Quay registry
The Quay Application consumes the separately published quay chart. The
chart owns Quay's registry and mirror Deployments, Service, Ingress, and
optional PostgreSQL and Valkey subcharts. These values choose the existing
hostname, private configuration Secret, database storage class, and existing
Valkey instance for this cluster.
The Rook CephObjectStoreUser/rook-ceph/quay is adopted by the same Argo
Application without changing its name or spec. Its existing quay bucket is
not recreated or pruned by Helm or Argo. At migration inventory it had
5,416 objects and bucket ID
e326b22c-970e-4ff6-bf65-499f3bab92bf.900401.2. Keep the Ceph user Secret,
bucket, and RGW data during any rollback.
default/secret/quay-config contains Quay's persistent encryption keys and
currently points at the shared PostgreSQL Service. It is retained as rollback
data. quay-config-next contains the same keys and S3 credentials with only
DB_URI changed to quay-postgresql.default.svc.cluster.local; neither
Secret's contents belongs in this public repository. quay-postgres holds the
dedicated PostgreSQL passwords. Restore those Secrets from the encrypted
administrator backup before enabling quay.enabled in a new cluster.
The migration starts with quay.enabled: false, deploying only dedicated
PostgreSQL. Stop both legacy Quay Deployments before the final database dump,
restore that dump to quay-postgresql, switch the config Secret, then enable
Quay in this values file. Preserve the old shared database and PVC for rollback
until backups and live pulls/pushes have been verified. The old direct Gitea CD
writer must be removed after Argo adopts and verifies both Deployments.