Chapter 6. Retrieving configuration settings by using the API


To retrieve Red Hat Quay configuration settings from the command line, you can enable FEATURE_SUPERUSER_CONFIGDUMP and call the v1/superuser/config API endpoint with a superuser OAuth 2 access token. As a Red Hat Quay superuser, you can return all Flask configuration fields that are set, which you can use to show proof of compliance for various security policies, such as PCI-DSS 4.0.

Prerequisites

  • You have set FEATURE_SUPERUSER_CONFIGDUMP: true in your config.yaml file.
  • You have assigned the superuser role to a user in your config.yaml file.
  • You have generated an OAuth 2 access token for the superuser.

Procedure

  • Retrieve configuration settings by using the v1/superuser/config API endpoint. For example:

    $ curl -X GET -H "Authorization: Bearer <bearer_token>" "http://<quay-server.example.com>/api/v1/superuser/config" | jq -r .config

    Example output

    ...
      "TEAM_RESYNC_STALE_TIME": "30m",
      "UI_DELAY_AFTER_WRITE_SECONDS": 3,
      "UI_MODELCARD_ANNOTATION": {},
      "UI_MODELCARD_ARTIFACT_TYPE": "application/x-mlmodel",
      "UI_MODELCARD_LAYER_ANNOTATION": {
        "org.opencontainers.image.title": "README.md"
      }
    ...

  • You can pass in one of .config, .env, .warning, or .schema to return specific information. For example:

    $ curl -X GET -H "Authorization: Bearer <bearer_token>" "http://<quay-server.example.com>/api/v1/superuser/config" | jq -r .warning

    Example output

    ...
      "BILLING_TYPE": "FakeStripe",
      "BUILDLOGS_OPTIONS": [],
      "BUILD_MANAGER": null,
      "CDN_SPECIFIC_NAMESPACES": [],
      "CHANNEL_COLORS": [
      ]
    ...

Red Hat Quay 3.18 adds configuration fields for QuayRegistry TLS Secrets and related status conditions. You can use these fields when you deploy Red Hat Quay on OpenShift Container Platform with an external TLS Secret.

6.1.1. QuayRegistry TLS component fields

The following fields apply to the tls entry in spec.components of the QuayRegistry CR when deploying Red Hat Quay on OpenShift Container Platform.

Table 6.1. QuayRegistry TLS component fields
FieldTypeDescription

secretRef

Object

References an external TLS Secret in the same namespace as the QuayRegistry. Valid only when managed is false. The Secret must be of type kubernetes.io/tls and contain tls.crt and tls.key data keys. The Operator watches the Secret and triggers a rolling restart of Red Hat Quay pods when certificate data changes. Do not use with ssl.cert and ssl.key files in the configBundleSecret.

secretRef.name

String

Name of the Kubernetes Secret that stores the TLS certificate and private key.

Table 6.2. QuayRegistry TLS status condition
ConditionTypeDescription

ComponentTLSReady

Status

Reports whether TLS from the configured source (external Secret or config bundle) is valid and applied to the registry deployment.

Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

Legal Notice

Theme

© 2026 Red Hat
Back to top