https://openbao.org/assets/js/c4df3de6.715b63a0.js

1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["14557"],{97717(e,n,o){o.r(n),o.d(n,{metadata:()=>s,default:()=>d,frontMatter:()=>t,contentTitle:()=>c,toc:()=>l,assets:()=>a});var s=JSON.parse('{"id":"policies/repo-setup","title":"OpenBao Repository Setup","description":"The OpenBao checklist for repository set up","source":"@site/content/community/policies/repo-setup.mdx","sourceDirName":"policies","slug":"/policies/repo-setup","permalink":"/community/policies/repo-setup","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/tree/main/website/content/community/policies/repo-setup.mdx","tags":[],"version":"current","frontMatter":{"layout":"docs","page_title":"OpenBao Repository Setup","sidebar_label":"Repo Setup","description":"The OpenBao checklist for repository set up"},"sidebar":"community","previous":{"title":"CVE Process","permalink":"/community/policies/cve"},"next":{"title":"Overview","permalink":"/community/rfcs/"}}'),i=o(94686),r=o(44812);let t={layout:"docs",page_title:"OpenBao Repository Setup",sidebar_label:"Repo Setup",description:"The OpenBao checklist for repository set up"},c="OpenBao Repository Setup",a={},l=[{value:"Secrets",id:"secrets",level:2},{value:"GPG Key for Signing",id:"gpg-key-for-signing",level:3},{value:"Container Registries",id:"container-registries",level:3},{value:"Quay",id:"quay",level:4},{value:"DockerHub",id:"dockerhub",level:4}];function h(e){let n={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.R)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"openbao-repository-setup",children:"OpenBao Repository Setup"})}),"\n",(0,i.jsx)(n.h2,{id:"secrets",children:"Secrets"}),"\n",(0,i.jsx)(n.h3,{id:"gpg-key-for-signing",children:"GPG Key for Signing"}),"\n",(0,i.jsx)(n.p,{children:"Ask the TSC chair to provision secrets:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"GPG_PASSWORD"}),", from 1Password"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"GPG_PRIVATE_KEY"}),", from 1Password"]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.code,{children:"GPG_PRIVATE_KEY_BASE64"}),", from 1Password with ",(0,i.jsx)(n.code,{children:"cat ... | base64"})," applied."]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"container-registries",children:"Container Registries"}),"\n",(0,i.jsx)(n.p,{children:"For each registry (Quay, DockerHub), we provision a username and password."}),"\n",(0,i.jsx)(n.h4,{id:"quay",children:"Quay"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.a,{href:"https://quay.io/new/?namespace=openbao",children:"Create a repository"})," in the\n",(0,i.jsx)(n.a,{href:"https://quay.io/organization/openbao",children:"OpenBao organization"}),", named after\nthe source repo (e.g., ",(0,i.jsx)(n.code,{children:"openbao-snapshot-agent"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:["Add team memberships in the ",(0,i.jsx)(n.a,{href:"https://quay.io/repository/openbao/openbao-snapshot-agent?tab=settings",children:"settings tab"}),":","\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Assign the ",(0,i.jsxs)(n.a,{href:"https://quay.io/organization/openbao/teams/owners",children:[(0,i.jsx)(n.code,{children:"owners"})," team"]}),"\n",(0,i.jsx)(n.code,{children:"admin"})," permissions."]}),"\n",(0,i.jsxs)(n.li,{children:["Create a new robot account and assign ",(0,i.jsx)(n.code,{children:"write"})," permission.","\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Name the robot account after the repository name, but with underscores\ninstead of dashes."}),"\n",(0,i.jsx)(n.li,{children:"After saving the account and assigning the permission, click on the\nblue part of the new robot name."}),"\n",(0,i.jsxs)(n.li,{children:["The value for ",(0,i.jsx)(n.code,{children:"QUAY_USERNAME"})," is the Username in the first box."]}),"\n",(0,i.jsxs)(n.li,{children:["The value for ",(0,i.jsx)(n.code,{children:"QUAY_TOKEN"})," is the Robot Account in the second box."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"dockerhub",children:"DockerHub"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.a,{href:"https://hub.docker.com/repository/create?namespace=openbao",children:"Create a repository"}),"\nin the ",(0,i.jsx)(n.a,{href:"https://hub.docker.com/orgs/openbao",children:"OpenBao organization"}),", named\nafter the source repo (e.g., ",(0,i.jsx)(n.code,{children:"openbao-snapshot-agent"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:[(0,i.jsx)(n.a,{href:"https://app.docker.com/accounts/openbao/admin/org-access-tokens/create",children:"Create an organization access token"}),":","\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["Label should be the name of the repository (e.g., ",(0,i.jsx)(n.code,{children:"openbao-snapshot-agent"}),")."]}),"\n",(0,i.jsx)(n.li,{children:"Description should point to the full GitHub repository path."}),"\n",(0,i.jsxs)(n.li,{children:["Resources should include only the specified repository with ",(0,i.jsx)(n.code,{children:"scope-image-push"}),"."]}),"\n",(0,i.jsx)(n.li,{children:"Generate token."}),"\n",(0,i.jsxs)(n.li,{children:["The value for ",(0,i.jsx)(n.code,{children:"DOCKER_USERNAME"})," is the organization name (",(0,i.jsx)(n.code,{children:"openbao"}),")."]}),"\n",(0,i.jsxs)(n.li,{children:["The value for ",(0,i.jsx)(n.code,{children:"DOCKER_TOKEN"})," is what is present on the screen after creation."]}),"\n"]}),"\n"]}),"\n"]})]})}function d(e={}){let{wrapper:n}={...(0,r.R)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(h,{...e})}):h(e)}},44812(e,n,o){o.d(n,{R:()=>t,x:()=>c});var s=o(92990);let i={},r=s.createContext(i);function t(e){let n=s.useContext(r);return s.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function c(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:t(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]);