Skip to content

Commit 8d6b6b6

Browse files
stevsmitSteven Smith
stevsmit
and
Steven Smith
authored
Adds new api config endpoint (quay#1363)
Co-authored-by: Steven Smith <[email protected]>
1 parent 21b1b71 commit 8d6b6b6

File tree

7 files changed

+204
-9
lines changed

7 files changed

+204
-9
lines changed

‎api_reference/master.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,7 @@ include::modules/api-secscan.adoc[leveloffset=+1]
207207
include::modules/api-secscan-getRepoManifestSecurity.adoc[leveloffset=+2]
208208
//done
209209
include::modules/api-superuser.adoc[leveloffset=+1]
210+
include::modules/api-superuser-configDump.adoc[leveloffset=+2]
210211
include::modules/api-superuser-createInstallUser.adoc[leveloffset=+2]
211212
include::modules/api-superuser-deleteInstallUser.adoc[leveloffset=+2]
212213
include::modules/api-superuser-listAllUsers.adoc[leveloffset=+2]

‎config_quay/master.adoc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ include::modules/operator-config-bundle-secret.adoc[leveloffset=+3]
2525
include::modules/modifying-config-bundle-secret-ui.adoc[leveloffset=+4]
2626
include::modules/operator-config-cli-download.adoc[leveloffset=+4]
2727

28+
//Obtaining config field by using the API
29+
include::modules/retrieving-config-api.adoc[leveloffset=+1]
30+
31+
2832
//include::modules/config-updates-313.adoc[leveloffset=+2]
2933
//include::modules/config-updates-312.adoc[leveloffset=+2]
3034
//include::modules/config-updates-311.adoc[leveloffset=+2]

‎modules/api-superuser-configDump.adoc‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
= getConfigDump
2+
Returns the full configuration dump of the Quay instance.
3+
4+
[discrete]
5+
== GET /api/v1/superuser/config
6+
7+
Authorizations: oauth2_implicit (super:user)
8+
9+
[discrete]
10+
== Responses
11+
12+
[options="header", width=100%, cols=".^2a,.^14a,.^4a"]
13+
|===
14+
|HTTP Code|Description|Schema
15+
|201|Successful creation|
16+
|400|Bad Request|&lt;&lt;_apierror,ApiError&gt;&gt;
17+
|401|Session required|&lt;&lt;_apierror,ApiError&gt;&gt;
18+
|403|Unauthorized access|&lt;&lt;_apierror,ApiError&gt;&gt;
19+
|404|Not found|&lt;&lt;_apierror,ApiError&gt;&gt;
20+
|===
21+
22+
[discrete]
23+
== Response structure
24+
25+
The JSON response includes the following top-level keys:
26+
27+
[cols="3a,9a,4a",options="header"]
28+
|===
29+
|Name|Description|Schema
30+
|.config|All config.yaml and defaulted parameters used by the Flask app that are part of the defined schema.|object
31+
|.warning|Any parameters from config.yaml or defaults that are not defined in the schema.|object
32+
|.env|All environment variables available to the Flask app.|object
33+
|.schema|The complete config schema (CONFIG_SCHEMA) defining expected keys and types.|object
34+
|===
35+
36+
[discrete]
37+
== Example command
38+
39+
[source,terminal]
40+
----
41+
$ curl -X GET -H "Authorization: Bearer <bearer_token>"
42+
"https://<quay-server.example.com>/api/v1/superuser/config" | jq -r .config
43+
----

‎modules/config-fields-user.adoc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,10 @@ The user configuration fields define how user accounts behave in your {productna
5858

5959
*Default:* `False`
6060

61+
|*FEATURE_SUPERUSER_CONFIGDUMP* |Boolean | Enables a full config dump of the running Framework, environment and schema for validation. +
62+
+
63+
**Default:** `false`
64+
6165
| **FEATURE_RESTRICTED_USERS** | Boolean | When set to `True` with `RESTRICTED_USERS_WHITELIST`:
6266

6367
* All normal users and superusers are restricted from creating organizations or content in their own namespace unless they are allowlisted via `RESTRICTED_USERS_WHITELIST`.
@@ -82,6 +86,7 @@ FEATURE_INVITE_ONLY_USER_CREATION: false
8286
FEATURE_USER_RENAME: true
8387
FEATURE_SUPERUSERS_FULL_ACCESS: true
8488
FEATURE_SUPERUSERS_ORG_CREATION_ONLY: false
89+
FEATURE_SUPERUSER_CONFIGDUMP: true
8590
FEATURE_RESTRICTED_USERS: true
8691
RESTRICTED_USERS_WHITELIST: <1>
8792
- user1

‎modules/config-updates-315.adoc‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,29 @@ The `SKOPEO_TIMEOUT_INTERVAL` has been added. With this configuration field, {pr
1616
**Default:** `300`
1717
|===
1818

