第 7 章 备份和恢复由 Red Hat Quay Operator 管理的 Red Hat Quay

步骤

1. 输入以下命令获取 Red Hat Quay pod 列表：

   $ oc get pods -n <namespace>

   输出示例

   example-registry-clair-app-7dc7ff5844-4skw5           0/1     Error                    0             70d
   example-registry-clair-app-7dc7ff5844-nvn4f           1/1     Running                  0             31d
   example-registry-clair-app-7dc7ff5844-x4smw           0/1     ContainerStatusUnknown   6 (70d ago)   70d
   example-registry-clair-app-7dc7ff5844-xjnvt           1/1     Running                  0             60d
   example-registry-clair-postgres-547d75759-75c49       1/1     Running                  0             70d
   example-registry-quay-app-76c8f55467-52wjz            1/1     Running                  0             70d
   example-registry-quay-app-76c8f55467-hwz4c            1/1     Running                  0             70d
   example-registry-quay-app-upgrade-57ghs               0/1     Completed                1             70d
   example-registry-quay-database-7c55899f89-hmnm6       1/1     Running                  0             70d
   example-registry-quay-mirror-6cccbd76d-btsnb          1/1     Running                  0             70d
   example-registry-quay-mirror-6cccbd76d-x8g42          1/1     Running                  0             70d
   example-registry-quay-redis-85cbdf96bf-4vk5m          1/1     Running                  0             70d

2. 输入以下命令打开到 Quay 容器的远程 shell 会话：

   $ oc rsh example-registry-quay-app-76c8f55467-52wjz

3. 输入以下命令来创建所需的服务密钥：

   sh-4.4$ python3 tools/generatekeypair.py quay-readonly

   输出示例

   Writing public key to quay-readonly.jwk
   Writing key ID to quay-readonly.kid
   Writing private key to quay-readonly.pem

步骤

1. 输入以下命令输入 Red Hat Quay 数据库环境：

   $ oc rsh example-registry-quay-app-76c8f55467-52wjz psql -U <database_username> -d <database_name>

2. 输入以下命令显示 servicekeyapproval 的批准类型和相关备注：

   quay=# select * from servicekeyapproval;

   输出示例

    id | approver_id |          approval_type           |       approved_date        | notes
   ----+-------------+----------------------------------+----------------------------+-------
     1 |             | ServiceKeyApprovalType.AUTOMATIC | 2024-05-07 03:47:48.181347 |
     2 |             | ServiceKeyApprovalType.AUTOMATIC | 2024-05-07 03:47:55.808087 |
     3 |             | ServiceKeyApprovalType.AUTOMATIC | 2024-05-07 03:49:04.27095  |
     4 |             | ServiceKeyApprovalType.AUTOMATIC | 2024-05-07 03:49:05.46235  |
     5 |           1 | ServiceKeyApprovalType.SUPERUSER | 2024-05-07 04:05:10.296796 |
   ...

3. 输入以下查询在 Red Hat Quay 数据库中添加服务密钥：

   quay=# INSERT INTO servicekey
     (name, service, metadata, kid, jwk, created_date, expiration_date)
     VALUES ('quay-readonly',
              'quay',
              '{}',
              '{<contents_of_.kid_file>}',
              '{<contents_of_.jwk_file>}',
              '{<created_date_of_read-only>}',
              '{<expiration_date_of_read-only>}');

   输出示例

   INSERT 0 1

4. 接下来，使用以下查询添加密钥批准：

   quay=# INSERT INTO servicekeyapproval ('approval_type', 'approved_date', 'notes')
     VALUES ("ServiceKeyApprovalType.SUPERUSER", "CURRENT_DATE",
              {include_notes_here_on_why_this_is_being_added});

   输出示例

   INSERT 0 1

5. 将所创建的服务键行中的 approval_ id 字段设置为所创建的服务密钥批准中的 id 字段。您可以使用以下 SELECT 语句来获取必要的 ID：

   UPDATE servicekey
   SET approval_id = (SELECT id FROM servicekeyapproval WHERE approval_type = 'ServiceKeyApprovalType.SUPERUSER')
   WHERE name = 'quay-readonly';

   UPDATE 1

步骤

1. 输入以下命令在 OpenShift Container Platform 部署中读取 Red Hat Quay 的 secret 名称：

   $ oc get deployment -o yaml <quay_main_app_deployment_name>

2. 使用 base64 命令对 quay-readonly.kid 和 quay-readonly.pem 文件进行编码：

   $ base64 -w0 quay-readonly.kid

   输出示例

   ZjUyNDFm...

   $ base64 -w0 quay-readonly.pem

   输出示例

   LS0tLS1CRUdJTiBSU0E...

3. 输入以下命令来获取当前的配置捆绑包和 secret：

   $ oc get secret quay-config-secret-name -o json | jq '.data."config.yaml"' | cut -d '"' -f2 | base64 -d -w0 > config.yaml

4. 编辑 config.yaml 文件并添加以下信息：

   # ...
   REGISTRY_STATE: readonly
   INSTANCE_SERVICE_KEY_KID_LOCATION: 'conf/stack/quay-readonly.kid'
   INSTANCE_SERVICE_KEY_LOCATION: 'conf/stack/quay-readonly.pem'
   # ...

5. 运行以下命令保存文件和 base64 编码：

   $ base64 -w0 quay-config.yaml

6. 将 Red Hat Quay Operator pod 缩减为 0。这样可确保 Operator 在编辑后不会协调 secret。

   $ oc scale --replicas=0 deployment quay-operator -n openshift-operators

7. 编辑 secret 使其包含新内容：

   $ oc edit secret quay-config-secret-name -n quay-namespace

   # ...
   data:
     "quay-readonly.kid": "ZjUyNDFm..."
     "quay-readonly.pem": "LS0tLS1CRUdJTiBSU0E..."
     "config.yaml": "QUNUSU9OX0xPR19..."
   # ...

   在 OpenShift Container Platform 以只读模式部署 Red Hat Quay 时，您可以安全地管理 registry 的操作并执行如备份和恢复等操作。