quay/config-tool

Configuration Validation Tool for Quay

Config Tool

The Quay Config Tool implements several features to capture and validate configuration data based on a predefined schema.

This tool includes the following features:

• Validate Quay configuration using CLI tool
• Generate code for custom field group definitions (includes structs, constructors, defaults)
• Validation tag support from Validator
• Built-in validator tags for OAuth and JWT structs

Installation

Build from Source

Install using the Go tool:

go get -u github.com/quay/config-tool/...

This will generate files for the Quay validator executable and install the config-tool CLI tool.

Build from Dockerfile

Clone this repo and build an image:

$ git clone https://github.com/quay/config-tool.git
$ cd config-tool
$ sudo podman build -t config-tool .

Start the container and execute command:

$ sudo podman run -it -v ${CONFIG_MOUNT}:/conf config-tool ...

Note that you must mount in your config directory in order for the config-tool to see it.

Note: By default, this tool will generate an executable from a pre-built Config definition. For usage on writing a custom Config definition see here

Usage

The CLI tool contains two main commands:

The print command is used to output the entire configuration with defaults specified

{
        "HostSettings": (*fieldgroups.HostSettingsFieldGroup)({
                ServerHostname: "quay:8081",
                PreferredURLScheme: "https",
                ExternalTLSTermination: false
        }),
        "TagExpiration": (*fieldgroups.TagExpirationFieldGroup)({
                FeatureChangeTagExpiration: false,
                DefaultTagExpiration: "2w",
                TagExpirationOptions: {
                        "0s",
                        "1d",
                        "1w",
                        "2w",
                        "4w"
                }
        }),
        "UserVisibleSettings": (*fieldgroups.UserVisibleSettingsFieldGroup)({
                RegistryTitle: "Project Quay",
                RegistryTitleShort: "Project Quay",
                SearchResultsPerPage: 10,
                SearchMaxResultPageCount: 10,
                ContactInfo: {
                },
                AvatarKind: "local",
                Branding: (*fieldgroups.BrandingStruct)({
                        Logo: "not_a_url",
                        FooterIMG: "also_not_a_url",
                        FooterURL: ""
                })
        })
}

The validate command is used to show while field groups have been validated succesully

$ config-tool validate -c <path-to-config-dir>
+---------------------+--------------------+-------------------------+--------+
|     FIELD GROUP     |       FIELD        |          ERROR          | STATUS |
+---------------------+--------------------+-------------------------+--------+
| HostSettings        | -                  | -                       | 🟢     |
| TagExpiration       | -                  | -                       | 🟢     |
| UserVisibleSettings | BRANDING.Logo      | Field enforces tag: url | 🔴     |
|                     | BRANDING.FooterIMG | Field enforces tag: url | 🔴     |
+---------------------+--------------------+-------------------------+--------+

The editor command will bring up an interactive UI to reconfigure and validate a config bundle.

$ config-tool editor -c <path-to-config-dir> -p <editor-password> -e <operator-endpoint>

This command will bring up an interactive UI in which a user can modify, validate, and download a config. In addition, Swagger documentation can be reached by going to {{host}}/swagger/index.html

Using HTTPS

You can deploy the config editor using TLS certificates by passing environment variables to the runtime. The public and private keys must contain valid SANs for the route that you wish to deploy the editor on.

The paths can be specifed using CONFIG_TOOL_PRIVATE_KEY and CONFIG_TOOL_PUBLIC_KEY.

NOTE: If running from a container, the CONFIG_TOOL_PRIVATE_KEY and CONFIG_TOOL_PUBLIC_KEY values are the locations of the certs INSIDE the container. This might look something like the following:

$ docker run -p 7070:8080 \

-v ${PRIVATE_KEY_PATH}:/tls/localhost.key \
-v ${PUBLIC_KEY_PATH}:/tls/localhost.crt \
-e CONFIG_TOOL_PRIVATE_KEY=/tls/localhost.key \
-e CONFIG_TOOL_PUBLIC_KEY=/tls/localhost.crt \
-e DEBUGLOG=true \
-ti config-app:dev

config-tool's Issues

How to create\deploy bundles.

The documentation states "Once a config bundle has been successfully validated, we can use a third endpoint to bundle our config into a tar.gz."

The directions does not show the how to actually bundle the config in to a tar.gz. How is this accomplished?

I attempted to pull the api info hitting {{host}}/swagger/index.html, but I get
"Fetch error" - "Not Found /docs/swagger.json"

How do you interact with the API to build/deploy the tar.gz?

Swift storage connection configuration is wrong

Hi,
I have been trying to deploy Quay on an environment which has swift as storage option and the config validator fails even though quay itself is working fine with the backend storage after bypassing the validator.
When looking at the source code here I noticed that the swift connection parameter isn't up to date with the upstream ncw/swift module:

config-tool/pkg/lib/shared/storage_validators.go

Line 451 in 673209c

c = swift.Connection{

Here you can see the tenant option is missing as per documentation :
https://github.com/ncw/swift/blob/master/README.md

I have locally changed the config tool code and the connection works as expected when the tenant name is provided.
I hope this info helps.

Thanks

config-tool fails on some secure passwords

Quay: v3.4.0
config-tool v0.1.0
Red Hat Enterprise Linux release 8.3 (Ootpa)

Quay container won't start after upgrade to Quay v3.4.0 caused by some trouble with config-tool

$ config-tool validate -c /quay-registry/conf/stack/ --mode online
panic: runtime error: slice bounds out of range [1:0]
goroutine 24 [running]:
github.com/quay/config-tool/pkg/lib/fieldgroups/database.ValidateDatabaseConnection(0x7ffd55ca9661, 0x6, 0xc0004a9980, 0xc0001882d0, 0x0, 0x0, 0x0, 0x0)
        /remote-source/app/source/config-tool/pkg/lib/fieldgroups/database/database_validator.go:90 +0xca5
github.com/quay/config-tool/pkg/lib/fieldgroups/database.(*DatabaseFieldGroup).Validate(0xc000450fc0, 0x7ffd55ca9661, 0x6, 0xc0004a9980, 0xc0002a7848, 0x0, 0x0)
        /remote-source/app/source/config-tool/pkg/lib/fieldgroups/database/database_validator.go:55 +0x22a
github.com/quay/config-tool/commands.glob..func3.1(0xc0004a97a0, 0xc0004e2cd0, 0xc0004a9980, 0xc000451700, 0xc00040e222, 0xc00040eea0)
        /remote-source/app/source/config-tool/commands/validate.go:108 +0xd4
created by github.com/quay/config-tool/commands.glob..func3
        /remote-source/app/source/config-tool/commands/validate.go:93 +0x4eb

It seems DB_URI contains some problematic content in secure database password. The problematic sign is "?"
After removing this, config-tool works well. Of course I have to change the password in database backend ;-)
Thanks!