You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: modules/builders-virtual-environment.adoc
+6-4
Original file line number
Diff line number
Diff line change
@@ -26,7 +26,11 @@ To add the builder route, use the following format:
26
26
[id="red-hat-quay-quota-builders-establishment"]
27
27
== Using {ocp} for {productname} builders
28
28
29
+
<<<<<<< HEAD
29
30
Builders require SSL/TLS certificates. For more information about SSL/TLS certificates, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html-single/proof_of_concept_-_deploying_red_hat_quay/index#advanced-quay-poc-deployment[Using SSL/TLS certificates].
31
+
=======
32
+
Builders require SSL/TLS certificates. For more information about SSL/TLS certificates, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html/proof_of_concept_-_deploying_red_hat_quay/advanced-quay-poc-deployment[Proof of concept deployment using SSL/TLS certificates].
33
+
>>>>>>> 7068057f (Fixes some Clair exporting commands (#992))
30
34
31
35
If you are using Amazon Web Service (AWS) S3 storage, you must modify your storage bucket in the AWS console, prior to running builders. See "Modifying your AWS S3 storage bucket" in the following section for the required parameters.
32
36
@@ -246,8 +250,7 @@ BUILD_MANAGER:
246
250
247
251
Due to a known issue with the configuration tool, you must manually add your custom SSL/TLS certificates to properly run builders. Use the following procedure to manually add custom SSL/TLS certificates.
248
252
249
-
For more information about SSL/TLS certificates, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html-single/proof_of_concept_-_deploying_red_hat_quay/index#advanced-quay-poc-deployment[Using SSL/TLS certificates].
250
-
253
+
For more information creating SSL/TLS certificates, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html/proof_of_concept_-_deploying_red_hat_quay/advanced-quay-poc-deployment[Proof of concept deployment using SSL/TLS certificates].
251
254
252
255
253
256
[id="create-sign-certificates"]
@@ -257,8 +260,7 @@ Use the following procedure to create and sign an SSL/TLS certificate.
257
260
258
261
.Procedure
259
262
260
-
* Create a certificate authority and sign a certificate. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html-single/proof_of_concept_-_deploying_red_hat_quay/index#advanced-quay-poc-deployment[Using SSL/TLS certificates].
261
-
263
+
* Create a certificate authority and sign a certificate. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html-single/proof_of_concept_-_deploying_red_hat_quay/index#creating-a-certificate-authority[Creating a Certificate Authority].
Copy file name to clipboardexpand all lines: modules/clair-standalone-database.adoc
+1-1
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
4
4
Clair requires a Postgres database. You can share a common database between Quay and Clair if Quay is also using Postgres, but in this example a separate, Clair-specific database is deployed.
5
5
6
-
In this proof-of-concept scenario, you will use a directory on the local file system to persist database data.
6
+
In this proof of concept scenario, you will use a directory on the local file system to persist database data.
7
7
8
8
. In the installation folder, denoted here by the variable $QUAY, create a directory for the Clair database data and set the permissions appropriately:
Copy file name to clipboardexpand all lines: modules/config-fields-ldap.adoc
+22-5
Original file line number
Diff line number
Diff line change
@@ -23,6 +23,8 @@
23
23
| **LDAP_URI** | String | The LDAP URI.
24
24
| **LDAP_USER_FILTER** | String | The user filter for LDAP authentication.
25
25
| **LDAP_USER_RDN** | Array of String| The user RDN for LDAP authentication.
26
+
| **LDAP_SECONDARY_USER_RDNS** | Array of String | Provide Secondary User Relative DNs if there are multiple Organizational Units where user objects are located.
27
+
26
28
| **TEAM_RESYNC_STALE_TIME** | String | If team syncing is enabled for a team, how often to check its membership and resync if necessary. +
27
29
+
28
30
**Pattern:** +
@@ -38,15 +40,21 @@ With this field, administrators can add or remove superusers without having to u
38
40
39
41
This field requires that your `AUTHENTICATION_TYPE` is set to `LDAP`.
