Procedure

1. Generate a secure, hashed password using the bcrypt package in Python 3.9 by entering the following command:

   $ python3.9 -c 'import bcrypt; print(bcrypt.hashpw(b"newpass1234", bcrypt.gensalt(12)).decode("utf-8"))'

   Example output

   $2b$12$T8pkgtOoys3G5ut7FV1She6vXlYgU.6TeoGmbbAVQtN8X8ch4knKm

2. Enter the following command to show the container ID of your Red Hat Quay container registry:

   $ sudo podman ps -a

   Example output

   CONTAINER ID  IMAGE                                       COMMAND         CREATED         STATUS             PORTS                   NAMES
   70560beda7aa  registry.redhat.io/rhel8/redis-5:1         run-redis       2 hours ago     Up 2 hours ago     0.0.0.0:6379->6379/tcp                       redis
   8012f4491d10  registry.redhat.io/quay/quay-rhel8:v3.8.2  registry        3 minutes ago   Up 8 seconds ago   0.0.0.0:80->8080/tcp, 0.0.0.0:443->8443/tcp  quay
   8b35b493ac05  registry.redhat.io/rhel8/postgresql-10:1   run-postgresql  39 seconds ago  Up 39 seconds ago  0.0.0.0:5432->5432/tcp                       postgresql-quay

3. Execute an interactive shell for the postgresql container image by entering the following command:

   $ sudo podman exec -it 8b35b493ac05 /bin/bash

4. Re-enter the quay PostgreSQL database server, specifying the database, username, and host address:

   bash-4.4$ psql -d quay -U quayuser -h 192.168.1.28 -W

5. Update the password_hash of the superuser admin who lost their password:

   quay=> UPDATE public.user SET password_hash = '$2b$12$T8pkgtOoys3G5ut7FV1She6vXlYgU.6TeoGmbbAVQtN8X8ch4knKm' where username = 'quayadmin';

   Example output

   UPDATE 1

6. Enter the following to command to ensure that the password_hash has been updated:

   quay=> select * from public.user;

   Example output

   id | uuid | username | password_hash | email | verified | stripe_id | organization | robot | invoice_email | invalid_login_attempts | last_invalid_login |removed_tag_expiration_s | enabled | invoice_email_address | company | family_name | given_name | location | maximum_queued_builds_count | creation_date | last_accessed
   ----+--------------------------------------+-----------+--------------------------------------------------------------+-----------------------+---
   -------+-----------+--------------+-------+---------------+------------------------+----------------------------+--------------------------+------
   ---+-----------------------+---------+-------------+------------+----------+-----------------------------+----------------------------+-----------
   1 | 73f04ef6-19ba-41d3-b14d-f2f1eed94a4a | quayadmin | $2b$12$T8pkgtOoys3G5ut7FV1She6vXlYgU.6TeoGmbbAVQtN8X8ch4knKm | quayadmin@example.com | t | | f | f | f | 0 | 2023-02-23 07:54:39.116485 | 1209600 | t | | | | | | | 2023-02-23 07:54:39.116492

7. Log in to your Red Hat Quay deployment using the new password:

   $ sudo podman login -u quayadmin -p newpass1234 http://quay-server.example.com --tls-verify=false

   Example output

   Login Succeeded!

Procedure

1. Log in to your Red Hat Quay deployment.
2. On the OpenShift Container Platform UI, navigate to Workloads → Secrets.
3. Select the namespace for your Red Hat Quay deployment, for example, Project quay.
4. Locate and store the PostgreSQL database credentials.

5. Generate a secure, hashed password using the bcrypt package in Python 3.9 by entering the following command:

   $ python3.9 -c 'import bcrypt; print(bcrypt.hashpw(b"newpass1234", bcrypt.gensalt(12)).decode("utf-8"))'

   Example output

   $2b$12$zoilcTG6XQeAoVuDuIZH0..UpvQEZcKh3V6puksQJaUQupHgJ4.4y

6. On the CLI, log in to the database, for example:

   $ oc rsh quayuser-quay-quay-database-669c8998f-v9qsl

7. Enter the following command to open a connection to the quay PostgreSQL database server, specifying the database, username, and host address:

   sh-4.4$ psql -U quayuser-quay-quay-database -d quayuser-quay-quay-database -W

8. Enter the following command to connect to the default database for the current user:

   quay=> \c

9. Update the password_hash of the superuser admin who lost their password:

   quay=> UPDATE public.user SET password_hash = '$2b$12$zoilcTG6XQeAoVuDuIZH0..UpvQEZcKh3V6puksQJaUQupHgJ4.4y' where username = 'quayadmin';

10. Enter the following to command to ensure that the password_hash has been updated:

    quay=> select * from public.user;

    Example output

    id | uuid | username | password_hash | email | verified | stripe_id | organization | robot | invoice_email | invalid_login_attempts | last_invalid_login |removed_tag_expiration_s | enabled | invoice_email_address | company | family_name | given_name | location | maximum_queued_builds_count | creation_date | last_accessed
    ----+--------------------------------------+-----------+--------------------------------------------------------------+-----------------------+---
    -------+-----------+--------------+-------+---------------+------------------------+----------------------------+--------------------------+------
    ---+-----------------------+---------+-------------+------------+----------+-----------------------------+----------------------------+-----------
    1 | 73f04ef6-19ba-41d3-b14d-f2f1eed94a4a | quayadmin | $2b$12$zoilcTG6XQeAoVuDuIZH0..UpvQEZcKh3V6puksQJaUQupHgJ4.4y | quayadmin@example.com | t | | f | f | f | 0 | 2023-02-23 07:54:39.116485 | 1209600 | t | | | | | | | 2023-02-23 07:54:39.116492

11. Navigate to your Red Hat Quay UI on OpenShift Container Platform and log in using the new credentials.

Procedure

1. Exec into the Red Hat Quay pod or container. For more information, see "Interacting with the Red Hat Quay database".

2. Enter the following command to show all users for external authentication:

   quay=# select * from federatedlogin;

   Example output

   id | user_id | service_id |                service_ident                |               metadata_json
   ----+---------+------------+---------------------------------------------+-------------------------------------------
   1 |       1 |          3 | testuser0                                   | {}
   2 |       1 |          8 | PK7Zpg2Yu2AnfUKG15hKNXqOXirqUog6G-oE7OgzSWc | {"service_username": "live.com#testuser0"}
   3 |       2 |          3 | testuser1                                    | {}
   4 |       2 |          4 | 110875797246250333431                       | {"service_username": "testuser1"}
   5 |       3 |          3 | testuser2                                    | {}
   6 |       3 |          1 | 26310880                                    | {"service_username": "testuser2"}
   (6 rows)

3. Verify that the users are inserted into the user table:

   quay=# select username, email from "user";

   Example output

   username  |        email
   -----------+----------------------
   testuser0 | testuser0@outlook.com
   testuser1  | testuser1@gmail.com
   testuser2  | testuser2@redhat.com
   (3 rows)