Chapter 10. Configuring AWS STS for Red Hat Quay

Procedure

1. Log in to the Amazon Web Services (AWS) console and navigate to the Identity and Access Management (IAM) console.
2. In the navigation pane, under Access management click Users.

3. Click Create User and enter the following information:

   1. Enter a valid username, for example, quay-user.
   2. For Permissions options, click Add user to group.
4. On the review and create page, click Create user. You are redirected to the Users page.
5. Click the username, for example, quay-user.
6. Copy the ARN of the user, for example, arn:aws:iam::123456:user/quay-user.
7. On the same page, click the Security credentials tab.
8. Navigate to Access keys.
9. Click Create access key.
10. On the Access key best practices & alternatives page, click Command Line Interface (CLI), then, check the confirmation box. Then click Next.
11. Optional. On the Set description tag - optional page, enter a description.
12. Click Create access key.

13. Copy and store the access key and the secret access key.

    Important

    This is the only time that the secret access key can be viewed or downloaded. You cannot recover it later. However, you can create a new access key any time.

14. Click Done.

Procedure

1. On the Home page of your OpenShift Container Platform deployment, click Operators Installed Operators.
2. Click Red Hat Quay.
3. Click Quay Registry and then the name of your Red Hat Quay registry.
4. Under Config Bundle Secret, click the name of your registry configuration bundle, for example, quay-registry-config-bundle-qet56.
5. On the configuration bundle page, click Actions to reveal a drop-down menu. Then click Edit Secret.

6. Update your the DISTRIBUTED_STORAGE_CONFIG fields of your config.yaml file with the following information:

   # ...
   DISTRIBUTED_STORAGE_CONFIG:
      default:
       - STSS3Storage
       - sts_role_arn: <role_arn> 

   1

   
         s3_bucket: <s3_bucket_name> 

   2

   
         storage_path: <storage_path> 

   3

   
         s3_region: <region> 

   4

   
         sts_user_access_key: <s3_user_access_key> 

   5

   
         sts_user_secret_key: <s3_user_secret_key> 

   6

   
   # ...

   Copy to Clipboard Toggle word wrap

   1

   The unique Amazon Resource Name (ARN) required when configuring AWS STS

   2

   The name of your s3 bucket.

   3

   The storage path for data. Usually /datastorage.

   4

   The Amazon Web Services region. Defaults to us-east-1.

   5

   The generated AWS S3 user access key required when configuring AWS STS.

   6

   The generated AWS S3 user secret key required when configuring AWS STS.

7. Click Save.

Verification

1. Tag a sample image, for example, busybox, that will be pushed to the repository. For example:

   $ podman tag docker.io/library/busybox <quay-server.example.com>/<organization_name>/busybox:test

   Copy to Clipboard Toggle word wrap

2. Push the sample image by running the following command:

   $ podman push <quay-server.example.com>/<organization_name>/busybox:test

   Copy to Clipboard Toggle word wrap
3. Verify that the push was successful by navigating to the Organization that you pushed the image to in your Red Hat Quay registry Tags.
4. Navigate to the Amazon Web Services (AWS) console and locate your s3 bucket.
5. Click the name of your s3 bucket.
6. On the Objects page, click datastorage/.

7. On the datastorage/ page, the following resources should seen:

   • sha256/

   • uploads/

     These resources indicate that the push was successful, and that AWS STS is properly configured.

Procedure

1. Get the serviceAccountIssuer resource by entering the following command:

   $ oc get authentication.config.openshift.io cluster -o json | jq -r .spec.serviceAccountIssuer | sed -e "s/^https:\/\///"

   Copy to Clipboard Toggle word wrap

   Example output

   oidc.op1.openshiftapps.com/123456

   Copy to Clipboard Toggle word wrap

2. On the Identity and Access Management (IAM) console of the Amazon Web Services (AWS) console:

   1. Click Roles.
   2. Click the name of the Role to be used with AWS STS, for example, example-role.

   3. Click the Trust relationships tab, which shows the JSON policy created during "Creating an S3 role". Update the JSON policy as follows:

