terraform-hrafnar-gcp-deploy/artifact-registry.tf at main · openteams-ai/terraform-hrafnar-gcp-deploy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# Artifact Registry standard repository for Docker images
resource "google_artifact_registry_repository" "docker_images" {
  count         = var.enable_artifact_registry ? 1 : 0
  location      = var.region
  repository_id = "docker-images"
  description   = "Standard repository for Docker images"
  format        = "DOCKER"
  mode          = "STANDARD_REPOSITORY"
  project       = var.project_id

  labels = local.common_labels

  depends_on = [google_project_service.required_apis]
}

# Artifact Registry remote repository for quay.io images
resource "google_artifact_registry_repository" "quay_remote" {
  count         = var.enable_artifact_registry ? 1 : 0
  location      = var.region
  repository_id = "quay-remote"
  description   = "Remote repository for quay.io images"
  format        = "DOCKER"
  mode          = "REMOTE_REPOSITORY"
  project       = var.project_id

  remote_repository_config {
    description = "Remote repository for quay.io"
    docker_repository {
      custom_repository {
        uri = "https://quay.io"
      }
    }
  }

  labels = local.common_labels

  depends_on = [google_project_service.required_apis]
}

# Grant Cloud Run service agent permission to pull images from docker-images repository
resource "google_artifact_registry_repository_iam_member" "cloud_run_docker_images_reader" {
  count      = var.enable_artifact_registry ? 1 : 0
  project    = var.project_id
  location   = var.region
  repository = google_artifact_registry_repository.docker_images[0].name
  role       = "roles/artifactregistry.reader"
  member     = "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"

  depends_on = [
    google_artifact_registry_repository.docker_images,
    google_project_service.required_apis
  ]
}

# Grant Cloud Run service agent permission to pull images from quay-remote repository
resource "google_artifact_registry_repository_iam_member" "cloud_run_quay_reader" {
  count      = var.enable_artifact_registry ? 1 : 0
  project    = var.project_id
  location   = var.region
  repository = google_artifact_registry_repository.quay_remote[0].name
  role       = "roles/artifactregistry.reader"
  member     = "serviceAccount:service-${data.google_project.current.number}@serverless-robot-prod.iam.gserviceaccount.com"

  depends_on = [
    google_artifact_registry_repository.quay_remote,
    google_project_service.required_apis
  ]
}

# Data source to get the current project information
data "google_project" "current" {
  project_id = var.project_id
}