builders-virtual

[[red-hat-quay-quota-builders-establishment]]
= Setting up a {productname} builders environment

The following procedure describes how you can implement the builders feature in {productname}.

.Prerequisites

* Builders require SSL certificates. For more information link:https://access.redhat.com/documentation/en-us/red_hat_quay/2.9/html/manage_red_hat_quay/adding-tls-certificates-to-the-quay-enterprise-container[Adding TLS certificates to the {productname} container].


.Procedure

[NOTE]
====
* This procedure assumes you already have a cluster provisioned.
* This procedure is for setting up virtual builders.
====

. Log in to your {productname} cluster using your specified username and password:
+
----
$ oc login -u $KUBE_USER -p $KUBE_PASSWORD $KUBE_API
----

. Create a new namespace for your virtual builders:
+
----
$ oc create ns virtual-builders
----

. Create a new project for your virtual builders:
+
----
$ oc project virtual-builders
----

. Create a service account for your virtual builder:
+
----
$ oc create sa quay-builder
----

. Provide the created service account with editing permissions so that it can run the build:
+
----
$ oc adm policy add-role-to-user edit system:serviceaccount:virtual-builders:quay-builder
----

. Grant the Quay builder `anyuid scc` permissions:
+
----
$ oc adm polcy add-scc-to-user anyuid -z quay-builder
----
+
[NOTE]
====
This action requires cluster admin privileges and is required because for unprivileged or rootless builds to work, they must run as the Podman user.
====

. Obtain token for the Quay builder service account:
+
----
$ export VIRTUAL_SA_TOKEN=$(oc sa get-token quay-builder -n virtual-builders) \
yq -i e '.BUILD_MANAGER[1].EXECUTORS[0].SERVICE_ACCOUNT_TOKEN = strenv(VIRTUAL_SA_TOKEN)' ./quay-configs/quay-config.build.virtual.yaml
----
+
[NOTE]
+
====
Using the `yq` yaml parser extracts the token to the specified Quay configuration file.
====

. Install the Quay Operator with a subscription:
+
----
$ oc apply -f ./k8s-objects/quay-operator-subscription.yaml -n openshift-opertors
----
+
[NOTE]
====
This step can also be accomplished on the Quay UI.
====

. Create a namespace for the Quay deployment:
+
----
$ oc create ns quay
----

. Set the project context:
+
----
$ oc project quay
----