Small 3.2 improvements (#39)

modules/proc_deploy_quay_openshift.adoc

@@ -121,7 +121,7 @@ persistent storage to the deployment and allow it to store db metadata.
 ```
 # oc create serviceaccount postgres -n quay-enterprise
 serviceaccount/postgres created
-# oc adm policy add-scc-to-user anyuid -z system:serviceaccount:quay-enterprise:postgres \
+# oc adm policy add-scc-to-user anyuid -z system:serviceaccount:quay-enterprise:postgres
 scc "anyuid" added to: ["system:serviceaccount:quay-enterprise:system:serviceaccount:quay-enterprise:postgres"]
 ```
 

modules/proc_manage-clair-enable.adoc

@@ -293,12 +293,6 @@ configure Docker, complete the following steps:
 to `ca.crt`
 . Make sure the `ca.crt` file is mounted inside the Clair container
 under `/etc/pki/ca-trust/source/anchors/` as in the example below:
-+
-[NOTE]
-====
-Add `--loglevel=debug` to the `docker run` command line for
-the clair container to enable debug level logging.
-====
 ifdef::upstream[]
 You will need to build your own Clair container and run it during this step.
 Instructions for building the Clair container are not yet available.

modules/proc_use-quay-build-workers-dockerfiles.adoc

@@ -80,7 +80,7 @@ ifdef::upstream[]
 # docker run --restart on-failure \
   -e SERVER=ws://myquayenterprise \
   --privileged=true \
-  -v /mnt/docker.sock:/var/run/docker.sock \
+  -v /var/run/docker.sock:/var/run/docker.sock \
   <registry>/<repo>/quay-builder:{productminv}
 ....
 endif::upstream[]
@@ -91,7 +91,7 @@ ifdef::downstream[]
 # docker run --restart on-failure \
   -e SERVER=ws://myquayenterprise \
   --privileged=true \
-  -v /mnt/docker.sock:/var/run/docker.sock \
+  -v /var/run/docker.sock:/var/run/docker.sock \
   {productrepo}/quay-builder:{productminv}
 ....
 endif::downstream[]
@@ -106,7 +106,7 @@ If {productname} is setup to use a SSL certificate that is not globally trusted,
   -e SERVER=wss://myquayenterprise \
   --privileged=true \
   -v /path/to/ssl/rootCA.pem:/etc/pki/ca-trust/source/anchors/rootCA.pem \
-  -v /mnt/docker.sock:/var/run/docker.sock \
+  -v /var/run/docker.sock:/var/run/docker.sock \
   {productrepo}/quay-builder:{productminv}
 ....
 [[set-up-github-build]]

modules/ref_deploy_quay_openshift.adoc

@@ -376,7 +376,7 @@ spec:
       volumes:
         - name: configvolume
           secret:
-            secretName: quay-enterprise-secret
+            secretName: quay-enterprise-config-secret
       containers:
       - name: quay-enterprise-app
         image: {productrepo}/quay:{productminv}
@@ -480,13 +480,14 @@ spec:
 ----
 
 .clair-config.yaml
+Modify source, endpoint, key_id, and registry settings to match your environment.
 [source,yaml,subs="verbatim,attributes"]
 ----
   clair:
     database:
       type: pgsql
       options:
-        source: host=postgres-clair port=5432 dbname=clair user=clair password=test123 sslmode=disable <1>
+        source: host=172.30.87.93 port=5432 dbname=clair user=clair password=test123 sslmode=disable
         cachesize: 16384
     api:
       # The port at which Clair will report its health status. For example, if Clair is running at
@@ -510,7 +511,7 @@ spec:
       http:
         # QUAY_ENDPOINT defines the endpoint at which Quay Enterprise is running.
         # For example: https://myregistry.mycompany.com
-        endpoint: http://quay-enterprise-clusterip/secscan/notify
+        endpoint: https://quay-enterprise.apps.lzha0413.qe.devcluster.openshift.com/secscan/notify <1>
         proxy: http://localhost:6063
 
   jwtproxy:
@@ -529,7 +530,7 @@ spec:
           options:
             # The ID of the service key generated for Clair. The ID is returned when setting up
             # the key in [Quay Enterprise Setup](security-scanning.md)
-            key_id: cd40f1c6a63f574c68ce882258925374882fac2b2f535ae5f8157c429e0c4b2e <2>
+            key_id: fc6c2b02c495c9b8fc674fcdbfdd2058f2f559d6bdd19d0ba70af26c0cb66a48 <2>
             private_key_path: /clair/config/security_scanner.pem
 
     verifier_proxies:
@@ -554,7 +555,7 @@ spec:
           options:
             # QUAY_ENDPOINT defines the endpoint at which Quay Enterprise is running.
             # Example: https://myregistry.mycompany.com
-            registry: http://quay-enterprise-clusterip/keys/
+            registry: https://quay-enterprise.apps.lzha0413.qe.devcluster.openshift.com/keys/
 ----
 <1> Check that the database options match those set earlier in postgres-clair-deployment.yaml.
 <2> Insert the Key ID matches the value from the key generated from the {productname} Setup screen.
@@ -617,13 +618,23 @@ spec:
           volumeMounts:
           - mountPath: /clair/config
             name: configvolume
+          - mountPath: /etc/pki/ca-trust/source/anchors/ca.crt
+            name: quay-ssl
+            subPath: ca.crt
         imagePullSecrets:
         - name: redhat-quay-pull-secret
         restartPolicy: Always
         volumes:
         - name: configvolume
           secret:
             secretName: clair-scanner-config-secret
+        - name: quay-ssl
+          secret:
+            defaultMode: 420
+            items:
+            - key: ssl.cert
+              path: ca.crt
+            secretName: quay-enterprise-config-secret
 ----
 
 == Repository mirroring
@@ -649,11 +660,19 @@ spec:
       labels:
         quay-enterprise-component: mirror-app
     spec:
+      volumes:
+      - name: configvolume
+        secret:
+          secretName: quay-enterprise-config-secret
       containers:
       - name: quay-enterprise-mirror-app
         image: {productrepo}/quay:{productminv}
         ports:
         - containerPort: 8443
+        volumeMounts:
+        - name: configvolume
+          readOnly: false
+          mountPath: /conf/stack
         command: ["/quay-registry/quay-entrypoint.sh"]
         args: ["repomirror"]
       imagePullSecrets: