Upgrade

Log into the Red Hat Customer Portal with your Red Hat customer account credentials.

Select your user name (upper-right corner) to see Red Hat Account and Customer Portal selections:

Select Notifications. Your profile activity page appears.

Select the Notifications tab.

Select Manage Notifications.

Select Follow, then choose Products from the drop-down box.

From the drop-down box next to the Products, search for and select Project Quay:

Select the SAVE NOTIFICATION button. Going forward, you will receive notifications when there are changes to the Project Quay product, such as a new release.

Review the cluster TLS security profile:

$ oc get apiserver cluster -o jsonpath='{.spec.tlsSecurityProfile}{"\n"}'

If you must preserve your current TLS settings, add SSL_PROTOCOLS and SSL_CIPHERS to the config.yaml file in your configBundleSecret before upgrading. For example:

# ...
SSL_PROTOCOLS:
  - TLSv1.2
  - TLSv1.3
SSL_CIPHERS:
  - ECDHE-RSA-AES128-GCM-SHA256
  - ECDHE-ECDSA-AES128-GCM-SHA256
  - ECDHE-RSA-AES256-GCM-SHA384
  - ECDHE-ECDSA-AES256-GCM-SHA384
  # Add other required ciphers
# ...

Update the configBundleSecret with the modified config.yaml file. You can edit the secret in the OpenShift Container Platform web console or recreate it from a local file. For example:

$ oc create secret generic <config_bundle_secret_name> \
  --from-file config.yaml=./config.yaml \
  --dry-run=client -o yaml | oc apply -f -

Proceed with the Project Quay Operator upgrade. If the cluster TLS profile is acceptable and neither SSL_PROTOCOLS nor SSL_CIPHERS is set, no additional TLS configuration is required.

In the OpenShift Container Platform Web Console, navigate to Operators → Installed Operators.

Click on the Project Quay Operator.

Navigate to the Subscription tab.

Under Subscription details click Update channel.

Select stable-3.18 → Save.

Check the progress of the new installation under Upgrade status. Wait until the upgrade status changes to 1 installed before proceeding.

In your OpenShift Container Platform cluster, navigate to Workloads → Pods. Existing pods should be terminated, or in the process of being terminated.

Wait for the following pods, which are responsible for upgrading the database and alembic migration of existing data, to spin up: clair-postgres-upgrade, quay-postgres-upgrade, and quay-app-upgrade.

After the clair-postgres-upgrade, quay-postgres-upgrade, and quay-app-upgrade pods are marked as Completed, the remaining pods for your Project Quay deployment spin up. This takes approximately ten minutes.

Verify that the quay-database uses the postgresql-13 image, and clair-postgres pods now uses the postgresql-15 image.

After the quay-app pod is marked as Running, you can reach your Project Quay registry.

Stop the Quay and Clair containers.

Backup the database and image storage (optional but recommended).

Start Clair using the new version of the image.

Wait until Clair is ready to accept connections before starting the new version of Project Quay.

Obtain a list of all Project Quay instances on each system running a Project Quay instance.

Temporarily shut down all Project Quay instances on each system.

Obtain the latest Project Quay version, for example, Project Quay {producty}, on each system.

On System A of your highly available Project Quay deployment, run the new image version, for example, Project Quay {producty}:

# sudo podman run --restart=always -p 443:8443 -p 80:8080 \
   --sysctl net.core.somaxconn=4096 \
   --name=quay01 \
   -v /mnt/quay/config:/conf/stack:Z \
   -v /mnt/quay/storage:/datastorage:Z \
   -d registry.redhat.io/quay/quay-rhel8:{productminv}

Wait for the new Project Quay container to become fully operational on System A. You can check the status of the container by entering the following command:

$ sudo podman ps

CONTAINER ID  IMAGE                                      COMMAND         CREATED        STATUS            PORTS                                        NAMES
70b9f38c3fb4  registry.redhat.io/quay/quay-rhel8:v{producty} registry        2 seconds ago   Up 2 seconds ago   0.0.0.0:82->8080/tcp, 0.0.0.0:445->8443/tcp  quay01

Optional: Ensure that Project Quay is fully operation by navigating to the Project Quay UI.

After ensuring that Project Quay on System A is fully operational, run the new image versions on System B and on System C.

