POST /api/v1/organization/{orgname}/prototypes endpoint:

   $ curl -X POST   -H "Authorization: Bearer <bearer_token>"   -H "Content-Type: application/json"   --data '{
       "role": "<admin_read_or_write>",
       "delegate": {
         "name": "<username>",
         "kind": "user"
       },
       "activating_user": {
         "name": "<robot_name>"
       }
     }'   https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes

   Example output

   {"activating_user": {"name": "test-org+test", "is_robot": true, "kind": "user", "is_org_member": true, "avatar": {"name": "test-org+test", "hash": "aa85264436fe9839e7160bf349100a9b71403a5e9ec684d5b5e9571f6c821370", "color": "#8c564b", "kind": "robot"}}, "delegate": {"name": "testuser", "is_robot": false, "kind": "user", "is_org_member": false, "avatar": {"name": "testuser", "hash": "f660ab912ec121d1b1e928a0bb4bc61b15f5ad44d5efdc4e1c92a25e99b8e44a", "color": "#6b6ecf", "kind": "user"}}, "role": "admin", "id": "977dc2bc-bc75-411d-82b3-604e5b79a493"}

2. Enter the following command to update a default permission using the PUT /api/v1/organization/{orgname}/prototypes/{prototypeid} endpoint, for example, if you want to change the permission type. You must include the ID that was returned when you created the policy.

   $ curl -X PUT \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Content-Type: application/json" \
     --data '{
       "role": "write"
     }' \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes/<prototypeid>

   Example output

   {"activating_user": {"name": "test-org+test", "is_robot": true, "kind": "user", "is_org_member": true, "avatar": {"name": "test-org+test", "hash": "aa85264436fe9839e7160bf349100a9b71403a5e9ec684d5b5e9571f6c821370", "color": "#8c564b", "kind": "robot"}}, "delegate": {"name": "testuser", "is_robot": false, "kind": "user", "is_org_member": false, "avatar": {"name": "testuser", "hash": "f660ab912ec121d1b1e928a0bb4bc61b15f5ad44d5efdc4e1c92a25e99b8e44a", "color": "#6b6ecf", "kind": "user"}}, "role": "write", "id": "977dc2bc-bc75-411d-82b3-604e5b79a493"}

3. You can delete the permission by entering the DELETE /api/v1/organization/{orgname}/prototypes/{prototypeid} command:

   curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes/<prototype_id>

   This command does not return an output. Instead, you can obtain a list of all permissions by entering the GET /api/v1/organization/{orgname}/prototypes command:

   $ curl -X GET \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/organization/<organization_name>/prototypes

   Example output

   {"prototypes": []}

Procedure

1. Log into Red Hat Quay.
2. On the v2 UI, click Repositories.
3. Click the name of a repository, for example, quayadmin/busybox.
4. Click the Settings tab.

5. Optional. Click User and robot permissions. You can adjust the settings for a user or robot account by clicking the dropdown menu option under Permissions. You can change the settings to Read, Write, or Admin.

   • Read. The User or Robot Account can view and pull from the repository.
   • Write. The User or Robot Account can read (pull) from and write (push) to the repository.
   • Admin. The User or Robot account has access to pull from, and push to, the repository, plus the ability to do administrative tasks associated with the repository.

Procedure

1. Enter the following PUT /api/v1/repository/{repository}/permissions/user/{username} command to change the permissions of a user:

   $ curl -X PUT \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Content-Type: application/json" \
     -d '{"role": "admin"}' \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>

   Example output

   {"role": "admin", "name": "quayadmin+test", "is_robot": true, "avatar": {"name": "quayadmin+test", "hash": "ca9afae0a9d3ca322fc8a7a866e8476dd6c98de543decd186ae090e420a88feb", "color": "#8c564b", "kind": "robot"}}

2. To delete the current permission, you can enter the DELETE /api/v1/repository/{repository}/permissions/user/{username} command:

   $ curl -X DELETE \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>

   This command does not return any output in the CLI. Instead, you can check that the permissions were deleted by entering the GET /api/v1/repository/{repository}/permissions/user/ command:

   $ curl -X GET \
     -H "Authorization: Bearer <bearer_token>" \
     -H "Accept: application/json" \
     https://<quay-server.example.com>/api/v1/repository/<namespace>/<repository>/permissions/user/<username>/

   Example output

   {"message":"User does not have permission for repo."}