Red Hat Quay

Overview

The Red Hat Quay integration connects your Quay organization (on quay.io or a self-hosted Red Hat Quay registry) to Oneleet, syncing the organization’s users as user account assets and its repositories. This lets Oneleet monitor who has access to your Quay organization and whether your container images are publicly visible.

What does Oneleet monitor?

• Quay organization members and outside collaborators (user accounts), including their teams and organization roles
• Whether your Quay repositories are publicly visible

Setup

To set up the Red Hat Quay integration, navigate to Integrations > Add integration > Red Hat Quay.

Oneleet connects with an OAuth access token generated from an organization OAuth application. Generating it requires admin access to the organization.

1. Sign in to Quay, open your organization, and copy its name from the address bar: it’s the part after /organization/, e.g. acme.
2. Open the organization’s Applications tab, click Create New Application, enter a name, and press Enter.
3. Click the new application, open the Generate Token tab, select Administer Organization, View all visible repositories, and Read User Information, then click Generate Access Token and authorize the application.
4. Copy the access token and paste it, the hostname (quay.io or your registry’s hostname), and the organization into the form in Oneleet, then click Connect.

Quay tokens can’t be scoped to read-only access. Administer Organization is the only scope that can list your organization’s members.

Quay doesn’t expose users’ email addresses or two-factor authentication status to organization admins, so Oneleet lists users by their Quay username.