Chapter 3. Adding additional Certificate Authorities for Red Hat Quay

Procedure

1. Describe the QuayRegistry resource by entering the following command:

   $ oc describe quayregistry -n <quay_namespace>

   # ...
     Config Bundle Secret:  example-registry-config-bundle-v123x
   # ...

2. Obtain the secret data by entering the following command:

   $ oc get secret -n <quay_namespace> <example-registry-config-bundle-v123x> -o jsonpath='{.data}'

   Example output

   {
       "config.yaml": "RkVBVFVSRV9VU0 ... MDAwMAo="
   }

3. Decode the data into a YAML file into the current directory by passing in the >> config.yaml flag. For example:

   $ echo 'RkVBVFVSRV9VU0 ... MDAwMAo=' | base64 --decode >> config.yaml

4. Make the desired changes to your config.yaml file, and then save the file as config.yaml.

5. Create a new configBundleSecret YAML by entering the following command.

   $ touch <new_configBundleSecret_name>.yaml

6. Create the new configBundleSecret resource, passing in the config.yaml file` by entering the following command:

   $ oc -n <namespace> create secret generic <secret_name> \
     --from-file=config.yaml=</path/to/config.yaml> \ 

   1

   
     --dry-run=client -o yaml > <new_configBundleSecret_name>.yaml

   1

   Where <config.yaml> is your base64 decoded config.yaml file.

7. Create the configBundleSecret resource by entering the following command:

   $ oc create -n <namespace> -f <new_configBundleSecret_name>.yaml

   Example output

   secret/config-bundle created

8. Update the QuayRegistry YAML file to reference the new configBundleSecret object by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"configBundleSecret":"<new_configBundleSecret_name>"}}'

   Example output

   quayregistry.quay.redhat.com/example-registry patched

Verification

1. Verify that the QuayRegistry CR has been updated with the new configBundleSecret:

   $ oc describe quayregistry -n <quay_namespace>

   Example output

   # ...
     Config Bundle Secret: <new_configBundleSecret_name>
   # ...

   After patching the registry, the Red Hat Quay Operator automatically reconciles the changes.

Procedure

1. Create a new YAML file, for example, extra-ca-certificate-config-bundle-secret.yaml:

   $ touch extra-ca-certificate-config-bundle-secret.yaml

2. Create the extra-ca-certificate-config-bundle-secret resource.

   1. Create the resource by entering the following command:

      $ oc -n <namespace> create secret generic extra-ca-certificate-config-bundle-secret \
        --from-file=config.yaml=</path/to/config.yaml> \ 

      1

      
        --from-file=extra_ca_cert_<name-of-certificate-one>=<path/to/certificate_one> \ 

      2

      
        --from-file=extra_ca_cert_<name-of-certificate-two>=<path/to/certificate_two> \ 

      3

      
        --from-file=extra_ca_cert_<name-of-certificate-three>=<path/to/certificate_three> \ 

      4

      
        --dry-run=client -o yaml > extra-ca-certificate-config-bundle-secret.yaml

      1

      Where <config.yaml> is your base64 decoded config.yaml file.

      2

      The extra CA file to be added to into the system trust bundle.

      3

      Optional. A second CA file to be added into the system trust bundle.

      4

      Optional. A third CA file to be added into the system trust bundle.

3. Optional. You can check the content of the extra-ca-certificate-config-bundle-secret.yaml file by entering the following command:

   $ cat extra-ca-certificate-config-bundle-secret.yaml

   Example output

   apiVersion: v1
   data:
     config.yaml: QUxMT1dfUFVMTFNfV0lUSE9VVF9TVFJJQ1RfTE9HR0lORzogZmFsc2UKQVVUSEVOVElDQVRJT05fVFlQRTogRGF0YWJhc2UKREVGQVVMVF9UQUdfRVhQSVJBVElPTjogMncKUFJFRkVSU...
     extra_ca_cert_certificate-one: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQyVENDQXNHZ0F3SUJBZ0lVS2xOai90VUJBZHBkNURjYkdRQUo4anRuKzd3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
     extra_ca_cert_certificate-three: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ0ekNDQXN1Z0F3SUJBZ0lVQmJpTXNUeExjM0s4ODNWby9GTThsWXlOS2lFd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
     extra_ca_cert_certificate-two: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUQ0ekNDQXN1Z0F3SUJBZ0lVVFVPTXZ2YVdFOFRYV3djYTNoWlBCTnV2QjYwd0RRWUpLb1pJaHZjTkFRRUwKQlFBd2ZERUxNQWtHQ...
   kind: Secret
   metadata:
     creationTimestamp: null
     name: custom-ssl-config-bundle-secret
     namespace: <namespace>

4. Create the configBundleSecret resource by entering the following command:

   $ oc create -n <namespace> -f extra-ca-certificate-config-bundle-secret.yaml

   Example output

   secret/extra-ca-certificate-config-bundle-secret created

5. Update the QuayRegistry YAML file to reference the extra-ca-certificate-config-bundle-secret object by entering the following command:

   $ oc patch quayregistry <registry_name> -n <namespace> --type=merge -p '{"spec":{"configBundleSecret":"extra-ca-certificate-config-bundle-secret"}}'

   Example output

   quayregistry.quay.redhat.com/example-registry patched

6. Ensure that your QuayRegistry YAML file has been updated to use the extra CA certificate configBundleSecret resource by entering the following command:

   $ oc get quayregistry <registry_name> -n <namespace> -o yaml

   Example output

   # ...
     configBundleSecret: extra-ca-certificate-config-bundle-secret
   # ...