Skip to content

Commit 4e93036

Browse files
bryantbiggsbryantbiggs
authored
feat: Add support for repository creation template (#46)
* feat: Add support for repository creation template * chore: Fix example after another round of validation
1 parent df965a8 commit 4e93036

File tree

24 files changed

+1119
-17
lines changed

24 files changed

+1119
-17
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
repos:
22
- repo: https://github.com/antonbabenko/pre-commit-terraform
3-
rev: v1.89.0
3+
rev: v1.94.1
44
hooks:
55
- id: terraform_fmt
66
- id: terraform_wrapper_module_for_each

‎README.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
# AWS ECR Terraform module
1+
# Amazon ECR Terraform module
22

3-
Terraform module which creates AWS ECR resources.
3+
Terraform module which creates Amazon ECR resources.
44

55
## Usage
66

@@ -187,20 +187,21 @@ Users of Terragrunt can achieve similar results by using modules provided in the
187187
Examples codified under the [`examples`](https://github.com/terraform-aws-modules/terraform-aws-ecr/tree/master/examples) are intended to give users references for how to use the module(s) as well as testing/validating changes to the source code of the module. If contributing to the project, please be sure to make any appropriate updates to the relevant examples to allow maintainers to test your changes and to keep the examples up to date for users. Thank you!
188188

189189
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-ecr/tree/master/examples/complete)
190+
- [Repository Template](https://github.com/terraform-aws-modules/terraform-aws-ecr/tree/master/examples/repository-template)
190191

191-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
192+
<!-- BEGIN_TF_DOCS -->
192193
## Requirements
193194

194195
| Name | Version |
195196
|------|---------|
196197
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
197-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.37 |
198+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
198199

199200
## Providers
200201

201202
| Name | Version |
202203
|------|---------|
203-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.37 |
204+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
204205

205206
## Modules
206207

@@ -264,7 +265,7 @@ No modules.
264265
| <a name="output_repository_name"></a> [repository\_name](#output\_repository\_name) | Name of the repository |
265266
| <a name="output_repository_registry_id"></a> [repository\_registry\_id](#output\_repository\_registry\_id) | The registry ID where the repository was created |
266267
| <a name="output_repository_url"></a> [repository\_url](#output\_repository\_url) | The URL of the repository |
267-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
268+
<!-- END_TF_DOCS -->
268269

269270
## License
270271

‎examples/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1-
# Terraform AWS ECR Examples
1+
# Terraform Amazon ECR Examples
22

33
- [Complete](https://github.com/terraform-aws-modules/terraform-aws-ecr/tree/master/examples/complete)
4+
- [Repository Template](https://github.com/terraform-aws-modules/terraform-aws-ecr/tree/master/examples/repository-template)

‎examples/complete/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Complete AWS ECR Example
1+
# Amazon ECR Complete Example
22

33
Configuration in this directory creates:
44

@@ -22,19 +22,19 @@ $ terraform apply
2222

2323
Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources.
2424

25-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
25+
<!-- BEGIN_TF_DOCS -->
2626
## Requirements
2727

2828
| Name | Version |
2929
|------|---------|
3030
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
31-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.37 |
31+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
3232

3333
## Providers
3434

3535
| Name | Version |
3636
|------|---------|
37-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.37 |
37+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
3838

3939
## Modules
4040

@@ -69,6 +69,6 @@ No inputs.
6969
| <a name="output_repository_name"></a> [repository\_name](#output\_repository\_name) | Name of the repository |
7070
| <a name="output_repository_registry_id"></a> [repository\_registry\_id](#output\_repository\_registry\_id) | The registry ID where the repository was created |
7171
| <a name="output_repository_url"></a> [repository\_url](#output\_repository\_url) | The URL of the repository (in the form `aws_account_id.dkr.ecr.region.amazonaws.com/repositoryName`) |
72-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
72+
<!-- END_TF_DOCS -->
7373

7474
Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-ecr/blob/master/LICENSE).