40
42
43
+
| **GLOBAL_READONLY_SUPER_USERS** | String | When set, grants users of this list read access to all repositories, regardless of whether they are public repositories. Only works for those superusers defined with the `LDAP_SUPERUSER_FILTER` configuration field.
44
+
41
45
| **LDAP_RESTRICTED_USER_FILTER** | String | Subset of the `LDAP_USER_FILTER` configuration field. When configured, allows {productname} administrators the ability to configure Lightweight Directory Access Protocol (LDAP) users as restricted users when {productname} uses LDAP as its authentication provider.
42
46
43
-
This field requires that your `AUTHENTICATION_TYPE` is set to `LDAP`.
47
+
This field requires that your `AUTHENTICATION_TYPE` is set to `LDAP`.
44
48
45
-
| **LDAP_TIMEOUT** |Integer | Determines the maximum time period. in seconds, allowed for establishing a connection to the Lightweight Directory Access Protocol (LDAP) server. +
49
+
| **FEATURE_RESTRICTED_USERS** | Boolean | When set to `True` with `LDAP_RESTRICTED_USER_FILTER` active, only the listed users in the defined LDAP group are restricted.
50
+
51
+
*Default:*`False`
52
+
53
+
| **LDAP_TIMEOUT** |Integer | Specifies the time limit, in seconds, for LDAP operations. This limits the amount of time an LDAP search, bind, or other operation can take. Similar to the `-l` option in `ldapsearch`, it sets a client-side operation timeout. +
46
54
+
47
55
**Default:**`10`
48
56
49
-
| **LDAP_NETWORK_TIMEOUT** |Integer | Defines the maximum time duration, in seconds, that {productname} waits for a response from the Lightweight Directory Access Protocol (LDAP) server during network operations. +
57
+
| **LDAP_NETWORK_TIMEOUT** |Integer | Specifies the time limit, in seconds, for establishing a connection to the LDAP server. This is the maximum time {productname} waits for a response during network operations, similar to the `-o nettimeout` option in `ldapsearch`. +
50
58
+
51
59
**Default:**`10`
52
60
@@ -83,6 +91,11 @@ LDAP_USER_RDN: <10>
83
91
- o=<organization_id>
84
92
- dc=<example_domain_component>
85
93
- dc=com
94
+
LDAP_SECONDARY_USER_RDNS: <11>
95
+
- ou=<example_organization_unit_one>
96
+
- ou=<example_organization_unit_two>
97
+
- ou=<example_organization_unit_three>
98
+
- ou=<example_organization_unit_four>
86
99
----
87
100
<1> Required. Must be set to `LDAP`.
88
101
<2> Required. The admin DN for LDAP authentication.
@@ -94,6 +107,7 @@ LDAP_USER_RDN: <10>
94
107
<8> Required. The LDAP URI.
95
108
<9> Required. The user filter for LDAP authentication.
96
109
<10> Required. The user RDN for LDAP authentication.
110
+
<11> Optional. Secondary User Relative DNs if there are multiple Organizational Units where user objects are located.
97
111
98
112
[id="reference-ldap-restricted-user"]
99
113
=== LDAP restricted user configuration
@@ -105,6 +119,8 @@ Use the following reference for an LDAP restricted user configuration.
Copy file name to clipboardexpand all lines: modules/config-fields-user.adoc
+6-2
Original file line number
Diff line number
Diff line change
@@ -53,13 +53,17 @@
53
53
54
54
*Default:*`False`
55
55
56
-
| **FEATURE_RESTRICTED_USERS** | Boolean | When set with `RESTRICTED_USERS_WHITELIST`, restricted users cannot create organizations or content in their own namespace. Normal permissions apply for an organization's membership, for example, a restricted user will still have normal permissions in organizations based on the teams that they are members of.
56
+
| **FEATURE_RESTRICTED_USERS** | Boolean | When set to `True` with `RESTRICTED_USERS_WHITELIST`:
57
+
58
+
* All normal users and superusers are restricted from creating organizations or content in their own namespace unless they are allowlisted via `RESTRICTED_USERS_WHITELIST`.
59
+
60
+
* Restricted users retain their normal permissions within organizations based on team memberships.
57
61
58
62
*Default:*`False`
59
63
60
64
| **RESTRICTED_USERS_WHITELIST** | String | When set with `FEATURE_RESTRICTED_USERS: true`, specific users are excluded from the `FEATURE_RESTRICTED_USERS` setting.
61
65
62
-
| **GLOBAL_READONLY_SUPER_USERS** | String | When set, grants users of this list read access to all repositories, regardless of whether they are public repositories.
66
+
| **GLOBAL_READONLY_SUPER_USERS** | String | When set, grants users of this list read access to all repositories, regardless of whether they are public repositories. Only works for those superusers defined with the `SUPER_USERS` configuration field.
Copy file name to clipboardexpand all lines: modules/config-intro.adoc
-11
Original file line number
Diff line number
Diff line change
@@ -5,17 +5,6 @@
5
5
{productname} can be deployed by an independent, standalone configuration, or by using the {productname} Operator on {ocp}.
6
6
7
7
How you create, retrieve, update, and validate the {productname} configuration varies depending on the type of deployment you are using. However, the core configuration options are the same for either deployment type. Core configuration is primarily set through a `config.yaml` file, but can also be set by using the configuration API.
8
-
////
9
-
+
10
-
[NOTE]
11
-
====
12
-
As of {productname} 3.10, the configuration tool has been removed on {ocp} deployments, meaning that users cannot configure, or reconfigure, directly from the {ocp} console.
13
-
14
-
As a workaround, you can deploy the configuration tool locally and create your own configuration bundle. This includes entering the database and storage credentials used for your {productname} on {ocp} deployment, generating a `config.yaml` file, and using it to deploy {productname} on {ocp} via the command-line interface.
15
-
16
-
To deploy the configuration tool locally, see link:https://access.redhat.com/documentation/en-us/red_hat_quay/3.10/html-single/deploy_red_hat_quay_for_proof-of-concept_non-production_purposes/index#poc-getting-started[Getting started with {productname}] and follow the instructions up to "Configuring {productname}".
17
-
====
18
-
////
19
8
20
9
For standalone deployments of {productname}, you must supply the minimum required configuration parameters before the registry can be started. The minimum requirements to start a {productname} registry can be found in the "Retrieving the current configuration" section.
Copy file name to clipboardexpand all lines: modules/georepl-prereqs.adoc
+5
Original file line number
Diff line number
Diff line change
@@ -36,6 +36,11 @@ Geo-replication does not replicate the database. In the event of an outage, {pro
36
36
37
37
* Geo-replication requires your Clair configuration to be set to `unmanaged`. An unmanaged Clair database allows the {productname} Operator to work in a geo-replicated environment, where multiple instances of the {productname} Operator must communicate with the same database. For more information, see link:https://access.redhat.com/documentation/en-us/red_hat_quay/3.7/html-single/deploy_red_hat_quay_on_openshift_with_the_quay_operator/index#clair-unmanaged[Advanced Clair configuration].
38
38
39
+
<<<<<<< HEAD
39
40
* Geo-Replication requires SSL/TLS certificates and keys. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html-single/proof_of_concept_-_deploying_red_hat_quay/index#advanced-quay-poc-deployment[Using SSL/TLS certificates].
41
+
=======
42
+
* Geo-Replication requires SSL/TLS certificates and keys. For more information, see * Geo-Replication requires SSL/TLS certificates and keys. For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/3/html/proof_of_concept_-_deploying_red_hat_quay/advanced-quay-poc-deployment[Proof of concept deployment using SSL/TLS certificates].
43
+
.
44
+
>>>>>>> 7068057f (Fixes some Clair exporting commands (#992))
40
45
41
46
If the above requirements cannot be met, you should instead use two or more distinct {productname} deployments and take advantage of repository mirroring functions.
{productname} does not have verbose logs, however, with the following procedures, you can obtain a detailed status check of your database pod or container.
59
59
60
+
[NOTE]
61
+
====
62
+
Additional debugging information can be returned if you have deployed {productname} in one of the following ways:
63
+
64
+
* You have deployed {productname} by passing in the `DEBUGLOG=true` variable.
65
+
* You have deployed {productname} with LDAP authentication enabled by passing in the `DEBUGLOG=true` and `USERS_DEBUG=1` variables.
66
+
* You have configured {productname-ocp} by updating the `QuayRegistry` resource to include `DEBUGLOG=true`.
67
+
68
+
For more information, see "Running {productname} in debug mode".
69
+
====
60
70
.Procedure
61
71
62
72
. Enter the following commands to examine verbose database logs.
. To view the debug logs, enter the following command:
17
+
+
18
+
[source,terminal]
19
+
----
20
+
$ podman logs <quay_container_name>
21
+
----
22
+
+
23
+
[IMPORTANT]
24
+
====
25
+
Setting `USERS_DEBUG=1` exposes credentials in clear text. This variable should be removed from the {productname} deployment after debugging. The log file that is generated with this environment variable should be scrutinized, and passwords should be removed before sending to other users. Use with caution.
. Update the `QuayRegistry` to add the following parameters:
17
+
+
18
+
[source,yaml]
19
+
----
20
+
spec:
21
+
- kind: quay
22
+
managed: true
23
+
overrides:
24
+
env:
25
+
- name: DEBUGLOG
26
+
value: "true"
27
+
----
28
+
29
+
. After the {productname} Operator has restarted with debugging enabled, try pulling an image from the registry. If it is still slow, dump all dogs from all `Quay` pods to a file, and check the files for more information.
Copy file name to clipboardexpand all lines: modules/running-quay-debug-mode-intro.adoc
+18-1
Original file line number
Diff line number
Diff line change
@@ -2,4 +2,21 @@
2
2
[id="running-quay-debug-mode-intro"]
3
3
= Running {productname} in debug mode
4
4
5
-
Red Hat recommends gathering your debugging information when opening a support case. Running {productname} in debug mode provides verbose logging to help administrators find more information about various issues. Enabling debug mode can speed up the process to reproduce errors and validate a solution for things like geo-replication deployments, Operator deployments, standalone {productname} deployments, object storage issues, and so on. Additionally, it helps the Red Hat Support to perform a root cause analysis.
5
+
Red Hat recommends gathering your debugging information when opening a support case. Running {productname} in debug mode provides verbose logging to help administrators find more information about various issues. Enabling debug mode can speed up the process to reproduce errors and validate a solution for things like geo-replication deployments, Operator deployments, standalone {productname} deployments, object storage issues, and so on. Additionally, it helps the Red Hat Support to perform a root cause analysis.
6
+
7
+
[id="debug-configuration-fields"]
8
+
== {productname} debug variables
9
+
10
+
{productname} offers two configuration fields that can be added to your `config.yaml` file to help diagnose issues or help obtain log information.
11
+
12
+
.Debug configuration variables
13
+
[cols="3a,1a,2a",options="header"]
14
+
|===
15
+
| Variable | Type | Description
16
+
| **DEBUGLOG** | Boolean | Whether to enable or disable debug logs. Must be `true` or `false`.
17
+
| **USERS_DEBUG** |Integer. Either `0` or `1`. | Used to debug LDAP operations in clear text, including passwords. Must be used with `DEBUGLOG=TRUE`. +
18
+
[IMPORTANT]
19
+
====
20
+
Setting `USERS_DEBUG=1` exposes credentials in clear text. This variable should be removed from the {productname} deployment after debugging. The log file that is generated with this environment variable should be scrutinized, and passwords should be removed before sending to other users. Use with caution.
. Update the `QuayRegistry` to add the following parameters:
40
-
+
41
-
[source,yaml]
42
-
----
43
-
spec:
44
-
- kind: quay
45
-
managed: true
46
-
overrides:
47
-
env:
48
-
- name: DEBUGLOG
49
-
value: "true"
50
-
----
51
-
52
-
. After the {productname} Operator has restarted with debugging enabled, try pulling an image from the registry. If it is still slow, dump all dogs from all `Quay` pods to a file, and check the files for more information.
0 commit comments