7.5.3. Exchanging an OAuth2 access token for a Red Hat Quay robot account token

Procedure

1. Save the following Python script in a .py file, for example, robot_fed_token_auth.py

   import requests
   import os
   
   TOKEN=os.environ.get('TOKEN')
   robot_user = "fed-test+robot1"
   
   def get_quay_robot_token(fed_token):
       URL = "https://<quay-server.example.com>/oauth2/federation/robot/token"
       response = requests.get(URL, auth=(robot_user,fed_token)) 

   1

   
       print(response)
       print(response.text)
   
   if __name__ == "__main__":
       get_quay_robot_token(TOKEN)

   1

   If your Red Hat Quay deployment is using custom SSL/TLS certificates, the response must be response = requests.get(URL,auth=(robot_user,fed_token),verify=False), which includes the verify=False flag.

2. Export the OAuth2 access token as TOKEN. For example:

   $ export TOKEN = eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJTVmExVHZ6eDd2cHVmc1dkZmc1SHdua1ZDcVlOM01DN1N5T016R0QwVGhVIn0...

3. Run the robot_fed_token_auth.py script by entering the following command:

   $ python3 robot_fed_token_auth.py

   Example output

   <Response [200]>
   {"token": "string..."}

   중요

   This token expires after one hour. After one hour, a new token must be generated.

4. Export the robot account access token as QUAY_TOKEN. For example:

   $ export QUAY_TOKEN=291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6InByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZