A Terraform module for Google Cloud Platform (GCP).
This module supports Terraform version 1 and is compatible with the Terraform Google Provider version 5.14.
This module is part of our Infrastructure as Code (IaC) framework that enables our users and customers to easily deploy and manage reusable, secure, and production-grade cloud infrastructure.
As the evolution of Google Container Registry (GCR), Artifact Registry is a single place for your organization to manage container images and language packages (such as Maven and npm).
It is fully integrated with Google Cloud’s tooling and runtimes and comes with support for native artifact protocols. This makes it simple to integrate with your CI/CD tooling to set up automated pipelines.
Contrary to GCR, Artifact Registry doesn’t have the concept of a single registry that you can use to push multiple images or packages to. It rather allows you to create repositories with a single purpose (single-responsibility), e.g. a repository that stores Docker images, a repository that stores npm images, etc.
For getting an overview of the available formats, please see https://cloud.google.com/artifact-registry/docs/supported-formats.
- Module Features
- Getting Started
- Module Argument Reference
- Module Outputs
- External Documentation
- Module Versioning
- About Mineiros
- Reporting Issues
- Contributing
- Makefile Targets
- License
This module implements the following Terraform resources
google_artifact_registry_repository
and supports additional features of the following modules:
Most basic usage just setting required arguments:
module "terraform-google-artifact-registry-repository" {
source = "github.com/mineiros-io/terraform-google-artifact-registry-repository?ref=v0.0.3"
repository_id = "my-repository"
}
See variables.tf and examples/ for details and use-cases.
-
module_enabled
: (Optionalbool
)Specifies whether resources in the module will be created.
Default is
true
. -
module_timeouts
: (Optionalmap(timeout)
)A map of timeout objects that is keyed by Terraform resource name defining timeouts for
create
,update
anddelete
Terraform operations. Supported resource names are:google_artifact_registry_repository
.Example:
module_timeouts = { google_artifact_registry_repository = { create = "4m" update = "4m" delete = "4m" } }
Each
timeout
object in the map accepts the following attributes: -
module_depends_on
: (Optionallist(dependency)
)A list of dependencies. Any object can be assigned to this list to define a hidden external dependency.
Default is
[]
.Example:
module_depends_on = [ null_resource.name ]
-
repository_id
: (Requiredstring
)The last part of the repository name, for example:
repo1
. -
location
: (Optionalstring
)The name of the location this repository is located in. If it is not provided, the provider location is used.
-
format
: (Optionalstring
)The format of packages that are stored in the repository. You can only create alpha formats if you are a member of the alpha user group. Possible values are
DOCKER
,MAVEN
,NPM
,PYTHON
,APT
(alpha),YUM
(alpha).Default is
"DOCKER"
. -
description
: (Optionalstring
)The user-provided description of the repository.
-
labels
: (Optionalmap(string)
)Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.
-
kms_key_name
: (Optionalstring
)The Cloud KMS resource name of the customer managed encryption key that's used to encrypt the contents of the Repository. Has the form:
projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key
. This value may not be changed after the Repository has been created. -
project
: (Optionalstring
)The ID of the project in which the resource belongs. If it is not provided, the provider project is used.
-
cleanup_policy_dry_run
: (Optionalbool
)If true, the cleanup pipeline is prevented from deleting versions in this repository.
-
cleanup_policies
: (Optionalany
)Cleanup policies for this repository.
The object accepts the following attributes:
-
id
: (Optionalstring
)(Required) The identifier for this object. Format specified above.
-
action
: (Optionalstring
)(Optional) Policy action. Possible values are: DELETE, KEEP.
-
condition
: (Optionalnumber
)(Optional) Policy condition for matching versions.
The object accepts the following attributes:
-
tag_state
: (Optionalstring
)(Optional) Match versions by tag status. Possible values are: TAGGED, UNTAGGED, ANY.
Default is
"ANY"
. -
tag_prefixes
: (Optionalstring
)(Optional) Match versions by tag prefix. Applied on any prefix match.
-
version_name_prefixes
: (Optionalstring
)(Optional) Match versions by version name prefix. Applied on any prefix match.
-
package_name_prefixes
: (Optionalstring
)(Optional) Match versions by package prefix. Applied on any prefix match.
-
older_than
: (Optionalstring
)(Optional) Match versions older than a duration.
-
newer_than
: (Optionalstring
)(Optional) Match versions newer than a duration.
-
-
most_recent_versions
: (Optionalnumber
)(Optional) Policy condition for retaining a minimum number of versions. May only be specified with a Keep action.
The object accepts the following attributes:
-
package_name_prefixes
: (Optionalstring
)(Optional) Match versions by package prefix. Applied on any prefix match.
