Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-4706

Quay 3.8.0 GLOBAL_READONLY_SUPER_USERS doesn't work

XMLWordPrintable

    • False
    • None
    • False

      Description:

      This is a new issue of Quay 3.8.0 new feature "GLOBAL_READONLY_SUPER_USERS", after config user quay to the list of GLOBAL_READONLY_SUPER_USERS, found this user can still create new organizations, repo, etc. Pls review this issue.

      GLOBAL_READONLY_SUPER_USERS:
      - quay
      SUPER_USERS:
      - admin 
      Quay 3.8.0 user "quay" is configured as global readonly user:

      Quay Image:  quay-operator-bundle-container-v3.8.0-108

      oc get pod
      NAME                                       READY   STATUS      RESTARTS      AGE
      quay-clair-app-5589b69bb4-2vmgw            1/1     Running     0             23m
      quay-clair-app-5589b69bb4-z8v2d            1/1     Running     0             30m
      quay-clair-postgres-5d96b69bd6-96vhz       1/1     Running     1 (29m ago)   30m
      quay-operator.v3.8.0-7cc8fc8746-4sm2k      1/1     Running     0             89m
      quay-quay-app-7cdf59974c-2dzjw             1/1     Running     0             18m
      quay-quay-app-7cdf59974c-qtqpb             1/1     Running     0             19m
      quay-quay-app-upgrade-p2xfm                0/1     Completed   0             30m
      quay-quay-config-editor-86b5b9d4d9-8hbg8   1/1     Running     0             19m
      quay-quay-database-68bc965664-mln5n        1/1     Running     0             30m
      quay-quay-mirror-7944b5c448-bgn98          1/1     Running     0             18m
      quay-quay-mirror-7944b5c448-z2gr2          1/1     Running     0             18m
      quay-quay-redis-f4dbb587-5fp6c             1/1     Running     0             30m
      
      
      cat conf/stack/config.yaml 
      ALLOW_PULLS_WITHOUT_STRICT_LOGGING: false
      AUTHENTICATION_TYPE: Database
      BUILDLOGS_REDIS:
        host: quay-quay-redis
        port: 6379
      DATABASE_SECRET_KEY: SYEGcAD2KK3mdiQBVca18PDt-cw62ORtRkypMuX47IxX14JP0oa56sl-ZcEvMrTWCD6lOVJ27xw-UKu1
      DB_CONNECTION_ARGS:
        autorollback: true
        threadlocals: true
      DB_URI: postgresql://quay-quay-database:g1xJRhxmyyG6v-5IW5y0UfHw3TOL4OeqFW6vy4ym6SH3ogeAcQV80LPFP85lBmmRou4NynpDACbx5kkV@quay-quay-database:5432/quay-quay-database
      DEFAULT_TAG_EXPIRATION: 2w
      DISTRIBUTED_STORAGE_CONFIG:
        local_us:
        - RHOCSStorage
        - access_key: oVwbfRSJNhwPIKULUt9k
          bucket_name: quay-datastore-88694230-a8c2-4769-9d70-85ca075c2c7d
          hostname: s3.openshift-storage.svc.cluster.local
          is_secure: true
          port: 443
          secret_key: TkH7k/IdSF1HvKTJkQAUogrV2wEoHm5ZHhuUxJoo
          storage_path: /datastorage/registry
      DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS:
      - local_us
      DISTRIBUTED_STORAGE_PREFERENCE:
      - local_us
      ENTERPRISE_LOGO_URL: /static/img/RH_Logo_Quay_Black_UX-horizontal.svg
      EXTERNAL_TLS_TERMINATION: true
      FEATURE_BUILD_SUPPORT: false
      FEATURE_DIRECT_LOGIN: true
      FEATURE_MAILING: false
      FEATURE_PROXY_STORAGE: true
      FEATURE_REPO_MIRROR: true
      FEATURE_SECURITY_NOTIFICATIONS: true
      FEATURE_SECURITY_SCANNER: true
      FEATURE_STORAGE_REPLICATION: false
      FEATURE_SUPERUSERS_FULL_ACCESS: true
      FEATURE_UI_V2: true
      GLOBAL_READONLY_SUPER_USERS:
      - quay
      PREFERRED_URL_SCHEME: https
      REGISTRY_TITLE: Red Hat Quay
      REGISTRY_TITLE_SHORT: Red Hat Quay
      REPO_MIRROR_INTERVAL: 30
      REPO_MIRROR_TLS_VERIFY: true
      SECRET_KEY: buknreOv4FDQcR9mAgeuoLwaCVeuRYXqxg0WZsrk3NeVan3oHhK13Vn4r8dB82FNUSAid46P2wfkTcHT
      SECURITY_SCANNER_INDEXING_INTERVAL: 30
      SECURITY_SCANNER_V4_ENDPOINT: http://quay-clair-app.quay-enterprise-13325.svc.cluster.local
      SECURITY_SCANNER_V4_NAMESPACE_WHITELIST:
      - admin
      SECURITY_SCANNER_V4_PSK: ek5HaEZ4SVMzb0dIeUNCNEpGYmo4bVRCc2lYNmNLLTA=
      SERVER_HOSTNAME: quay-quay-quay-enterprise-13325.apps.quaytest-13325.qe.devcluster.openshift.com
      SETUP_COMPLETE: true
      SUPER_USERS:
      - admin
      TAG_EXPIRATION_OPTIONS:
      - 2w
      TEAM_RESYNC_STALE_TIME: 60m
      TESTING: false
      USER_EVENTS_REDIS:
        host: quay-quay-redis
        port: 6379 

            sleesinc Kenny Lee Sin Cheong
            lzha1981 luffy zhang
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: