37 lines
2.1 KiB
Markdown
37 lines
2.1 KiB
Markdown
# Quay registry
|
|
|
|
The Quay Application consumes the separately published `quay` chart. The
|
|
chart owns Quay's registry and mirror Deployments, Service, Ingress, and
|
|
optional PostgreSQL and Valkey subcharts. These values choose the existing
|
|
hostname, private configuration Secret, database storage class, and existing
|
|
Valkey instance for this cluster.
|
|
|
|
The Rook `CephObjectStoreUser/rook-ceph/quay` is adopted by the same Argo
|
|
Application without changing its name or spec. Its existing `quay` bucket is
|
|
**not** recreated or pruned by Helm or Argo. At migration inventory it had
|
|
5,416 objects and bucket ID
|
|
`e326b22c-970e-4ff6-bf65-499f3bab92bf.900401.2`. Keep the Ceph user Secret,
|
|
bucket, and RGW data during any rollback.
|
|
|
|
`default/secret/quay-config` contains Quay's persistent encryption keys and
|
|
points at the former shared PostgreSQL Service. It is retained as rollback
|
|
data. `quay-config-next` contains the same keys and S3 credentials with only
|
|
`DB_URI` changed to `quay-postgresql.default.svc.cluster.local`; neither
|
|
Secret's contents belongs in this public repository. `quay-postgres` holds the
|
|
dedicated PostgreSQL passwords. Restore those Secrets from the encrypted
|
|
administrator backup before restoring this installation in a new cluster.
|
|
|
|
The cutover stopped both old Quay Deployments, took a final PostgreSQL dump,
|
|
restored it into `quay-postgresql`, and enabled the registry with
|
|
`quay-config-next`. The final dump is stored outside Git at
|
|
`/home/feedc0de/migration-backups/quay/final-cutover-2026-10-20.dump` on the
|
|
administrator host. The old shared `quay` database and its PVC remain for
|
|
rollback; do not drop or overwrite them until off-cluster backups and actual
|
|
image pulls and pushes have been verified. The old direct Gitea deployment
|
|
writer and its kubeconfig were removed. Argo CD is the only normal writer.
|
|
|
|
The Argo Application intentionally has pruning disabled. In particular,
|
|
removing the adopted Rook object-user resource from Git must never silently
|
|
delete the credentials to the existing image bucket. Review data-bearing
|
|
resources individually before enabling pruning.
|