Project Quay container registry platform provides secure storage, distribution, and governance of containers and cloud-native artifacts on any infrastructure. It is available as a standalone component or as an Operator on OpenShift Container Platform. Project Quay includes the following features and benefits:

  • Granular security management

  • Fast and robust at any scale

  • High velocity CI/CD

  • Automated installation and updates

  • Enterprise authentication and team-based access control

  • OpenShift Container Platform integration

Project Quay is regularly released, containing new features, bug fixes, and software updates. To upgrade Project Quay for both standalone and OpenShift Container Platform deployments, see Upgrade Project Quay.

Important

Project Quay only supports rolling back, or downgrading, to previous z-stream versions, for example, {producty-n1}.2 → {producty-n1}.1. Rolling back to previous y-stream versions (3.18 → {producty-n1}) is not supported. This is because Project Quay updates might contain database schema upgrades that are applied when upgrading to a new version of Project Quay. Database schema upgrades are not considered backwards compatible.

Downgrading to previous z-streams is neither recommended nor supported by either Operator based deployments or virtual machine based deployments. Downgrading should only be done in extreme circumstances. The decision to rollback your Project Quay deployment must be made in conjunction with the Project Quay support and development teams. For more information, contact Project Quay support.

Project Quay release notes

The following sections detail y and z stream release information.

RHBA-TBD - Project Quay 3.18.0 release

Issued TBD

Project Quay release 3.18 is now available with Clair 4.9. The bug fixes that are included in the update are listed in the RHBA-TBD advisory. For the most recent compatibility matrix, see Quay Enterprise 3.x Tested Integrations. For information on the release cadence of Project Quay, see the Project Quay Life Cycle Policy.

Project Quay new features and enhancements

The following updates have been made to Project Quay.

Red Hat Quay on OpenShift Container Platform new features and enhancements

The following updates have been made to Red Hat Quay on OpenShift Container Platform.

OpenShift Container Platform cluster TLS security profile inheritance & Post-Quantum Cryptography (PQC) readiness

When the tls component is set to unmanaged, the Project Quay Operator inherits the cluster’s TLS security profile from the APIServer configuration when neither SSL_PROTOCOLS nor SSL_CIPHERS is configured in the configBundleSecret resource. This helps align Project Quay with the platform TLS policy and supports Post-Quantum Cryptography (PQC) readiness when the cluster profile requires TLS 1.3.

To fully override or preserve TLS behavior, set both SSL_PROTOCOLS and SSL_CIPHERS in the configBundleSecret resource. Setting either field disables cluster-profile inheritance for both fields; partial configuration is not supported. Supported profile types are Old, Intermediate, Modern, and Custom. If the cluster has no profile set, the Operator defaults to the Intermediate profile (TLS 1.2 and TLS 1.3).

Table 1. TLS security profile inheritance by TLS mode
TLS mode Before this release After this release

Managed TLS (Operator-managed route)

OpenShift Container Platform Route enforces the cluster TLS profile

No change

Unmanaged TLS (tls component set to unmanaged)

Project Quay used built-in TLS defaults

Project Quay inherits the cluster TLS security profile when neither SSL_PROTOCOLS nor SSL_CIPHERS is configured
Important

If you use unmanaged TLS and require specific TLS settings that differ from the cluster default, set both SSL_PROTOCOLS and SSL_CIPHERS in your configBundleSecret resource before upgrading. Setting only one field disables cluster-profile inheritance for both fields. For more information, see Preserving TLS settings before upgrading Red Hat Quay on OpenShift Container Platform.

On Kubernetes clusters without the config.openshift.io API, the Operator does not inject TLS settings and Project Quay uses its built-in defaults.

For more information about SSL/TLS configuration fields, see SSL/TLS configuration fields.

For information about custom certificates and the config bundle, see Configuring custom SSL/TLS certificates for Red Hat Quay on OpenShift Container Platform. For information about TLS protocol and cipher inheritance, see OpenShift Container Platform cluster TLS security profile inheritance.

For more information about NIST post-quantum cryptography standards, see Post-Quantum Cryptography.

For the latest compliance information for OpenShift Container Platform, RHEL, and Red Hat Enterprise Linux CoreOS (RHCOS), see Compliance Activities and Government Standards.

Project Quay configuration fields updates and changes

The following configuration fields have been added or changed in Project Quay 3.18.

SSL_PROTOCOLS and SSL_CIPHERS Operator inheritance on OpenShift Container Platform

When you deploy Red Hat Quay on OpenShift Container Platform, the Operator can populate the existing SSL_PROTOCOLS and SSL_CIPHERS fields from the cluster-wide OpenShift Container Platform tlsSecurityProfile when neither field is set in the configBundleSecret resource. To fully override or preserve TLS behavior, set both fields. Setting either field disables cluster-profile inheritance for both fields.

For more information, see OpenShift Container Platform cluster TLS security profile inheritance and Preserving TLS settings before upgrading Red Hat Quay on OpenShift Container Platform.

API endpoint enhancements

The following API endpoints were added in Project Quay 3.18.

Known issues and limitations

The following sections note known issues and limitations for Project Quay 3.18.

Example

Project Quay bug fixes

The following issues were fixed with Project Quay 3.18:

Project Quay feature tracker

New features have been added to Project Quay, some of which are currently in Technology Preview. Technology Preview features are experimental features and are not intended for production use.

Some features available in previous releases have been deprecated or removed. Deprecated functionality is still included in Project Quay, but is planned for removal in a future release and is not recommended for new deployments. For the most recent list of deprecated and removed functionality in Project Quay, refer to Table 1.1. Additional details for more fine-grained functionality that has been deprecated and removed are listed after the table.

Table 2. Features tracker
Feature Quay 3.18 Quay 3.17 Quay 3.16

Sparse manifest support for multi-architecture filtering

General Availability

General Availability

-

Immutable tags overview

General Availability

General Availability

-

Proof Key for Code Exchange support for OIDC

General Availability

General Availability

-

v1 UI

Deprecated

Deprecated

Deprecated
IBM Power, IBM Z, and IBM® LinuxONE support matrix
Table 3. list of supported and unsupported features
Feature IBM Power IBM Z and IBM® LinuxONE

Allow team synchronization via OIDC on Azure

Not Supported

Not Supported

Backing up and restoring on a standalone deployment

Supported

Supported

Clair Disconnected

Supported

Supported

Geo-Replication (Standalone)

Supported

Supported

Geo-Replication (Operator)

Supported

Supported

IPv6

Not Supported

Not Supported

Migrating a standalone to operator deployment

Supported

Supported

Mirror registry

Supported

Supported

Quay config editor - mirror, OIDC

Supported

Supported

Quay config editor - MAG, Kinesis, Keystone, GitHub Enterprise

Not Supported

Not Supported

Quay config editor - Red Hat Quay V2 User Interface

Supported

Supported

Quay Disconnected

Supported

Supported

Repo Mirroring

Supported

Supported