ManifestLabel - Manage Quay Container Registry image manifest labels
The ManifestLabel custom resource relies on a Secret resource to provide the connection parameters to the Quay instance. This Secret resource must include the following data:
host
: URL for accessing the Quay API, such ashttps://quay.example.com:8443
for example.validateCerts
: Whether to allow insecure connections to the API. By default, insecure connections are refused.token
: OAuth access token for authenticating against the API. To create such a token see the Creating an OAuth Access Token documentation. You can also use the ApiToken custom resource to create this token.username
: The username to use for authenticating against the API. Iftoken
is set, thenusername
is ignored.password
: The password to use for authenticating against the API. Iftoken
is set, thenpassword
is ignored.
You can create the secret by using the kubectl create secret
command:
kubectl create secret generic quay-credentials --from-literal host=https://quay.example.com:8443 --from-literal validateCerts=false --from-literal token=vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku
Or you can create the secret from a resource file:
---
apiVersion: v1
kind: Secret
metadata:
name: quay-credentials
stringData:
host: https://quay.example.com:8443
validateCerts: "false"
token: vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku
You refer to this secret in your ManifestLabel custom resource by using the connSecretRef
property.
See the usage example.
Warning
Do not delete the Secret resource if a Quay custom resource still references it. If you delete the Secret resource, then the Operator cannot connect to the Quay API anymore, and cannot synchronize the Quay custom resource with its corresponding object in Quay. In addition, deleting the Quay custom resource does not complete because the Operator cannot delete the corresponding object in Quay.
If you face this issue, then edit the custom resource (kubectl edit
), and set the .spec.preserveInQuayOnDeletion property to true
.
Alternatively, you can remove the .metadata.finalizers
section.
In both case, you must manually delete the corresponding object in Quay.
Usage Example
---
apiVersion: quay.herve4m.github.io/v1alpha1
kind: ManifestLabel
metadata:
name: manifestlabel-sample
spec:
# Connection parameters in a Secret resource
connSecretRef:
name: quay-credentials
# By default, the operator looks for the secret in the same namespace as
# the manifestlabel resource, but you can specify a different namespace.
# namespace: mynamespace
# Whether to preserve the corresponding Quay object when you
# delete the ManifestLabel resource.
preserveInQuayOnDeletion: false
image: production/smallimage:v1.4.3
key: component
value: front
replace: true
# The Secret resource is created or updated, and stores the returned data.
# Some details of the manifest label are stored in this secret.
retSecretRef:
name: manifestlabel-sample-ret-secret
# By default, the operator stores the secret in the same namespace as the
# manifestlabel resource, but you can specify a different namespace.
# namespace: mynamespace
Properties
connSecretRef
Reference to the secret resource that stores the connection parameters to the Quay Container Registry API.
The secret must include the host
, token
(or username
and password
), and optionally the validateCerts
keys.
Type: object (see the following properties)
Required: True
Default value: None
connSecretRef.name
Name of the secret resource.
Type: string
Required: True
Default value: None
connSecretRef.namespace
Namespace of the secret resource. By default, the secret resource is retrieved from the same namespace as the current ManifestLabel resource.
Type: string
Required: False
Default value: None
image
Manifest to update. The format is namespace
/repository
:tag
or namespace
/repository
@digest
. The namespace can be an organization or a personal namespace. If you omit the namespace part, then the resource looks for the repository in your personal namespace. If you omit the tag and the digest part, then latest
is assumed.
Type: string
Required: True
Default value: None
key
Label's key.
Type: string
Required: True
Default value: None
preserveInQuayOnDeletion
Whether to preserve the corresponding Quay object when you delete the ManifestLabel resource. When set to false
(the default), the object is deleted from Quay.
Type: boolean
Required: False
Default value: False
replace
Only used when state=present
. If true
, then the resource deletes all the labels that use the key you define in the key
parameter before adding the new label. If false
, then the resource adds the new label even if existing labels already use the key you define in the key
parameter. Quay supports multiple labels with the same key.
Type: boolean
Required: False
Default value: True
retSecretRef
RetSecretRef is the secret resource that the ManifestLabel resource creates. This secret will store the data that the resource generates:
- id - Internal identifier of the label.
- key - Label's key.
- mediaType - Format of the label (
text/plain
orapplication/json
). - sourceType - Whether the label has been set by the Containerfile/Dockerfile manifest (
manifest
), or by an API call or from the web UI (api
). Labels set in Containerfile/Dockerfile manifests are read-only. - value - Label's value.
Type: object (see the following properties)
Required: False
Default value: None
retSecretRef.name
Name of the secret resource.
Type: string
Required: True
Default value: None
retSecretRef.namespace
Namespace of the secret resource. By default, the secret resource is created in the same namespace as the current ManifestLabel resource.
Type: string
Required: False
Default value: None
value
Labels value. Required when
state=present'.
Type: string
Required: False
Default value: None
Listing the ManifestLabel Resources
You can retrieve the list of the ManifestLabel custom resources in a namespace by using the kubectl get
command:
kubectl get manifestlabels.quay.herve4m.github.io -n <namespace>