Rewindex

ChangesRed Hat (incl. Quay.io)quay.io & registry.redhat logins failing with RHSSO

Red Hat (incl. Quay.io): Major incident: quay.io & registry.redhat logins failing with RHSSO

Major incidentmajor (vendor)Changed Detected stspg.io (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Incident page: the full timeline of updates

What changed

Struck in red is what Red Hat (incl. Quay.io) removed; blue is what they added. Muted text is unchanged context.

AddedTitle#1
Before: not present
After: quay.io & registry.redhat logins failing with RHSSO
AddedImpact#2
Before: not present
After: major
AddedStatus#3
Before: not present
After: postmortem
AddedStart time#4
Before: not present
After: 2026-01-29 18:59 UTC
AddedResolved time#5
Before: not present
After: 2026-01-29 19:51 UTC
AddedAffected components#6
Before: not present
After: API, Container Registries - registry.access.redhat.com, Container Registries - registry.connect.redhat.com, Container Registries - registry.redhat.io, Quay.io - API, registry.access.redhat.com, registry.connect.redhat.com, registry.redhat.io
AddedUpdateinvestigating#7
Before: not present
After: Users are facing login issues to Quay.io & registry.redhat with 403 errors.
AddedUpdateresolved#8
Before: not present
After: We identified an issue related to rate limiting and have rolled out a fix that has restored service.
AddedUpdatepostmortem#9
Before: not present
After: On January 29, 2026, Quay.io and Registry Proxy experienced a partial outage that caused approximately 50% of image pulls to fail and blocked new user logins. The failure occurred during a migration to a new cluster whose egress IPs had not been added to the RHSSO allowlist, which triggered automatic rate-limiting and blocked the authentication requests. Service was quickly restored by temporarily routing traffic back to the legacy cluster, and the team is implementing better rate limiting and authentication alerting to prevent a recurrence.

First version of this incident archived by Rewindex. View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Rewindex captured this after the last checkpoint; the next run (00:41 UTC) commits it.

This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.

History of this incident

Thursday, January 29

1 incident change

All Red Hat (incl. Quay.io) changesRed Hat (incl. Quay.io) profileMarkdownJSON