Chapter 11. Configuring AWS STS for Red Hat Quay

Procedure

1. Update your config.yaml file for Red Hat Quay to include the following information:

   # ...
   DISTRIBUTED_STORAGE_CONFIG:
      default:
       - STSS3Storage
       - sts_role_arn: <role_arn>
         s3_bucket: <s3_bucket_name>
         storage_path: <storage_path>
         s3_region: <region>
         sts_user_access_key: <s3_user_access_key>
         sts_user_secret_key: <s3_user_secret_key>
   # ...

   where:

   sts_role_arn

   Specifies the unique Amazon Resource Name (ARN) required when configuring AWS STS.

   s3_bucket

   Specifies the name of your S3 bucket.

   storage_path

   Specifies the storage path for data. Usually /datastorage.

   s3_region

   Specifies the Amazon Web Services region. Defaults to us-east-1.

   sts_user_access_key

   Specifies the generated AWS S3 user access key required when configuring AWS STS.

   sts_user_secret_key

   Specifies the generated AWS S3 user secret key required when configuring AWS STS.

2. Restart your Red Hat Quay deployment.

Verification

1. Tag a sample image, for example, busybox, that you push to the repository. For example:

   $ podman tag docker.io/library/busybox <quay-server.example.com>/<organization_name>/busybox:test

2. Push the sample image by running the following command:

   $ podman push <quay-server.example.com>/<organization_name>/busybox:test

3. Verify that the push was successful by navigating to the Organization that you pushed the image to in your Red Hat Quay registry Tags.
4. Navigate to the Amazon Web Services (AWS) console and locate your S3 bucket.
5. Click the name of your S3 bucket.
6. On the Objects page, click datastorage/.

7. On the datastorage/ page, the following resources should appear:

   • sha256/

   • uploads/

     These resources indicate that the push was successful, and that AWS STS is properly configured.