‎examples/complete/versions.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.37"
7+
version = ">= 5.61"
88
}
99
}
1010
}

‎examples/repository-template/README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Amazon ECR Repository Template Example
2+
3+
## Usage
4+
5+
To run this example you need to execute:
6+
7+
```bash
8+
$ terraform init
9+
$ terraform plan
10+
$ terraform apply
11+
```
12+
13+
You can validate this example by running the commands generated in the `example_docker_pull_commands` output value.
14+
15+
Note that this example may create resources which will incur monetary charges on your AWS bill. Run `terraform destroy` when you no longer need these resources.
16+
17+
If you validate the example by using the pull-through cache, you will need to manually clean up these repositories within ECR since they are not manage by Terraform.
18+
19+
<!-- BEGIN_TF_DOCS -->
20+
## Requirements
21+
22+
| Name | Version |
23+
|------|---------|
24+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
25+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.61 |
26+
27+
## Providers
28+
29+
| Name | Version |
30+
|------|---------|
31+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.61 |
32+
33+
## Modules
34+
35+
| Name | Source | Version |
36+
|------|--------|---------|
37+
| <a name="module_disabled"></a> [disabled](#module\_disabled) | ../../modules/repository-template | n/a |
38+
| <a name="module_dockerhub_pull_through_cache_repository_template"></a> [dockerhub\_pull\_through\_cache\_repository\_template](#module\_dockerhub\_pull\_through\_cache\_repository\_template) | ../../modules/repository-template | n/a |
39+
| <a name="module_public_ecr_pull_through_cache_repository_template"></a> [public\_ecr\_pull\_through\_cache\_repository\_template](#module\_public\_ecr\_pull\_through\_cache\_repository\_template) | ../../modules/repository-template | n/a |
40+
| <a name="module_secrets_manager_dockerhub_credentials"></a> [secrets\_manager\_dockerhub\_credentials](#module\_secrets\_manager\_dockerhub\_credentials) | terraform-aws-modules/secrets-manager/aws | ~> 1.0 |
41+
42+
## Resources
43+
44+
| Name | Type |
45+
|------|------|
46+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
47+
48+
## Inputs
49+
50+
No inputs.
51+
52+
## Outputs
53+
54+
| Name | Description |
55+
|------|-------------|
56+
| <a name="output_example_docker_pull_commands"></a> [example\_docker\_pull\_commands](#output\_example\_docker\_pull\_commands) | Example docker pull commands to test and validate the example |
57+
| <a name="output_iam_role_arn"></a> [iam\_role\_arn](#output\_iam\_role\_arn) | IAM role ARN |
58+
| <a name="output_iam_role_name"></a> [iam\_role\_name](#output\_iam\_role\_name) | IAM role name |
59+
| <a name="output_iam_role_unique_id"></a> [iam\_role\_unique\_id](#output\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
60+
<!-- END_TF_DOCS -->
61+
62+
Apache-2.0 Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-aws-ecr/blob/master/LICENSE).

‎examples/repository-template/main.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
provider "aws" {
2+
region = local.region
3+
}
4+
5+
locals {
6+
region = "us-east-1"
7+
name = "ecr-ex-${basename(path.cwd)}"
8+
9+
account_id = data.aws_caller_identity.current.account_id
10+
11+
tags = {
12+
Name = local.name
13+
Example = local.name
14+
Repository = "https://github.com/terraform-aws-modules/terraform-aws-ecr"
15+
}
16+
}
17+
18+
data "aws_caller_identity" "current" {}
19+
20+
################################################################################
21+
# ECR Repository Template
22+
################################################################################
23+
24+
module "public_ecr_pull_through_cache_repository_template" {
25+
source = "../../modules/repository-template"
26+
27+
# Template
28+
description = "Pull through cache repository template for Public ECR artifacts"
29+
prefix = "ecr-public"
30+
resource_tags = local.tags
31+
lifecycle_policy = jsonencode({
32+
rules = [
33+
{
34+
rulePriority = 1,
35+
description = "Keep last 30 images",
36+
selection = {
37+
tagStatus = "tagged",
38+
tagPrefixList = ["v"],
39+
countType = "imageCountMoreThan",
40+
countNumber = 30
41+
},
42+
action = {
43+
type = "expire"
44+
}
45+
}
46+
]
47+
})
48+
49+
# Pull through cache rule
50+
create_pull_through_cache_rule = true
51+
upstream_registry_url = "public.ecr.aws"
52+
53+
tags = local.tags
54+
}
55+
56+
module "dockerhub_pull_through_cache_repository_template" {
57+
source = "../../modules/repository-template"
58+
59+
# Template
60+
description = "Pull through cache repository template for Dockerhub artifacts"
61+
prefix = "docker-hub"
62+
resource_tags = local.tags
63+
64+
# Pull through cache rule
65+
create_pull_through_cache_rule = true
66+
upstream_registry_url = "registry-1.docker.io"
67+
credential_arn = module.secrets_manager_dockerhub_credentials.secret_arn
68+
69+
tags = local.tags
70+
}
71+
72+
module "disabled" {
73+
source = "../../modules/repository-template"
74+
75+
create = false
76+
}
77+
78+
################################################################################
79+
# Supporting Resources
80+
################################################################################
81+
82+
module "secrets_manager_dockerhub_credentials" {
83+
source = "terraform-aws-modules/secrets-manager/aws"
84+
version = "~> 1.0"
85+
86+
# Secret names must contain 1-512 Unicode characters and be prefixed with ecr-pullthroughcache/
87+
name_prefix = "ecr-pullthroughcache/dockerhub-credentials"
88+
description = "Dockerhub credentials"
89+
90+
# For example only
91+
recovery_window_in_days = 0
92+
secret_string = jsonencode({
93+
username = "example"
94+
accessToken = "YouShouldNotStoreThisInPlainText"
95+
})
96+
97+
# Policy
98+
create_policy = true
99+
block_public_policy = true
100+
policy_statements = {
101+
read = {
102+
sid = "AllowAccountRead"
103+
principals = [{
104+
type = "AWS"
105+
identifiers = ["arn:aws:iam::${local.account_id}:root"]
106+
}]
107+
actions = ["secretsmanager:GetSecretValue"]
108+
resources = ["*"]
109+
}
110+
}
111+
112+
tags = local.tags
113+
}

‎examples/repository-template/outputs.tf‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
output "iam_role_name" {
2+
description = "IAM role name"
3+
value = module.dockerhub_pull_through_cache_repository_template.iam_role_name
4+
}
5+
6+
output "iam_role_arn" {
7+
description = "IAM role ARN"
8+
value = module.dockerhub_pull_through_cache_repository_template.iam_role_arn
9+
}
10+
11+
output "iam_role_unique_id" {
12+
description = "Stable and unique string identifying the IAM role"
13+
value = module.public_ecr_pull_through_cache_repository_template.iam_role_unique_id
14+
}
15+
16+
output "example_docker_pull_commands" {
17+
description = "Example docker pull commands to test and validate the example"
18+
value = <<-EOT
19+
# Ensure your local CLI is authenticated with ECR
20+
aws ecr get-login-password --region ${local.region} | docker login --username AWS --password-stdin ${local.account_id}.dkr.ecr.${local.region}.amazonaws.com
21+
22+
# Dockerhub pull through cache and repo creation
23+
docker pull ${local.account_id}.dkr.ecr.${local.region}.amazonaws.com/docker-hub/library/nginx:latest
24+
25+
# Public ECR pull through cache and repo creation
26+
docker pull ${local.account_id}.dkr.ecr.${local.region}.amazonaws.com/ecr-public/docker/library/nginx:latest
27+
EOT
28+
}

‎examples/repository-template/variables.tf‎

Whitespace-only changes.

‎examples/repository-template/versions.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.61"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)