Add vulnerability scanning to artifact registry module (#3040)
* Add vulnerability scanning to artifact registry module * make variable nullable = false * tfdoc --------- Co-authored-by: Luca Prete <lucaprete@google.com>
This commit is contained in:
Luca Prete
@@ -300,18 +300,19 @@ module "additive_iam" {
|
||||
| name | description | type | required | default |
|
||||
|---|---|:---:|:---:|:---:|
|
||||
| [cleanup_policies](variables.tf#L17) | Object containing details about the cleanup policies for an Artifact Registry repository. | <code title="map(object({ action = string condition = optional(object({ tag_state = optional(string) tag_prefixes = optional(list(string)) older_than = optional(string) newer_than = optional(string) package_name_prefixes = optional(list(string)) version_name_prefixes = optional(list(string)) })) most_recent_versions = optional(object({ package_name_prefixes = optional(list(string)) keep_count = optional(number) })) })) default = null">map(object({…default = null</code> | ✓ | |
|
||||
| [format](variables.tf#L56) | Repository format. | <code title="object({ apt = optional(object({ remote = optional(object({ public_repository = string # "BASE path" disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) })) docker = optional(object({ remote = optional(object({ public_repository = optional(string) common_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(object({ immutable_tags = optional(bool) })) virtual = optional(map(object({ repository = string priority = number }))) })) kfp = optional(object({ standard = optional(bool) })) generic = optional(object({ standard = optional(bool) })) go = optional(object({ standard = optional(bool) })) googet = optional(object({ standard = optional(bool) })) maven = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(object({ allow_snapshot_overwrites = optional(bool) version_policy = optional(string) })) virtual = optional(map(object({ repository = string priority = number }))) })) npm = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) virtual = optional(map(object({ repository = string priority = number }))) })) python = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) virtual = optional(map(object({ repository = string priority = number }))) })) yum = optional(object({ remote = optional(object({ public_repository = string # "BASE path" disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) })) })">object({…})</code> | ✓ | |
|
||||
| [location](variables.tf#L206) | Registry location. Use `gcloud beta artifacts locations list' to get valid values. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L211) | Registry name. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L216) | Registry project id. | <code>string</code> | ✓ | |
|
||||
| [format](variables.tf#L63) | Repository format. | <code title="object({ apt = optional(object({ remote = optional(object({ public_repository = string # "BASE path" disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) })) docker = optional(object({ remote = optional(object({ public_repository = optional(string) common_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(object({ immutable_tags = optional(bool) })) virtual = optional(map(object({ repository = string priority = number }))) })) kfp = optional(object({ standard = optional(bool) })) generic = optional(object({ standard = optional(bool) })) go = optional(object({ standard = optional(bool) })) googet = optional(object({ standard = optional(bool) })) maven = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(object({ allow_snapshot_overwrites = optional(bool) version_policy = optional(string) })) virtual = optional(map(object({ repository = string priority = number }))) })) npm = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) virtual = optional(map(object({ repository = string priority = number }))) })) python = optional(object({ remote = optional(object({ public_repository = optional(string) custom_repository = optional(string) disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) virtual = optional(map(object({ repository = string priority = number }))) })) yum = optional(object({ remote = optional(object({ public_repository = string # "BASE path" disable_upstream_validation = optional(bool) upstream_credentials = optional(object({ username = string password_secret_version = string })) })) standard = optional(bool) })) })">object({…})</code> | ✓ | |
|
||||
| [location](variables.tf#L213) | Registry location. Use `gcloud beta artifacts locations list' to get valid values. | <code>string</code> | ✓ | |
|
||||
| [name](variables.tf#L218) | Registry name. | <code>string</code> | ✓ | |
|
||||
| [project_id](variables.tf#L223) | Registry project id. | <code>string</code> | ✓ | |
|
||||
| [cleanup_policy_dry_run](variables.tf#L38) | If true, the cleanup pipeline is prevented from deleting versions in this repository. | <code>bool</code> | | <code>null</code> |
|
||||
| [description](variables.tf#L44) | An optional description for the repository. | <code>string</code> | | <code>"Terraform-managed registry"</code> |
|
||||
| [encryption_key](variables.tf#L50) | The KMS key name to use for encryption at rest. | <code>string</code> | | <code>null</code> |
|
||||
| [enable_vulnerability_scanning](variables.tf#L50) | Whether vulnerability scanning should be enabled in the repository. | <code>bool</code> | | <code>true</code> |
|
||||
| [encryption_key](variables.tf#L57) | The KMS key name to use for encryption at rest. | <code>string</code> | | <code>null</code> |
|
||||
| [iam](variables-iam.tf#L36) | IAM bindings in {ROLE => [MEMBERS]} format. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [iam_bindings](variables-iam.tf#L43) | Authoritative IAM bindings in {KEY => {role = ROLE, members = [], condition = {}}}. Keys are arbitrary. | <code title="map(object({ members = list(string) role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_bindings_additive](variables-iam.tf#L58) | Individual additive IAM bindings. Keys are arbitrary. | <code title="map(object({ member = string role = string condition = optional(object({ expression = string title = string description = optional(string) })) }))">map(object({…}))</code> | | <code>{}</code> |
|
||||
| [iam_by_principals](variables-iam.tf#L73) | Authoritative IAM binding in {PRINCIPAL => [ROLES]} format. Principals need to be statically defined to avoid cycle errors. Merged internally with the `iam` variable. | <code>map(list(string))</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L200) | Labels to be attached to the registry. | <code>map(string)</code> | | <code>{}</code> |
|
||||
| [labels](variables.tf#L207) | Labels to be attached to the registry. | <code>map(string)</code> | | <code>{}</code> |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -21,17 +21,21 @@ locals {
|
||||
}
|
||||
|
||||
resource "google_artifact_registry_repository" "registry" {
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
location = var.location
|
||||
description = var.description
|
||||
format = upper(local.format_string)
|
||||
labels = var.labels
|
||||
repository_id = var.name
|
||||
mode = "${upper(local.mode_string)}_REPOSITORY"
|
||||
kms_key_name = var.encryption_key
|
||||
|
||||
provider = google-beta
|
||||
project = var.project_id
|
||||
location = var.location
|
||||
description = var.description
|
||||
format = upper(local.format_string)
|
||||
labels = var.labels
|
||||
repository_id = var.name
|
||||
mode = "${upper(local.mode_string)}_REPOSITORY"
|
||||
kms_key_name = var.encryption_key
|
||||
cleanup_policy_dry_run = var.cleanup_policy_dry_run
|
||||
|
||||
vulnerability_scanning_config {
|
||||
enablement_config = var.enable_vulnerability_scanning ? "INHERITED" : "DISABLED"
|
||||
}
|
||||
|
||||
dynamic "cleanup_policies" {
|
||||
for_each = var.cleanup_policies == null ? {} : var.cleanup_policies
|
||||
content {
|
||||
|
||||
@@ -47,6 +47,13 @@ variable "description" {
|
||||
default = "Terraform-managed registry"
|
||||
}
|
||||
|
||||
variable "enable_vulnerability_scanning" {
|
||||
description = "Whether vulnerability scanning should be enabled in the repository."
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "encryption_key" {
|
||||
description = "The KMS key name to use for encryption at rest."
|
||||
type = string
|
||||
|
||||
Reference in New Issue
Block a user