# Quay registry

The Quay Application consumes the separately published `quay` chart. The
chart owns Quay's registry and mirror Deployments, Service, Ingress, and
optional PostgreSQL and Valkey subcharts. These values choose the existing
hostname, private configuration Secret, database storage class, and existing
Valkey instance for this cluster.

The Rook `CephObjectStoreUser/rook-ceph/quay` is adopted by the same Argo
Application without changing its name or spec. Its existing `quay` bucket is
**not** recreated or pruned by Helm or Argo. At migration inventory it had
5,416 objects and bucket ID
`e326b22c-970e-4ff6-bf65-499f3bab92bf.900401.2`. Keep the Ceph user Secret,
bucket, and RGW data during any rollback.

`default/secret/quay-config` contains Quay's persistent encryption keys and
points at the former shared PostgreSQL Service. It is retained as rollback
data. `quay-config-next` contains the same keys and S3 credentials with only
`DB_URI` changed to `quay-postgresql.default.svc.cluster.local`; neither
Secret's contents belongs in this public repository. `quay-postgres` holds the
dedicated PostgreSQL passwords. Restore those Secrets from the encrypted
administrator backup before restoring this installation in a new cluster.

The cutover stopped both old Quay Deployments, took a final PostgreSQL dump,
restored it into `quay-postgresql`, and enabled the registry with
`quay-config-next`. The final dump is stored outside Git at
`/home/feedc0de/migration-backups/quay/final-cutover-2026-10-20.dump` on the
administrator host. The old shared `quay` database and its PVC remain for
rollback; do not drop or overwrite them until off-cluster backups and actual
image pulls and pushes have been verified. The old direct Gitea deployment
writer and its kubeconfig were removed. Argo CD is the only normal writer.

The Argo Application intentionally has pruning disabled. In particular,
removing the adopted Rook object-user resource from Git must never silently
delete the credentials to the existing image bucket. Review data-bearing
resources individually before enabling pruning.