ManifestLabel - Manage Quay Container Registry image manifest labels

The ManifestLabel custom resource relies on a Secret resource to provide the connection parameters to the Quay instance. This Secret resource must include the following data:

• host: URL for accessing the Quay API, such as https://quay.example.com:8443 for example.
• validateCerts: Whether to allow insecure connections to the API. By default, insecure connections are refused.
• token: OAuth access token for authenticating against the API. To create such a token see the Creating an OAuth Access Token documentation. You can also use the ApiToken custom resource to create this token.
• username: The username to use for authenticating against the API. If token is set, then username is ignored.
• password: The password to use for authenticating against the API. If token is set, then password is ignored.

You can create the secret by using the kubectl create secret command:

kubectl create secret generic quay-credentials --from-literal host=https://quay.example.com:8443 --from-literal validateCerts=false --from-literal token=vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku

Or you can create the secret from a resource file:

---
apiVersion: v1
kind: Secret
metadata:
  name: quay-credentials
stringData:
  host: https://quay.example.com:8443
  validateCerts: "false"
  token: vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku

You refer to this secret in your ManifestLabel custom resource by using the connSecretRef property. See the usage example.

Usage Example

---
apiVersion: quay.herve4m.github.io/v1alpha1
kind: ManifestLabel
metadata:
  name: manifestlabel-sample
spec:
  # Connection parameters in a Secret resource
  connSecretRef:
    name: quay-credentials
    # By default, the operator looks for the secret in the same namespace as
    # the manifestlabel resource, but you can specify a different namespace.
    # namespace: mynamespace

  # Whether to preserve the corresponding Quay object when you
  # delete the resource.
  preserveInQuayOnDeletion: false

  image: production/smallimage:v1.4.3
  key: component
  value: front
  replace: true

  # The Secret resource is created or updated, and stores the returned data.
  # Some details of the manifest label are stored in this secret.
  retSecretRef:
    name: manifestlabel-sample-ret-secret
    # By default, the operator stores the secret in the same namespace as the
    # manifestlabel resource, but you can specify a different namespace.
    # namespace: mynamespace

Properties

connSecretRef

Reference to the secret resource that stores the connection parameters to the Quay Container Registry API. The secret must include the host, token (or username and password), and optionally the validateCerts keys.

Type: object (see the following properties)

Required: True

Default value: None

connSecretRef.name

Name of the secret resource.

Type: string

Required: True

Default value: None

connSecretRef.namespace

Namespace of the secret resource. By default, the secret resource is retrieved from the same namespace as the current ManifestLabel resource.

Type: string

Required: False

Default value: None

image

Manifest to update. The format is namespace/repository:tag or namespace/repository@digest. The namespace can be an organization or a personal namespace. If you omit the namespace part, then the resource looks for the repository in your personal namespace. If you omit the tag and the digest part, then latest is assumed.

Type: string

Required: True

Default value: None

key

Label's key.

Type: string

Required: True

Default value: None

preserveInQuayOnDeletion

Whether to preserve the corresponding Quay object when you delete the ManifestLabel resource. When set to false (the default), the object is deleted from Quay.

Type: boolean

Required: False

Default value: False

replace

Only used when state=present. If true, then the resource deletes all the labels that use the key you define in the key parameter before adding the new label. If false, then the resource adds the new label even if existing labels already use the key you define in the key parameter. Quay supports multiple labels with the same key.

Type: boolean

Required: False

Default value: True

retSecretRef

RetSecretRef is the secret resource that the ManifestLabel resource creates. This secret will store the data that the resource generates:

• id - Internal identifier of the label.
• key - Label's key.
• mediaType - Format of the label (text/plain or application/json).
• sourceType - Whether the label has been set by the Containerfile/Dockerfile manifest (manifest), or by an API call or from the web UI (api). Labels set in Containerfile/Dockerfile manifests are read-only.
• value - Label's value.

Type: object (see the following properties)

Required: False

Default value: None

retSecretRef.name

Name of the secret resource.

Type: string

Required: True

Default value: None

retSecretRef.namespace

Namespace of the secret resource. By default, the secret resource is created in the same namespace as the current ManifestLabel resource.

Type: string

Required: False

Default value: None

value

Labels value. Required whenstate=present'.

Type: string

Required: False

Default value: None

Listing the ManifestLabel Resources

You can retrieve the list of the ManifestLabel custom resources in a namespace by using the kubectl get command:

kubectl get manifestlabels.quay.herve4m.github.io -n <namespace>