You can check the status of the containers on System B and on System C by entering the following command:

$ sudo podman ps

On System B and System C, scale down your Project Quay registry. This is done by disabling auto scaling and overriding the replica county for Project Quay, mirror workers, and Clair if it is managed. Note that you must keep the Project Quay registry running on System A. Do not update the quayregistry.yaml file on System A.

apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: registry
  namespace: ns
spec:
  components:
    …
    - kind: horizontalpodautoscaler
      managed: false
    - kind: quay
      managed: true
      overrides:
        replicas: 0
    - kind: clair
      managed: true
      overrides:
        replicas: 0
    - kind: mirror
      managed: true
      overrides:
        replicas: 0
    …

Wait for the registry-quay-app, registry-quay-mirror, and registry-clair-app pods to disappear. Enter the following command to check their status:

oc get pods -n <quay-namespace>

quay-operator.v3.7.1-6f9d859bd-p5ftc               1/1     Running     0             12m
quayregistry-clair-postgres-7487f5bd86-xnxpr       1/1     Running     1 (12m ago)   12m
quayregistry-quay-app-upgrade-xq2v6                0/1     Completed   0             12m
quayregistry-quay-redis-84f888776f-hhgms           1/1     Running     0             12m

On System A, initiate a Project Quay upgrade to the latest y-stream version. This is a manual process. For more information about upgrading installed Operators, see Upgrading installed Operators. For more information about Project Quay upgrade paths, see Upgrading the Project Quay Operator.

After the new Project Quay registry is installed, the necessary upgrades on the cluster are automatically completed. Afterwards, new Project Quay pods are started with the latest y-stream version. Additionally, new Quay pods are scheduled and started.

Confirm that the update has properly worked by navigating to the Project Quay UI:

Confirm that the update has properly worked on System A, initiate the Project Quay upgrade on System B and on System C. The Operator upgrade results in an upgraded Project Quay installation, and the pods are restarted.

After updating, revert the changes made in step 1 of this procedure by removing overrides for the components. For example:

apiVersion: quay.redhat.com/v1
kind: QuayRegistry
metadata:
  name: registry
  namespace: ns
spec:
  components:
    …
    - kind: horizontalpodautoscaler
      managed: true
    - kind: quay
      managed: true
    - kind: clair
      managed: true
    - kind: mirror
      managed: true
    …

On the OpenShift Container Platform web console, click Operators → Installed Operators → Quay Bridge Operator.

Click the Subscription tab.

Under Update channel, click stable-3.15 → Save.

Stop the Project Quay container by entering the following command:

$ sudo podman stop <quay_container_name>

Stop the Clair container by running the following command:

$ sudo podman stop <clair_container_id>

Run the following Podman process from SCLOrg’s Data Migration procedure, which allows for data migration from a remote PostgreSQL server:

$ sudo podman run -d --name <clair_migration_postgresql_database> \
  -e POSTGRESQL_MIGRATION_REMOTE_HOST=<container_ip_address> \
  -e POSTGRESQL_MIGRATION_ADMIN_PASSWORD=remoteAdminP@ssword \
  -v </host/data/directory:/var/lib/pgsql/data:Z> \
  [ OPTIONAL_CONFIGURATION_VARIABLES ]
  registry.redhat.io/rhel8/postgresql-15

Stop the Clair PostgreSQL 13 container:

$ sudo podman stop <clair_postgresql13_container_name>

After completing the PostgreSQL migration, run the Clair PostgreSQL 15 container, using the new data volume mount from Step 3, for example, </host/data/clair-postgresql15-directory:/var/lib/postgresql/data>:

$ sudo podman run -d --rm --name <postgresql15-clairv4> \
  -e POSTGRESQL_USER=<clair_username> \
  -e POSTGRESQL_PASSWORD=<clair_password> \
  -e POSTGRESQL_DATABASE=<clair_database_name> \
  -e POSTGRESQL_ADMIN_PASSWORD=<admin_password> \
  -p 5433:5432 \
  -v </host/data/clair-postgresql15-directory:/var/lib/postgresql/data:Z> \
    registry.redhat.io/rhel8/postgresql-15

Start the Project Quay container by entering the following command:

$ sudo podman run -d --rm -p 80:8080 -p 443:8443 --name=quay \
-v /home/<quay_user>/quay-poc/config:/conf/stack:Z \
-v /home/<quay_user>/quay-poc/storage:/datastorage:Z \
{productrepo}/{quayimage}:{productminv}

Start the Clair container by entering the following command:

$ sudo podman run -d --name clairv4 \
-p 8081:8081 -p 8088:8088 \
-e CLAIR_CONF=/clair/config.yaml \
-e CLAIR_MODE=combo \
registry.redhat.io/quay/clair-rhel8:{productminv}