-
keep_count
: (Optionalstring
)(Optional) Minimum number of versions to keep.
-
-
-
iam
: (Optionallist(iam)
)A list of IAM access.
Default is
[]
.Example:
iam = [{ role = "roles/artifactregistry.writer" members = ["user:[email protected]"] authoritative = false }]
Each
iam
object in the list accepts the following attributes:-
members
: (Optionalset(string)
)Identities that will be granted the privilege in role. Each entry can have one of the following values:
allUsers
: A special identifier that represents anyone who is on the internet; with or without a Google account.allAuthenticatedUsers
: A special identifier that represents anyone who is authenticated with a Google account or a service account.user:{emailid}
: An email address that represents a specific Google account. For example, [email protected] or [email protected].serviceAccount:{emailid}
: An email address that represents a service account. For example, [email protected].group:{emailid}
: An email address that represents a Google group. For example, [email protected].domain:{domain}
: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.projectOwner:projectid
: Owners of the given project. For example,projectOwner:my-example-project
projectEditor:projectid
: Editors of the given project. For example,projectEditor:my-example-project
projectViewer:projectid
: Viewers of the given project. For example,projectViewer:my-example-project
computed:{identifier}
: An existing key fromvar.computed_members_map
.
Default is
[]
. -
role
: (Optionalstring
)The role that should be applied. Note that custom roles must be of the format
[projects|organizations]/{parent-name}/roles/{role-name}
. -
roles
: (Optionallist(string)
)The set of roles that should be applied. Note that custom roles must be of the format
[projects|organizations]/{parent-name}/roles/{role-name}
. -
authoritative
: (Optionalbool
)Whether to exclusively set (authoritative mode) or add (non-authoritative/additive mode) members to the role.
Default is
true
. -
condition
: (Optionalobject(condition)
)An IAM Condition for a given binding.
Example:
condition = { expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")" title = "expires_after_2021_12_31" }
-
-
computed_members_map
: (Optionalmap(string)
)A map of members to replace in
members
of various IAM settings to handle terraform computed values.Default is
{}
. -
policy_bindings
: (Optionallist(policy_bindings)
)A list of IAM policy bindings.
Example:
policy_bindings = [{ role = "roles/artifactregistry.writer" members = ["user:[email protected]"] condition = { title = "expires_after_2021_12_31" description = "Expiring at midnight of 2021-12-31" expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")" } }]
Each
policy_bindings
object in the list accepts the following attributes:-
role
: (Requiredstring
)The role that should be applied.
-
members
: (Optionalset(string)
)Identities that will be granted the privilege in
role
.Default is
var.members
. -
condition
: (Optionalobject(condition)
)An IAM Condition for a given binding.
Example:
condition = { expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")" title = "expires_after_2021_12_31" }
The
condition
object accepts the following attributes:-
expression
: (Requiredstring
)Textual representation of an expression in Common Expression Language syntax.
-
title
: (Requiredstring
)A title for the expression, i.e. a short string describing its purpose.
-
description
: (Optionalstring
)An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
-
-
The following attributes are exported in the outputs of the module:
-
repository
: (object(repository)
)All
google_artifact_registry_repository
resource attributes. -
iam
: (list(iam)
)The
iam
resource objects that define the access to the resources. -
policy_binding
: (object(policy_binding)
)All attributes of the created policy_bindings
mineiros-io/terraform-google-artifact-registry-repository-iam/google
module when using policy bindings.
- https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository
- https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository_iam
This Module follows the principles of Semantic Versioning (SemVer).
Given a version number MAJOR.MINOR.PATCH
, we increment the:
MAJOR
version when we make incompatible changes,MINOR
version when we add functionality in a backwards compatible manner, andPATCH
version when we make backwards compatible bug fixes.
- Backwards compatibility in versions
0.0.z
is not guaranteed whenz
is increased. (Initial development) - Backwards compatibility in versions
0.y.z
is not guaranteed wheny
is increased. (Pre-release)
Mineiros is a remote-first company headquartered in Berlin, Germany that solves development, automation and security challenges in cloud infrastructure.
Our vision is to massively reduce time and overhead for teams to manage and deploy production-grade and secure cloud infrastructure.
We offer commercial support for all of our modules and encourage you to reach out if you have any questions or need help. Feel free to email us at [email protected] or join our Community Slack channel.
We use GitHub Issues to track community reported issues and missing features.
Contributions are always encouraged and welcome! For the process of accepting changes, we use Pull Requests. If you'd like more information, please see our Contribution Guidelines.
This repository comes with a handy Makefile.
Run make help
to see details on each available target.
This module is licensed under the Apache License Version 2.0, January 2004. Please see LICENSE for full details.
Copyright © 2020-2022 Mineiros GmbH