Skip to content

Commit 253f081

Browse files
stevsmitSteven Smith
stevsmit
and
Steven Smith
authored
Starts authentication book for Quay (#1072)
Co-authored-by: Steven Smith <stevsmit@stevsmit-thinkpadt14gen4.remote.csb>
1 parent f104487 commit 253f081

9 files changed

+41
-12
lines changed

‎deploy_quay/master.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ include::modules/advanced-quay-poc-deployment.adoc[leveloffset=+1]
4747
include::modules/ssl-intro.adoc[leveloffset=+2]
4848
include::modules/ssl-create-certs.adoc[leveloffset=+3]
4949
include::modules/configuring-ssl-tls.adoc[leveloffset=+2]
50-
include::modules/ssl-config-ui.adoc[leveloffset=+3]
50+
//include::modules/ssl-config-ui.adoc[leveloffset=+3]
5151
include::modules/ssl-config-cli.adoc[leveloffset=+3]
5252
include::modules/testing-ssl-tls-configuration.adoc[leveloffset=+2]
5353
include::modules/ssl-testing-cli.adoc[leveloffset=+3]

‎modules/configuring-ssl-tls.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
[id="configuring-ssl-tls"]
33
= Configuring SSL/TLS
44

5-
SSL/TLS can be configured using either the command-line interface (CLI) or the {productname} registry UI. Use one of the following procedures to configure SSL/TLS.
5+
SSL/TLS must be configured by using the command-line interface (CLI) and updating your `config.yaml` file manually.

‎modules/ssl-create-certs.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
[id="creating-a-certificate-authority"]
33
= Creating a Certificate Authority
44

5-
Use the following procedure to create a Certificate Authority (CA).
5+
To configure {productname} with a self-signed certificate, you must first create a Certificate Authority (CA). Use the following procedure to create a Certificate Authority (CA).
66

77
.Procedure
88

@@ -63,6 +63,7 @@ Locality Name (eg, city) [Default City]:GALWAY
6363
Organization Name (eg, company) [Default Company Ltd]:QUAY
6464
Organizational Unit Name (eg, section) []:DOCS
6565
Common Name (eg, your name or your server's hostname) []:quay-server.example.com
66+
Email Address []:
6667
----
6768

6869
. Create a configuration file `openssl.cnf`, specifying the server hostname, for example:

‎modules/ssl-intro.adoc

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,4 @@
11
[id="introduction-using-ssl"]
22
= Using SSL/TLS
33

4-
To configure {productname} with a self-signed certificate, you must create a Certificate Authority (CA) and a primary key file named `ssl.cert` and `ssl.key`.
5-
6-
[NOTE]
7-
====
8-
The following examples assume that you have configured the server hostname `quay-server.example.com` using DNS or another naming mechanism, such as adding an entry in your `/etc/hosts` file. For more information, see "Configuring port mapping for {productname}".
9-
====
4+
To configure {productname} with a self-signed certificate, you must create a Certificate Authority (CA) and a primary key file named `ssl.cert` and `ssl.key`.

‎modules/ssl-testing-cli.adoc

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,20 @@
22
[id="testing-ssl-tls-configuration-using-cli"]
33
= Testing the SSL/TLS configuration using the CLI
44

5+
Your SSL/TLS configuration can be tested by using the command-line interface (CLI). Use the following procedure to test your SSL/TLS configuration.
6+
57
Use the following procedure to test your SSL/TLS configuration using the CLI.
68

79
.Procedure
810

9-
* Enter the following command to attempt to log in to the {productname} registry with SSL/TLS enabled:
11+
. Enter the following command to attempt to log in to the {productname} registry with SSL/TLS enabled:
1012
+
1113
[source,terminal]
1214
----
1315
$ sudo podman login quay-server.example.com
1416
----
1517
+
16-
Example output
18+
.Example output
1719
+
1820
[source,terminal]
1921
----

‎modules/testing-ssl-tls-configuration.adoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
[id="testing-ssl-tls-configuration"]
33
= Testing the SSL/TLS configuration
44

5-
Your SSL/TLS configuration can be tested using either the command-line interface (CLI) or the {productname} registry UI. Use one of the following procedures to test your SSL/TLS configuration.
5+
Your SSL/TLS configuration can be tested by using the command-line interface (CLI). Use the following procedure to test your SSL/TLS configuration.

‎tls_config/docinfo.xml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<productname>{productname}</productname>
2+
<productnumber>{producty}</productnumber>
3+
<subtitle>Configuring SSL/TLS for {productname}</subtitle>
4+
<abstract>
5+
<para>Using SSL/TLS with {productname}</para>
6+
</abstract>
7+
<authorgroup>
8+
<orgname>Red Hat OpenShift Documentation Team</orgname>
9+
</authorgroup>
10+
<xi:include href="Common_Content/Legal_Notice.xml" xmlns:xi="http://www.w3.org/2001/XInclude" />

‎tls_config/master.adoc

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
include::modules/attributes.adoc[]
2+
3+
:_content-type: ASSEMBLY
4+
[id="understanding-ssl-tls-quay"]
5+
= SSL/TLS for {productname}
6+
7+
The Secure Sockets Layer (SSL) protocol was originally developed by Netscape Corporation to provide a mechanism for secure communication over the Internet. Subsequently, the protocol was adopted by the Internet Engineering Task Force (IETF) and renamed to Transport Layer Security (TLS).
8+
9+
TLS (Transport Layer Security) is a cryptographic protocol used to secure network communications. When hardening system security settings by configuring preferred key-exchange protocols, authentication methods, and encryption algorithms, it is necessary to bear in mind that the broader the range of supported clients, the lower the resulting security. Conversely, strict security settings lead to limited compatibility with clients, which can result in some users being locked out of the system. Be sure to target the strictest available configuration and only relax it when it is required for compatibility reasons.
10+
11+
{productname} can be configured to use SSL/TLS certificates to ensure secure communication between clients and the Quay server. This configuration involves the use of valid SSL/TLS certificates, which can be obtained from a trusted Certificate Authority (CA) or generated as self-signed certificates for internal use.
12+
13+
The following sections show you how to enable SSL/TLS for {productname} by generating CAs, configuring SSL/TLS, testing the configuration, configuring Podman to trust the CA, and configuring the system to trust the CA. They should be followed in succession.
14+
15+
include::modules/ssl-create-certs.adoc[leveloffset=+1]
16+
include::modules/configuring-ssl-tls.adoc[leveloffset=+2]
17+
include::modules/ssl-config-cli.adoc[leveloffset=+3]
18+
include::modules/ssl-testing-cli.adoc[leveloffset=+3]
19+
include::modules/ssl-trust-ca-podman.adoc[leveloffset=+2]
20+
include::modules/ssl-trust-ca-system.adoc[leveloffset=+2]

‎tls_config/modules

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../modules/

0 commit comments

Comments
 (0)