19-
.Skopeo timeout xample YAML
19+
.Skopeo timeout example YAML
2020
[source,yaml]
2121
----
2222
SKOPEO_TIMEOUT_INTERVAL: 300
23+
----
24+
25+
[id="superuser-config-dump"]
26+
== Superuser configDump
27+
28+
The `FEATURE_SUPERUSER_CONFIGDUMP` configuration field has been added. With this field, {productname} superusers can leverage the `configDump` API field to return all Flask configuration fields that are set. This can be used to show proof of compliance for various security policies, such as PCI-DSS4.0. To use this field, superusers must be defined in the `config.yaml` file via the `SUPER_USERS` configuration field.
29+
30+
.configDump configuration field
31+
|===
32+
| Field | Type | Description
33+
|*FEATURE_SUPERUSER_CONFIGDUMP* |Boolean | Enables a full config dump of the running Framework, environment and schema for validation. +
34+
+
35+
**Default:** `false`
36+
|===
37+
38+
.Superuser configDump example YAML
39+
[source,yaml]
40+
----
41+
# ...
42+
FEATURE_SUPERUSER_CONFIGDUMP: true
43+
# ...
2344
----

‎modules/retrieving-config-api.adoc‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Document included in the following assemblies:
2+
3+
// Configuring Red hat Quay
4+
5+
:_content-type: REFERENCE
6+
[id="retrieving-config-file-api"]
7+
= Retrieving the configuration file by using the API
8+
9+
The `config.yaml` file can be returned on the CLI by leveraging the `FEATURE_SUPERUSER_CONFIGDUMP` configuration field alongside the `v1/superuser/config` API endpoint. Together, {productname} superusers can return all Flask configuration fields that are set, which can be used to show proof of compliance for various security policies, such as PCI-DSS4.0.
10+
11+
.Prerequisites
12+
13+
* You have set `FEATURE_SUPERUSER_CONFIGDUMP: true` in your `config.yaml` file.
14+
* You have set `BROWSER_API_CALLS_XHR_ONLY: false` in your `config.yaml` file.
15+
* You have assigned the superuser role to a user in your `config.yaml` file.
16+
* You have generated an OAuth 2 access token for the superuser.
17+
18+
.Procedure
19+
20+
* Retrieve the `config.yaml` file by using the `v1/superuser/config` API endpoint. For example:
21+
+
22+
[source,terminal]
23+
----
24+
$ curl -X GET -H "Authorization: Bearer <bearer_token>" "http://<quay-server.example.com>/api/v1/superuser/config" | jq -r .config
25+
----
26+
+
27+
.Example output
28+
+
29+
[source,terminal]
30+
----
31+
...
32+
"TEAM_RESYNC_STALE_TIME": "30m",
33+
"UI_DELAY_AFTER_WRITE_SECONDS": 3,
34+
"UI_MODELCARD_ANNOTATION": {},
35+
"UI_MODELCARD_ARTIFACT_TYPE": "application/x-mlmodel",
36+
"UI_MODELCARD_LAYER_ANNOTATION": {
37+
"org.opencontainers.image.title": "README.md"
38+
}
39+
...
40+
----
41+
42+
* You can pass in one of `.config`, `.env`, `.warning`, or `.schema` to return specific information. For example:
43+
+
44+
[source,terminal]
45+
----
46+
$ curl -X GET -H "Authorization: Bearer <bearer_token>" "http://<quay-server.example.com>/api/v1/superuser/config" | jq -r .warning
47+
----
48+
+
49+
.Example output
50+
+
51+
[source,terminal]
52+
----
53+
...
54+
"BILLING_TYPE": "FakeStripe",
55+
"BUILDLOGS_OPTIONS": [],
56+
"BUILD_MANAGER": null,
57+
"CDN_SPECIFIC_NAMESPACES": [],
58+
"CHANNEL_COLORS": [
59+
]
60+
...
61+
----

‎modules/rn_3_15_0.adoc‎

Lines changed: 68 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,6 @@ Previously, when pulling from a proxied repository, only the layers explicitly r
4040

4141
With this release, {productname} now caches all layers when an image is pulled from a proxied repository. This enhancement ensures that Clair can scan all images and that images remain pullable even if the upstream registry becomes unavailable.
4242

43-
[id="clair-enhancements"]
44-
=== Clair enhancements
45-
4643
[id="new-quay-config-fields-315"]
4744
== {productname} configuration fields updates and changes
4845

@@ -51,8 +48,9 @@ The following configuration fields have been added to {productname} 3.15.
5148
[id="skopeo-timeout-configuration-field"]
5249
=== Skopeo timeout interval
5350

54-
The `SKOPEO_TIMEOUT_INTERVAL` has been added. With this configuration field, {productname} administrators can adjust the time, in seconds, that a mirroring job runs before it times out. This field is required and defaults at `300` seconds, or 5 minutes. It cannot be set lower than `300` seconds.
51+
The `SKOPEO_TIMEOUT_INTERVAL` configuration field has been added. With this field, {productname} administrators can adjust the time, in seconds, that a mirroring job runs before it times out. This field is required and defaults at `300` seconds, or 5 minutes. It cannot be set lower than `300` seconds.
5552

53+
.Skopeo timeout configuration field
5654
|===
5755
| Field | Type | Description
5856
|*SKOPEO_TIMEOUT_INTERVAL* |Integer | Number of seconds mirroring job will run before timing out. +
@@ -63,15 +61,40 @@ The `SKOPEO_TIMEOUT_INTERVAL` has been added. With this configuration field, {pr
6361
.Skopeo timeout example YAML
6462
[source,yaml]
6563
----
64+
# ...
6665
SKOPEO_TIMEOUT_INTERVAL: 300
66+
# ...
67+
----
68+
69+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/manage_red_hat_quay/index#repo-mirroring-in-red-hat-quay[Repository mirroring].
70+
71+
[id="superuser-config-dump"]
72+
=== Superuser configDump
73+
74+
The `FEATURE_SUPERUSER_CONFIGDUMP` configuration field has been added. With this field, {productname} superusers can leverage the `configDump` API field to return all Flask configuration fields that are set. This can be used to show proof of compliance for various security policies, such as PCI-DSS4.0. To use this field, superusers must be defined in the `config.yaml` file via the `SUPER_USERS` configuration field.
75+
76+
.configDump configuration field
77+
|===
78+
| Field | Type | Description
79+
|*FEATURE_SUPERUSER_CONFIGDUMP* |Boolean | Enables a full config dump of the running Framework, environment and schema for validation. +
80+
+
81+
**Default:** `false`
82+
|===
83+
84+
.Superuser configDump example YAML
85+
[source,yaml]
86+
----
87+
# ...
88+
FEATURE_SUPERUSER_CONFIGDUMP: true
89+
# ...
6790
----
6891

69-
For more information, see
92+
For more information, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/configure_red_hat_quay/index#retrieving-config-file-api[Retrieiving the configuration file by using the API].
7093

7194
[id="new-api-endpoints-315"]
7295
== API endpoint enhancements
7396

74-
No the following API endpoints were added in {productname} 3.15.
97+
The following API endpoints were added in {productname} 3.15.
7598

7699
[id="skopeo-timeout-api-endpoint"]
77100
=== Skopeo timeout interval
@@ -83,10 +106,47 @@ A new parameter, `SKOPEO_TIMEOUT_INTERVAL`, has been added to the `createRepoMir
83106
|*skopeo_timeout_interval* |Number of seconds mirroring job will run before timing out | Integer
84107
|===
85108

86-
See the link:https://docs.redhat.com/en/documentation/red_hat_quay/3.14/html/red_hat_quay_api_reference/mirror#createrepomirrorconfig[createRepoMirrorConfig] endpoint for more information.
109+
See the link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html/red_hat_quay_api_reference/mirror#createrepomirrorconfig[createRepoMirrorConfig] endpoint for more information.
110+
111+
[id="api-v1-superuser-config"]
112+
=== Superuser configDump
113+
114+
A new superuser API parameter, `v1/superuser/config`, has been added to the {productname} API. With this field, superusers can return all Flask configuration fields that are set. This can be used to show proof of compliance for various security policies, such as PCI-DSS4.0.
115+
116+
|===
117+
|Name|Description|Schema
118+
119+
|**configDump** +
120+
_optional_|Returns a structured JSON dump of the current configuration, including values from `config.yaml` (`.config`), default parameters (`.warning`), environment variables (`.env`), and schema (`.schema`) types. Sensitive fields are obfuscated. Useful for audit/compliance validation (e.g., PCI-DSS 4.0). |object
121+
122+
|===
123+
124+
For example API commands, see link:https://docs.redhat.com/en/documentation/red_hat_quay/{producty}/html-single/red_hat_quay_api_reference/index#superuser[Red Hat Quay API superuser commands].
125+
126+
127+
[id="notable-technical-changes-315"]
128+
== Notable technical changes
129+
130+
The following section highlights notable technical changes for {productname} 3.15.
131+
132+
[id="model-card-disable"]
133+
=== Model card rendering disabled by default
134+
135+
In {productname} 3.14, model card rendering was made available on the v2 UI for machine learning models. This feature was enabled by default via the `FEATURE_UI_MODELCARD` parameter.
136+
137+
With {productname} 3.15, this feature is now disabled by default. To view model cards on the v2 UI, you must set the `FEATURE_UI_MODELCARD` field to `true`. For example:
138+
139+
[source,yaml]
140+
----
141+
# ...
142+
FEATURE_UI_MODELCARD: true
143+
# ...
144+
----
145+
146+
This change will be reverted in a future version of {productname}.
87147

88148
[id="known-issues-and-limitations-315"]
89-
== {productname} {producty} known issues and limitations
149+
== Known issues and limitations
90150

91151
The following sections note known issues and limitations for {productname} 3.15.
92152

0 commit comments

Comments
 (0)