Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-5021

Remove the config editor

    XMLWordPrintable

Details

    • Remove the config editor
    • False
    • None
    • False
    • Green
    • 100
    • 100% 100%
    • 0

    Description

      Story: As a Quay administrator I want to disable remove the config-editor deployed by the Quay Operator so that I have a full audit-trail on the registry configuration.

      Background: By default the config editor is deployed for every QuayRegistry instance which makes it difficult to establish an audit-trail over the registry's configuration. Anyone with access to the namespace, config editor secret and config editor route can use the config editor to make changes to the Quay configuration and their identity will not be logged anywhere in the system. By disabling  removing the config-editor any config change will be forced through the config bundle property of the QuayRegistry resource which points to a Secret which is then subject to native Kubernetes auditing and logging.

      Acceptance criteria:

      • the config editor becomes a managed component
      • the config editor is enabled by default removed and no longer available in an operator deployment
      • the config editor can be disabled by setting its component to unmanaged
      • during updates from previous Quay operator versions the config editor component will be instantiated as a managed component which is enabled

      Attachments

        Activity

          People

            jonathankingfc Jonathan King
            DanielMesser Daniel Messer
            Votes:
            0 Vote for this issue
            Watchers:
            11 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: