cloudnationhq / terraform-azure-acr

Terraform module which creates container registry resources used by workloads and accelerators.

Container registry

This terraform module automates the creation of container registry resources on the azure cloud platform, enabling easier deployment and management of container images.

Goals

The main objective is to create a more logic data structure, achieved by combining and grouping related resources together in a complex object.

The structure of the module promotes reusability. It's intended to be a repeatable component, simplifying the process of building diverse workloads and platform accelerators consistently.

A primary goal is to utilize keys and values in the object that correspond to the REST API's structure. This enables us to carry out iterations, increasing its practical value as time goes on.

A last key goal is to separate logic from configuration in the module, thereby enhancing its scalability, ease of customization, and manageability.

Non-Goals

These modules are not intended to be complete, ready-to-use solutions; they are designed as components for creating your own patterns.

They are not tailored for a single use case but are meant to be versatile and applicable to a range of scenarios.

Security standardization is applied at the pattern level, while the modules include default values based on best practices but do not enforce specific security standards.

End-to-end testing is not conducted on these modules, as they are individual components and do not undergo the extensive testing reserved for complete patterns or solutions.

Features

• data replication is possible across different geolocations
• detailed access control is ensured through the use of scope maps
• data protection is enhanced by encryption for data at rest
• utilization of terratest for robust validation.
• enables the configuration of multiple tasks and triggers
• supports enhanced scalability and isolation through dedicated agent pools
• integrates seamlessly with private endpoint capabilities for direct and secure connectivity.

Requirements

Name	Version
terraform	~> 1.0
azurerm	~> 3.61
random	~> 3.5.1

Providers

Name	Version
azurerm	~> 3.61

Resources

Name	Type
azurerm_container_registry	resource
azurerm_user_assigned_identity	resource
azurerm_role_assignment	resource
azurerm_container_registry_scope_map	resource
azurerm_container_registry_token	resource
azurerm_container_registry_token_password	resource
azurerm_key_vault_secret	resource
azurerm_container_registry_agent_pool	resource
azurerm_container_registry_task	resource
azurerm_subscription	data source
azurerm_client_config	data source

Inputs

Name	Description	Type	Required
registry	describes container registry related configuration	object	yes
naming	contains the naming convention	string	yes
location	default azure region tho be used	string	no
resource_group	default resource group to be used	string	no
tags	tags to be added to the resources	map(string)	no

Outputs

Name	Description
registry	contains the container registry related configuration
subscription_id	contains the current subscription id
agentpools	contains the agent pools

Testing

As a prerequirement, please ensure that both go and terraform are properly installed on your system.

The Makefile includes two distinct variations of tests. The first one is designed to deploy different usage scenarios of the module. These tests are executed by specifying the TF_PATH environment variable, which determines the different usages located in the example directory.

To execute this test, input the command make test TF_PATH=default, substituting default with the specific usage you wish to test.

The second variation is known as a extended test. This one performs additional checks and can be executed without specifying any parameters, using the command make test_extended.

Both are designed to be executed locally and are also integrated into the github workflow.

Each of these tests contributes to the robustness and resilience of the module. They ensure the module performs consistently and accurately under different scenarios and configurations.

Notes

For agent pool tasks, a personal access token with the repo scope is required

Using a dedicated module, we've developed a naming convention for resources that's based on specific regular expressions for each type, ensuring correct abbreviations and offering flexibility with multiple prefixes and suffixes

Full examples detailing all usages, along with integrations with dependency modules, are located in the examples directory

Authors

Module is maintained by these awesome contributors.

Contributing

We welcome contributions from the community! Whether it's reporting a bug, suggesting a new feature, or submitting a pull request, your input is highly valued.

For more information, please see our contribution guidelines.

License

MIT Licensed. See LICENSE for full details.

Reference

• Documentation
• Rest Api
• Rest Api Specs

terraform-azure-acr's Issues

add network rule set support

support for caching rules

resource is available at: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_registry_cache_rule

Create a simple build task (from a public image, e.g.: nginx) example in the ACR module on a private registry

add registry tasks submodule

To prevent dependency cycle errors it is best to only create a submodule for registry tasks and make agent pools optional in the main module.

refactor registry agentpools

In the current situation the data structure is wrong. We are forced to create agent pools to deploy tasks.

It should also be possible to create tasks without the use of agent pools. Because the data structure changes a major release is needed to ensure backwards compatibility.

support for webhooks

resource is available at: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_registry_webhook

properties needs to be more alligned

Is there an existing issue for this?

• I have searched the existing issues

Description

Some properties and outputs needs to be more aligned with our standards.

In the attached release (major) there will be a detailed overview of whats changed.

Potential Terraform Configuration

No response

References

No response

support for connected registries

resource is available at: https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_connected_registry

improve container registry task support