      {
      	"Version": "2012-10-17",
      	"Statement": [
          	{
              	"Sid": "Statement1",
              	"Effect": "Allow",
              	"Principal": {
                  	"Federated": "arn:aws:iam::123456:oidc-provider/oidc.op1.openshiftapps.com/123456" 

      1

      
              	},
              	"Action": "sts:AssumeRoleWithWebIdentity", 

      2

      
              	"Condition": {
                  	"StringEquals": {
                      	"oidc.op1.openshiftapps.com/123456:sub": "system:serviceaccount:quay:registry-quay-app" 

      3

      
                  	}
              	}
          	}
      	]
      }

      Copy to Clipboard Toggle word wrap

      1

      Updates the Principal parameter of the JSON policy to Federated:<your_user_ARN>:<serviceAccountIssuer_domain_path>

      2

      Updates the Action parameter of the JSON policy to sts:AssumeRoleWithWebIdentity.

      3

      Updates the Condition parameter of the JSON policy to StringEquals”: “<serviceAccountIssuer>:sub”: “system:serviceAccount:<quay_namespace>:<quay_registry_using_serviceAccount>

   4. Verify that your User ARN is configured correct, then click Next.
   5. On the Add permissions page, select AmazonS3FullAccess, then click Next.
   6. On the Name, review, and create page, provide your role a name, a description, verify your configuration, add any optional tags. Then, click Create Role.

3. On the Roles page, click the new role and store the Role ARN resource. For example:

   arn:aws:iam::123456:role/test_s3_access

   Copy to Clipboard Toggle word wrap

4. On the Red Hat Quay web console:

   1. Click Operators Installed Operators.
   2. Click Red Hat Quay.
   3. Click Quay Registry and then the name of your Red Hat Quay registry.
   4. Under Config Bundle Secret, click the name of your registry configuration bundle, for example, quay-registry-config-bundle-12345.
   5. On the configuration bundle page, click Actions to reveal a drop-down menu. Then click Edit Secret.

   6. Update your the DISTRIBUTED_STORAGE_CONFIG fields of your config.yaml file with the following information:

      # ...
      DISTRIBUTED_STORAGE_CONFIG:
         default:
          - STSS3Storage
            s3_bucket: <s3_bucket_name> 

      1

      
            storage_path: <storage_path> 

      2

      
            s3_region: <region> 

      3

      
      # ...

      Copy to Clipboard Toggle word wrap

      1

      The name of your s3 bucket.

      2

      The storage path for data. Usually /datastorage.

      3

      The Amazon Web Services region. Defaults to us-east-1.

5. Click Save. Your QuayRegistry custom resource (CR) automatically restarts.

6. Annotate the Service Account (SA) that executes pods with the EKS configuration values. For example:

   $ oc annotate sa registry-quay-app "eks.amazonaws.com/role-arn"="arn:aws:iam::123456:role/test_s3_access" "eks.amazonaws.com/audience"="sts.amazonaws.com" "eks.amazonaws.com/sts-regional-endpoints"="true"

   Copy to Clipboard Toggle word wrap

Verification

1. Tag a sample image, for example, busybox, that will be pushed to the repository. For example:

   $ podman tag docker.io/library/busybox <quay-server.example.com>/<organization_name>/busybox:test

   Copy to Clipboard Toggle word wrap

2. Push the sample image by running the following command:

   $ podman push <quay-server.example.com>/<organization_name>/busybox:test

   Copy to Clipboard Toggle word wrap
3. Verify that the push was successful by navigating to the Organization that you pushed the image to in your Red Hat Quay registry Tags.
4. Navigate to the Amazon Web Services (AWS) console and locate your s3 bucket.
5. Click the name of your s3 bucket.
6. On the Objects page, click datastorage/.

7. On the datastorage/ page, the following resources should seen:

   • sha256/

   • uploads/

     These resources indicate that the push was successful, and that AWS STS is properly configured.