terraform-google-artifact-registry-repository

A Terraform module for Google Cloud Platform (GCP).

This module supports Terraform version 1 and is compatible with the Terraform Google Provider version 5.14.

This module is part of our Infrastructure as Code (IaC) framework that enables our users and customers to easily deploy and manage reusable, secure, and production-grade cloud infrastructure.

As the evolution of Google Container Registry (GCR), Artifact Registry is a single place for your organization to manage container images and language packages (such as Maven and npm).

It is fully integrated with Google Cloud’s tooling and runtimes and comes with support for native artifact protocols. This makes it simple to integrate with your CI/CD tooling to set up automated pipelines.

Contrary to GCR, Artifact Registry doesn’t have the concept of a single registry that you can use to push multiple images or packages to. It rather allows you to create repositories with a single purpose (single-responsibility), e.g. a repository that stores Docker images, a repository that stores npm images, etc.

For getting an overview of the available formats, please see https://cloud.google.com/artifact-registry/docs/supported-formats.

• Module Features
• Getting Started
• Module Argument Reference
  • Top-level Arguments
    • Module Configuration
    • Main Resource Configuration
    • Extended Resource Configuration
• Module Outputs
• External Documentation
  • Google Documentation
  • Terraform Google Provider Documentation:
• Module Versioning
  • Backwards compatibility in 0.0.z and 0.y.z version
• About Mineiros
• Reporting Issues
• Contributing
• Makefile Targets
• License

Module Features

This module implements the following Terraform resources

• google_artifact_registry_repository

and supports additional features of the following modules:

• mineiros-io/terraform-google-artifact-registry-repository-iam

Getting Started

Most basic usage just setting required arguments:

module "terraform-google-artifact-registry-repository" {
  source = "github.com/mineiros-io/terraform-google-artifact-registry-repository?ref=v0.0.3"

  repository_id = "my-repository"
}

Module Argument Reference

See variables.tf and examples/ for details and use-cases.

Top-level Arguments

Module Configuration

• module_enabled: (Optional bool)

  Specifies whether resources in the module will be created.

  Default is true.

• module_timeouts: (Optional map(timeout))

  A map of timeout objects that is keyed by Terraform resource name defining timeouts for create, update and delete Terraform operations. Supported resource names are: google_artifact_registry_repository.

  Example:

  module_timeouts = {
    google_artifact_registry_repository = {
      create = "4m"
      update = "4m"
      delete = "4m"
    }
  }

  Each timeout object in the map accepts the following attributes:

  • create: (Optional string)

    Timeout for create operations.

  • update: (Optional string)

    Timeout for update operations.

  • delete: (Optional string)

    Timeout for delete operations.

• module_depends_on: (Optional list(dependency))

  A list of dependencies. Any object can be assigned to this list to define a hidden external dependency.

  Default is [].

  Example:

  module_depends_on = [
    null_resource.name
  ]

Main Resource Configuration

• repository_id: (Required string)

  The last part of the repository name, for example: repo1.

• location: (Optional string)

  The name of the location this repository is located in. If it is not provided, the provider location is used.

• format: (Optional string)

  The format of packages that are stored in the repository. You can only create alpha formats if you are a member of the alpha user group. Possible values are DOCKER, MAVEN, NPM, PYTHON, APT (alpha), YUM (alpha).

  Default is "DOCKER".

• description: (Optional string)

  The user-provided description of the repository.

• labels: (Optional map(string))

  Labels with user-defined metadata. This field may contain up to 64 entries. Label keys and values may be no longer than 63 characters. Label keys must begin with a lowercase letter and may only contain lowercase letters, numeric characters, underscores, and dashes.

• kms_key_name: (Optional string)

  The Cloud KMS resource name of the customer managed encryption key that's used to encrypt the contents of the Repository. Has the form: projects/my-project/locations/my-region/keyRings/my-kr/cryptoKeys/my-key. This value may not be changed after the Repository has been created.

• project: (Optional string)

  The ID of the project in which the resource belongs. If it is not provided, the provider project is used.

• cleanup_policy_dry_run: (Optional bool)

  If true, the cleanup pipeline is prevented from deleting versions in this repository.

• cleanup_policies: (Optional any)

  Cleanup policies for this repository.

  The object accepts the following attributes:

  • id: (Optional string)

    (Required) The identifier for this object. Format specified above.

  • action: (Optional string)

    (Optional) Policy action. Possible values are: DELETE, KEEP.

  • condition: (Optional number)

    (Optional) Policy condition for matching versions.

    The object accepts the following attributes:

    • tag_state: (Optional string)

      (Optional) Match versions by tag status. Possible values are: TAGGED, UNTAGGED, ANY.

      Default is "ANY".

    • tag_prefixes: (Optional string)

      (Optional) Match versions by tag prefix. Applied on any prefix match.

    • version_name_prefixes: (Optional string)

      (Optional) Match versions by version name prefix. Applied on any prefix match.

    • package_name_prefixes: (Optional string)

      (Optional) Match versions by package prefix. Applied on any prefix match.

    • older_than: (Optional string)

      (Optional) Match versions older than a duration.

    • newer_than: (Optional string)

      (Optional) Match versions newer than a duration.

  • most_recent_versions: (Optional number)

    (Optional) Policy condition for retaining a minimum number of versions. May only be specified with a Keep action.

    The object accepts the following attributes:

    • package_name_prefixes: (Optional string)

      (Optional) Match versions by package prefix. Applied on any prefix match.

    • keep_count: (Optional string)

      (Optional) Minimum number of versions to keep.

Extended Resource Configuration

• iam: (Optional list(iam))

  A list of IAM access.

  Default is [].

  Example:

  iam = [{
    role = "roles/artifactregistry.writer"
    members = ["user:member@example.com"]
    authoritative = false
  }]

  Each iam object in the list accepts the following attributes:

  • members: (Optional set(string))

    Identities that will be granted the privilege in role. Each entry can have one of the following values:

    • allUsers: A special identifier that represents anyone who is on the internet; with or without a Google account.
    • allAuthenticatedUsers: A special identifier that represents anyone who is authenticated with a Google account or a service account.
    • user:{emailid}: An email address that represents a specific Google account. For example, alice@gmail.com or joe@example.com.
    • serviceAccount:{emailid}: An email address that represents a service account. For example, my-other-app@appspot.gserviceaccount.com.
    • group:{emailid}: An email address that represents a Google group. For example, admins@example.com.
    • domain:{domain}: A G Suite domain (primary, instead of alias) name that represents all the users of that domain. For example, google.com or example.com.
    • projectOwner:projectid: Owners of the given project. For example, projectOwner:my-example-project
    • projectEditor:projectid: Editors of the given project. For example, projectEditor:my-example-project
    • projectViewer:projectid: Viewers of the given project. For example, projectViewer:my-example-project
    • computed:{identifier}: An existing key from var.computed_members_map.

    Default is [].

  • role: (Optional string)

    The role that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

  • roles: (Optional list(string))

    The set of roles that should be applied. Note that custom roles must be of the format [projects|organizations]/{parent-name}/roles/{role-name}.

  • authoritative: (Optional bool)

    Whether to exclusively set (authoritative mode) or add (non-authoritative/additive mode) members to the role.

    Default is true.

  • condition: (Optional object(condition))

    An IAM Condition for a given binding.

    Example:

    condition = {
      expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")"
      title      = "expires_after_2021_12_31"
    }

• computed_members_map: (Optional map(string))

  A map of members to replace in members of various IAM settings to handle terraform computed values.

  Default is {}.

• policy_bindings: (Optional list(policy_bindings))

  A list of IAM policy bindings.

  Example:

  policy_bindings = [{
    role    = "roles/artifactregistry.writer"
    members = ["user:member@example.com"]
    condition = {
      title       = "expires_after_2021_12_31"
      description = "Expiring at midnight of 2021-12-31"
      expression  = "request.time < timestamp(\"2022-01-01T00:00:00Z\")"
    }
  }]

  Each policy_bindings object in the list accepts the following attributes:

  • role: (Required string)

    The role that should be applied.

  • members: (Optional set(string))

    Identities that will be granted the privilege in role.

    Default is var.members.

  • condition: (Optional object(condition))

    An IAM Condition for a given binding.

    Example:

    condition = {
      expression = "request.time < timestamp(\"2022-01-01T00:00:00Z\")"
      title      = "expires_after_2021_12_31"
    }

    The condition object accepts the following attributes:

    • expression: (Required string)

      Textual representation of an expression in Common Expression Language syntax.

    • title: (Required string)

      A title for the expression, i.e. a short string describing its purpose.

    • description: (Optional string)

      An optional description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.

Module Outputs

The following attributes are exported in the outputs of the module:

• repository: (object(repository))

  All google_artifact_registry_repository resource attributes.

• iam: (list(iam))

  The iam resource objects that define the access to the resources.

• policy_binding: (object(policy_binding))

  All attributes of the created policy_bindings mineiros-io/terraform-google-artifact-registry-repository-iam/google module when using policy bindings.

External Documentation

Google Documentation

• https://cloud.google.com/artifact-registry

Terraform Google Provider Documentation:

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/artifact_registry_repository_iam

Module Versioning

This Module follows the principles of Semantic Versioning (SemVer).

Given a version number MAJOR.MINOR.PATCH, we increment the:

1. MAJOR version when we make incompatible changes,
2. MINOR version when we add functionality in a backwards compatible manner, and
3. PATCH version when we make backwards compatible bug fixes.

Backwards compatibility in 0.0.z and 0.y.z version

• Backwards compatibility in versions 0.0.z is not guaranteed when z is increased. (Initial development)
• Backwards compatibility in versions 0.y.z is not guaranteed when y is increased. (Pre-release)

About Mineiros

Mineiros is a remote-first company headquartered in Berlin, Germany that solves development, automation and security challenges in cloud infrastructure.

Our vision is to massively reduce time and overhead for teams to manage and deploy production-grade and secure cloud infrastructure.

We offer commercial support for all of our modules and encourage you to reach out if you have any questions or need help. Feel free to email us at hello@mineiros.io or join our Community Slack channel.

Reporting Issues

We use GitHub Issues to track community reported issues and missing features.

Contributing

Contributions are always encouraged and welcome! For the process of accepting changes, we use Pull Requests. If you'd like more information, please see our Contribution Guidelines.

Makefile Targets

This repository comes with a handy Makefile. Run make help to see details on each available target.

License

This module is licensed under the Apache License Version 2.0, January 2004. Please see LICENSE for full details.

Copyright © 2020-2022 Mineiros GmbH