2.2. About superuser full access

When a user, for example, user1 creates an organization within a registry, they own the access and permissions to that organization. As such, they can create repositories, define teams and memberships, create robot accounts, set default permissions, view logs, and adjust other settings as warranted. It is, for all intents and purposes, the user’s organization.

By default, superusers do not have access to a user’s organization. However, Red Hat Quay administrators can use the FEATURE_SUPERUSERS_FULL_ACCESS configuration field to grant superusers the ability to read, write, and delete content from other repositories in namespaces or organizations that they do not own or have explicit permissions for.

When the FEATURE_SUPERUSERS_FULL_ACCESS field is enabled (true), all organizations and members of the registry are revealed on the Organizations page of the UI. However, when this field is enabled, the superuser cannot view the image repository of every organization at once. This is a known limitation and will be fixed in a future version of Red Hat Quay. As a temporary workaround, the superuser can view image repositories by navigating to them from the Organizations page.

To grant superusers full access to all organizations within the registry, you can use the following YAML configuration:

# ...
FEATURE_SUPERUSERS_FULL_ACCESS: true
# ...

After sitting FEATURE_SUPERUSERS_FULL_ACCESS: true, all organizations will be visible on the superuser’s Organization page.