Chapter 10. Open Container Initiative support

Procedure

1. Add a chart repository by entering the following command:

   $ helm repo add redhat-cop https://redhat-cop.github.io/helm-charts

2. Enter the following command to update the information of available charts locally from the chart repository:

   $ helm repo update

3. Enter the following command to pull a chart from a repository:

   $ helm pull redhat-cop/etherpad --version=0.0.4 --untar

4. Enter the following command to package the chart into a chart archive:

   $ helm package ./etherpad

   Example output

   Successfully packaged chart and saved it to: /home/user/linux-amd64/etherpad-0.0.4.tgz

5. Log in to Red Hat Quay using helm registry login:

   $ helm registry login quay370.apps.quayperf370.perfscale.devcluster.openshift.com

6. Push the chart to your repository using the helm push command:

   $ helm push etherpad-0.0.4.tgz oci://quay370.apps.quayperf370.perfscale.devcluster.openshift.com

   Example output:

   Pushed: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:a6667ff2a0e2bd7aa4813db9ac854b5124ff1c458d170b70c2d2375325f2451b

7. Ensure that the push worked by deleting the local copy, and then pulling the chart from the repository:

   $ rm -rf etherpad-0.0.4.tgz

   $ helm pull oci://quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad --version 0.0.4

   Example output:

   Pulled: quay370.apps.quayperf370.perfscale.devcluster.openshift.com/etherpad:0.0.4
   Digest: sha256:4f627399685880daf30cf77b6026dc129034d68c7676c7e07020b70cf7130902

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay-server.example.com/user1/busybox:test

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay-server.example.com

   Example output

   Username:
   Password:
   Login Succeeded!

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

Procedure

1. Enter the following go command to directly install Cosign:

   $ go install github.com/sigstore/cosign/cmd/cosign@v1.0.0

   Example output

   go: downloading github.com/sigstore/cosign v1.0.0
   go: downloading github.com/peterbourgon/ff/v3 v3.1.0

2. Generate a key-value pair for Cosign by entering the following command:

   $ cosign generate-key-pair

   Example output

   Enter password for private key:
   Enter again:
   Private key written to cosign.key
   Public key written to cosign.pub

3. Sign the key-value pair by entering the following command:

   $ cosign sign -key cosign.key quay-server.example.com/user1/busybox:test

   Example output

   Enter password for private key:
   Pushing signature to: quay-server.example.com/user1/busybox:sha256-ff13b8f6f289b92ec2913fa57c5dd0a874c3a7f8f149aabee50e3d01546473e3.sig

   If you experience the error: signing quay-server.example.com/user1/busybox:test: getting remote image: GET https://quay-server.example.com/v2/user1/busybox/manifests/test: UNAUTHORIZED: access to the requested resource is not authorized; map[] error, which occurs because Cosign relies on ~./docker/config.json for authorization, you might need to execute the following command:

   $ podman login --authfile ~/.docker/config.json quay-server.example.com

   Example output

   Username:
   Password:
   Login Succeeded!

4. Enter the following command to see the updated authorization configuration:

   $ cat ~/.docker/config.json
   {
   	"auths": {
   		"quay-server.example.com": {
   			"auth": "cXVheWFkbWluOnBhc3N3b3Jk"
   		}
   	}

Procedure

1. In your config.yaml file, add the ALLOWED_OCI_ARTIFACT_TYPES configuration field. For example:

   FEATURE_GENERAL_OCI_SUPPORT: true
   ALLOWED_OCI_ARTIFACT_TYPES:
     <oci config type 1>:
     - <oci layer type 1>
     - <oci layer type 2>
   
     <oci config type 2>:
     - <oci layer type 3>
     - <oci layer type 4>

2. Add support for your desired artifact type, for example, Singularity Image Format (SIF), by adding the following to your config.yaml file:

   ALLOWED_OCI_ARTIFACT_TYPES:
     application/vnd.oci.image.config.v1+json:
     - application/vnd.dev.cosign.simplesigning.v1+json
     application/vnd.cncf.helm.config.v1+json:
     - application/tar+gzip
     application/vnd.sylabs.sif.config.v1+json:
     - application/vnd.sylabs.sif.layer.v1+tar

   Important

   When adding artifact types that are not configured by default, Red Hat Quay administrators will also need to manually add support for Cosign and Helm if desired.

   Now, users can tag SIF images for their Red Hat Quay registry.