OrganizationPrune - Manage auto-pruning policies for organizations and user namespaces

The OrganizationPrune custom resource relies on a Secret resource to provide the connection parameters to the Quay instance. This Secret resource must include the following data:

  • host: URL for accessing the Quay API, such as https://quay.example.com:8443 for example.
  • validateCerts: Whether to allow insecure connections to the API. By default, insecure connections are refused.
  • token: OAuth access token for authenticating against the API. To create such a token see the Creating an OAuth Access Token documentation. You can also use the ApiToken custom resource to create this token.
  • username: The username to use for authenticating against the API. If token is set, then username is ignored.
  • password: The password to use for authenticating against the API. If token is set, then password is ignored.

You can create the secret by using the kubectl create secret command:

kubectl create secret generic quay-credentials --from-literal host=https://quay.example.com:8443 --from-literal validateCerts=false --from-literal token=vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku

Or you can create the secret from a resource file:

---
apiVersion: v1
kind: Secret
metadata:
  name: quay-credentials
stringData:
  host: https://quay.example.com:8443
  validateCerts: "false"
  token: vFYyU2D0fHYXvcA3Y5TYfMrIMyVIH9YmxoVLsmku

You refer to this secret in your OrganizationPrune custom resource by using the connSecretRef property. See the usage example.

Warning

Do not delete the Secret resource if a Quay custom resource still references it. If you delete the Secret resource, then the Operator cannot connect to the Quay API anymore, and cannot synchronize the Quay custom resource with its corresponding object in Quay. In addition, deleting the Quay custom resource does not complete because the Operator cannot delete the corresponding object in Quay.

If you face this issue, then edit the custom resource (kubectl edit), and set the .spec.preserveInQuayOnDeletion property to true. Alternatively, you can remove the .metadata.finalizers section. In both case, you must manually delete the corresponding object in Quay.

Usage Example

---
apiVersion: quay.herve4m.github.io/v1alpha1
kind: OrganizationPrune
metadata:
  name: organizationprune-sample
spec:
  # Connection parameters in a Secret resource
  connSecretRef:
    name: quay-credentials
    # By default, the operator looks for the secret in the same namespace as
    # the organizationprune resource, but you can specify a different namespace.
    # namespace: mynamespace

  # Whether to preserve the corresponding Quay object when you
  # delete the OrganizationPrune resource.
  preserveInQuayOnDeletion: false

  namespace: production
  method: date
  value: 7d
  tagPattern: stable
  tagPatternMatches: false

Properties

append

If true, then add the auto-pruning policy to the existing policies. If false, then the resource deletes all the existing auto-pruning policies before adding the specified policy.

Type: boolean

Required: False

Default value: True

connSecretRef

Reference to the secret resource that stores the connection parameters to the Quay Container Registry API. The secret must include the host, token (or username and password), and optionally the validateCerts keys.

Type: object (see the following properties)

Required: True

Default value: None

connSecretRef.name

Name of the secret resource.

Type: string

Required: True

Default value: None

connSecretRef.namespace

Namespace of the secret resource. By default, the secret resource is retrieved from the same namespace as the current OrganizationPrune resource.

Type: string

Required: False

Default value: None

method

Method to use for the auto-pruning tags policy. If tags, then the policy keeps only the number of tags that you specify in value. If date, then the policy deletes the tags older than the time period that you specify in value.

Type: string

Required: True

Default value: None

namespace

Organization or personal namespace. This namespace must exist.

Type: string

Required: True

Default value: None

preserveInQuayOnDeletion

Whether to preserve the corresponding Quay object when you delete the OrganizationPrune resource. When set to false (the default), the object is deleted from Quay.

Type: boolean

Required: False

Default value: False

retSecretRef

RetSecretRef is the secret resource that the OrganizationPrune resource creates. This secret will store the data that the resource generates:

  • id - Internal identifier of the auto-pruning policy.

Type: object (see the following properties)

Required: False

Default value: None

retSecretRef.name

Name of the secret resource.

Type: string

Required: True

Default value: None

retSecretRef.namespace

Namespace of the secret resource. By default, the secret resource is created in the same namespace as the current OrganizationPrune resource.

Type: string

Required: False

Default value: None

tagPattern

Regular expression to select the tags to process. If you do not set the parameter, then Quay processes all the tags.

Type: string

Required: False

Default value: None

tagPatternMatches

If true, then Quay processes the tags matching the tagPattern parameter. If false, then Quay excludes the tags matching the tagPattern parameter. true by default.

Type: boolean

Required: False

Default value: True

value

Number of tags to keep when method is tags. The value must be 1 or more. Period of time when method is date. The value must be 1 or more, and must be followed by a suffix; s (for second), m (for minute), h (for hour), d (for day), or w (for week).

Type: string

Required: True

Default value: None

Listing the OrganizationPrune Resources

You can retrieve the list of the OrganizationPrune custom resources in a namespace by using the kubectl get command:

kubectl get organizationprunes.quay.herve4m.github.io -n <namespace>