Squashed 'cluster-config/' content from commit 654f2390

git-subtree-dir: cluster-config
git-subtree-split: 654f23903bd1f9a27a4810bd289d165b6cfdbb0c

clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml

@@ -0,0 +1,31 @@
+EXTERNAL_TLS_TERMINATION: false
+SERVER_HOSTNAME: registry.apps.home.ocplab.com
+PREFERRED_URL_SCHEME: https
+DISTRIBUTED_STORAGE_CONFIG:
+  # using Minio on QNAP NAS
+  radosGWStorage:
+    - RadosGWStorage
+    - access_key: XXXXX
+      secret_key: XXXX
+      bucket_name: quay
+      hostname: lab-nas.ocplab.com
+      is_secure: true
+      port: 9000
+      storage_path: /datastorage/registry
+DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
+DISTRIBUTED_STORAGE_PREFERENCE:
+  - radosGWStorage
+SSO_LOGIN_CONFIG:
+  CLIENT_ID: quay
+  CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86
+  OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/
+  LOGIN_SCOPES:
+    - openid
+  SERVICE_NAME: OpenShift
+SUPER_USERS:
+  - admin
+  - quayadmin
+FEATURE_DIRECT_LOGIN: true
+FEATURE_USER_INITIALIZE: true
+FEATURE_QUOTA_MANAGEMENT: true
+FEATURE_PROXY_CACHE: true

clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh

@@ -0,0 +1,2 @@
+oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml
+kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml

clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh

@@ -0,0 +1,7 @@
+# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables)
+. aws-creds
+mkdir -p qnap-tls
+acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com
+
+# Convert CA to crt
+openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt