Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-5021

Remove the config editor

XMLWordPrintable

    • Remove the config editor
    • False
    • None
    • False
    • Green
    • 0% To Do, 0% In Progress, 100% Done

      Story: As a Quay administrator I want to disable remove the config-editor deployed by the Quay Operator so that I have a full audit-trail on the registry configuration.

      Background: By default the config editor is deployed for every QuayRegistry instance which makes it difficult to establish an audit-trail over the registry's configuration. Anyone with access to the namespace, config editor secret and config editor route can use the config editor to make changes to the Quay configuration and their identity will not be logged anywhere in the system. By disabling  removing the config-editor any config change will be forced through the config bundle property of the QuayRegistry resource which points to a Secret which is then subject to native Kubernetes auditing and logging.

      Acceptance criteria:

      • the config editor becomes a managed component
      • the config editor is enabled by default removed and no longer available in an operator deployment
      • the config editor can be disabled by setting its component to unmanaged
      • during updates from previous Quay operator versions the config editor component will be instantiated as a managed component which is enabled

              jonathankingfc Jonathan King
              DanielMesser Daniel Messer
              Votes:
              0 Vote for this issue
              Watchers:
              11 Start watching this issue

                Created:
                Updated:
                Resolved: