Skip to content

Commit c4021ac

Browse files
dcmcanddcmcand
committed
Add Artifact Registry setup for external container images
- Create one-time setup script for Artifact Registry remote repository - Document the setup process and usage instructions - Update dev example to use Artifact Registry URL pattern - Add app_image_tag variable for flexible image versioning - Fix script to use correct gcloud syntax with custom upstream URL - Successfully created quay-remote repository in vor-infra-sz9k project
1 parent 5e86154 commit c4021ac

5 files changed

Lines changed: 179 additions & 3 deletions

File tree

‎cloud-run.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ resource "google_cloud_run_service" "main_app" {
2424
timeout_seconds = 300
2525

2626
containers {
27-
image = var.app_image
27+
image = "${var.app_image}:${var.app_image_tag}"
2828

2929
ports {
3030
container_port = var.app_port

‎docs/ARTIFACT_REGISTRY_SETUP.md‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Artifact Registry Setup for External Container Images
2+
3+
## Overview
4+
5+
Google Cloud Run now restricts container image sources to:
6+
- `gcr.io` (Google Container Registry)
7+
- `*.docker.pkg.dev` (Artifact Registry)
8+
- `docker.io` (Docker Hub)
9+
10+
To use images from other registries like `quay.io`, you must set up an Artifact Registry remote repository that acts as a proxy.
11+
12+
## One-Time Setup
13+
14+
This setup only needs to be done once per GCP project.
15+
16+
### Option 1: Using the Setup Script
17+
18+
1. Run the provided setup script:
19+
```bash
20+
cd scripts
21+
PROJECT_ID=your-project-id ./setup-artifact-registry.sh
22+
```
23+
24+
2. The script will:
25+
- Enable the Artifact Registry API
26+
- Create a remote repository named `quay-remote`
27+
- Configure it to proxy quay.io
28+
29+
### Option 2: Manual Setup
30+
31+
1. Enable the Artifact Registry API:
32+
```bash
33+
gcloud services enable artifactregistry.googleapis.com
34+
```
35+
36+
2. Create the remote repository:
37+
```bash
38+
gcloud artifacts repositories create quay-remote \
39+
--repository-format=docker \
40+
--mode=remote-repository \
41+
--location=us-central1 \
42+
--description="Remote repository for quay.io images" \
43+
--remote-docker-repo=https://quay.io
44+
```
45+
46+
## Using the Remote Repository
47+
48+
After setup, you need to update your image URLs:
49+
50+
### Original Image URL
51+
```
52+
quay.io/reiemp/hrafnar:latest
53+
```
54+
55+
### New Image URL
56+
```
57+
us-central1-docker.pkg.dev/YOUR_PROJECT_ID/quay-remote/reiemp/hrafnar:latest
58+
```
59+
60+
### In Terraform
61+
62+
Update your module configuration:
63+
64+
```hcl
65+
module "hrafnar_deploy" {
66+
source = "../.."
67+
68+
project_id = "your-project-id"
69+
name_prefix = "my-app"
70+
app_image = "us-central1-docker.pkg.dev/your-project-id/quay-remote/reiemp/hrafnar"
71+
app_image_tag = "latest"
72+
73+
# ... other configuration
74+
}
75+
```
76+
77+
## Testing
78+
79+
To verify the setup works:
80+
81+
1. Test pulling an image through the remote repository:
82+
```bash
83+
docker pull us-central1-docker.pkg.dev/YOUR_PROJECT_ID/quay-remote/reiemp/hrafnar:latest
84+
```
85+
86+
2. Deploy to Cloud Run:
87+
```bash
88+
gcloud run deploy test-app \
89+
--image=us-central1-docker.pkg.dev/YOUR_PROJECT_ID/quay-remote/reiemp/hrafnar:latest \
90+
--region=us-central1
91+
```
92+
93+
## Troubleshooting
94+
95+
### Authentication Issues
96+
If the quay.io repository requires authentication:
97+
1. Store credentials in Secret Manager
98+
2. Configure the remote repository with authentication:
99+
```bash
100+
gcloud artifacts repositories update quay-remote \
101+
--location=us-central1 \
102+
--remote-username=YOUR_USERNAME \
103+
--remote-password-secret-version=projects/PROJECT_ID/secrets/quay-password/versions/latest
104+
```
105+
106+
### Image Not Found
107+
- Verify the original image exists on quay.io
108+
- Check that the repository path is correct
109+
- Ensure the Artifact Registry API is enabled
110+
111+
### Performance
112+
- First pull will be slower as it fetches from quay.io
113+
- Subsequent pulls use the cached version in Artifact Registry
114+
- Configure cleanup policies to manage storage costs

‎examples/dev/main.tf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,10 @@ module "hrafnar_deploy" {
3131
# Required variables
3232
project_id = var.project_id
3333
name_prefix = var.name_prefix
34-
app_image = "quay.io/reiemp/hrafnar:latest"
34+
# For quay.io images, use Artifact Registry remote repository
35+
# See docs/ARTIFACT_REGISTRY_SETUP.md for one-time setup instructions
36+
app_image = "${var.region}-docker.pkg.dev/${var.project_id}/quay-remote/reiemp/hrafnar"
37+
app_image_tag = "latest"
3538

3639
# Production configuration
3740
region = var.region

‎scripts/setup-artifact-registry.sh‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#!/bin/bash
2+
# One-time setup script for Artifact Registry remote repository
3+
# This enables Cloud Run to pull images from quay.io
4+
5+
set -e
6+
7+
# Default values
8+
PROJECT_ID="${PROJECT_ID:-}"
9+
REGION="${REGION:-us-central1}"
10+
REPOSITORY_ID="quay-remote"
11+
12+
# Check if PROJECT_ID is set
13+
if [ -z "$PROJECT_ID" ]; then
14+
echo "Error: PROJECT_ID environment variable must be set"
15+
echo "Usage: PROJECT_ID=your-project-id ./setup-artifact-registry.sh"
16+
exit 1
17+
fi
18+
19+
echo "Setting up Artifact Registry remote repository for quay.io..."
20+
echo "Project ID: $PROJECT_ID"
21+
echo "Region: $REGION"
22+
echo "Repository ID: $REPOSITORY_ID"
23+
24+
# Enable required APIs
25+
echo "Enabling Artifact Registry API..."
26+
gcloud services enable artifactregistry.googleapis.com --project="$PROJECT_ID"
27+
28+
# Check if repository already exists
29+
if gcloud artifacts repositories describe "$REPOSITORY_ID" --location="$REGION" --project="$PROJECT_ID" &>/dev/null; then
30+
echo "Repository $REPOSITORY_ID already exists in $REGION"
31+
else
32+
echo "Creating Artifact Registry remote repository..."
33+
gcloud artifacts repositories create "$REPOSITORY_ID" \
34+
--repository-format=docker \
35+
--mode=remote-repository \
36+
--location="$REGION" \
37+
--description="Remote repository for quay.io images" \
38+
--remote-docker-repo=https://quay.io \
39+
--project="$PROJECT_ID"
40+
41+
echo "Repository created successfully!"
42+
fi
43+
44+
echo ""
45+
echo "Setup complete! You can now use images from quay.io through Artifact Registry."
46+
echo ""
47+
echo "To use an image from quay.io, replace the registry URL:"
48+
echo " Original: quay.io/reiemp/hrafnar:latest"
49+
echo " New: ${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/reiemp/hrafnar:latest"
50+
echo ""
51+
echo "Example in Terraform:"
52+
echo " app_image = \"${REGION}-docker.pkg.dev/${PROJECT_ID}/${REPOSITORY_ID}/reiemp/hrafnar\""
53+
echo " app_image_tag = \"latest\""

‎variables.tf‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,16 @@ variable "database_log_retention_days" {
8383

8484
# Application Configuration
8585
variable "app_image" {
86-
description = "Container image for the hrafnar application"
86+
description = "Container image for the hrafnar application (without tag)"
8787
type = string
8888
}
8989

90+
variable "app_image_tag" {
91+
description = "Container image tag"
92+
type = string
93+
default = "latest"
94+
}
95+
9096
variable "app_port" {
9197
description = "Port the application listens on"
9298
type = number

0 commit comments

Comments
 (0)