Skip to content

Commit d623d9d

Browse files
Mia-CrossMia-Cross
committed
deprecate container token and document new auth with IAM
1 parent f826d8c commit d623d9d

File tree

5 files changed

+118
-3
lines changed

5 files changed

+118
-3
lines changed

‎docs/resources/container.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,60 @@ resource "scaleway_container" "main" {
4848
}
4949
```
5050

51+
### Managing authentication of private containers with IAM
52+
53+
```terraform
54+
# Project to be referenced in the IAM policy
55+
data "scaleway_account_project" "default" {
56+
name = "default"
57+
}
58+
59+
# IAM resources
60+
resource "scaleway_iam_application" "container_auth" {
61+
name = "container-auth"
62+
}
63+
resource "scaleway_iam_policy" "access_private_containers" {
64+
application_id = scaleway_iam_application.container_auth.id
65+
rule {
66+
project_ids = [data.scaleway_account_project.default.id]
67+
permission_set_names = ["ContainersPrivateAccess"]
68+
}
69+
}
70+
resource "scaleway_iam_api_key" "api_key" {
71+
application_id = scaleway_iam_application.container_auth.id
72+
}
73+
74+
# Container resources
75+
resource "scaleway_container_namespace" "private" {
76+
name = "private-container-namespace"
77+
}
78+
resource "scaleway_container" "private" {
79+
namespace_id = scaleway_container_namespace.private.id
80+
registry_image = "rg.fr-par.scw.cloud/my-registry-ns/my-image:latest"
81+
privacy = "private"
82+
deploy = true
83+
}
84+
85+
# Output the secret key and the container's endpoint for the curl command
86+
output "secret_key" {
87+
value = scaleway_iam_api_key.api_key.secret_key
88+
sensitive = true
89+
}
90+
output "container_endpoint" {
91+
value = scaleway_container.private.domain_name
92+
}
93+
94+
```
95+
96+
Then you can access your private container using the API key:
97+
98+
```shell
99+
$ curl -H "X-Auth-Token: $(terraform output -raw secret_key)" \
100+
"https://$(terraform output -raw container_endpoint)/"
101+
```
102+
103+
Keep in mind that you should revoke your legacy JWT tokens to ensure maximum security.
104+
51105
## Argument Reference
52106

53107
The following arguments are supported:

‎docs/resources/container_token.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ page_title: "Scaleway: scaleway_container_token"
55

66
# Resource: scaleway_container_token
77

8+
> **Important:** The resource `scaleway_container_token` has been deprecated and will no longer be supported in v1 of the API.
9+
Please use IAM authentication instead. You will find an implementation example in the [IAM authentication](container.md#managing-authentication-of-private-containers-with-iam) section of the Container documentation.
10+
811
The `scaleway_container_token` resource allows you to create and manage authentication tokens for Scaleway [Serverless Containers](https://www.scaleway.com/en/docs/serverless/containers/).
912

1013
Refer to the Containers tokens [documentation](https://www.scaleway.com/en/docs/serverless/containers/how-to/create-auth-token-from-console/) and [API documentation](https://www.scaleway.com/en/developers/api/serverless-containers/#path-tokens-list-all-tokens) for more information.

‎internal/services/container/token.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,10 @@ import (
1818

1919
func ResourceToken() *schema.Resource {
2020
return &schema.Resource{
21-
CreateContext: ResourceContainerTokenCreate,
22-
ReadContext: ResourceContainerTokenRead,
23-
DeleteContext: ResourceContainerTokenDelete,
21+
CreateContext: ResourceContainerTokenCreate,
22+
ReadContext: ResourceContainerTokenRead,
23+
DeleteContext: ResourceContainerTokenDelete,
24+
DeprecationMessage: "The \"scaleway_container_token\" resource is deprecated in favor of IAM authentication",
2425
Importer: &schema.ResourceImporter{
2526
StateContext: schema.ImportStatePassthroughContext,
2627
},

‎templates/resources/container.md.tmpl‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,60 @@ resource "scaleway_container" "main" {
4949
}
5050
```
5151

52+
### Managing authentication of private containers with IAM
53+
54+
```terraform
55+
# Project to be referenced in the IAM policy
56+
data "scaleway_account_project" "default" {
57+
name = "default"
58+
}
59+
60+
# IAM resources
61+
resource "scaleway_iam_application" "container_auth" {
62+
name = "container-auth"
63+
}
64+
resource "scaleway_iam_policy" "access_private_containers" {
65+
application_id = scaleway_iam_application.container_auth.id
66+
rule {
67+
project_ids = [data.scaleway_account_project.default.id]
68+
permission_set_names = ["ContainersPrivateAccess"]
69+
}
70+
}
71+
resource "scaleway_iam_api_key" "api_key" {
72+
application_id = scaleway_iam_application.container_auth.id
73+
}
74+
75+
# Container resources
76+
resource "scaleway_container_namespace" "private" {
77+
name = "private-container-namespace"
78+
}
79+
resource "scaleway_container" "private" {
80+
namespace_id = scaleway_container_namespace.private.id
81+
registry_image = "rg.fr-par.scw.cloud/my-registry-ns/my-image:latest"
82+
privacy = "private"
83+
deploy = true
84+
}
85+
86+
# Output the secret key and the container's endpoint for the curl command
87+
output "secret_key" {
88+
value = scaleway_iam_api_key.api_key.secret_key
89+
sensitive = true
90+
}
91+
output "container_endpoint" {
92+
value = scaleway_container.private.domain_name
93+
}
94+
95+
```
96+
97+
Then you can access your private container using the API key:
98+
99+
```shell
100+
$ curl -H "X-Auth-Token: $(terraform output -raw secret_key)" \
101+
"https://$(terraform output -raw container_endpoint)/"
102+
```
103+
104+
Keep in mind that you should revoke your legacy JWT tokens to ensure maximum security.
105+
52106
## Argument Reference
53107

54108
The following arguments are supported:

‎templates/resources/container_token.md.tmpl‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ page_title: "Scaleway: scaleway_container_token"
66

77
# Resource: scaleway_container_token
88

9+
> **Important:** The resource `scaleway_container_token` has been deprecated and will no longer be supported in v1 of the API.
10+
Please use IAM authentication instead. You will find an implementation example in the [IAM authentication](container.md#managing-authentication-of-private-containers-with-iam) section of the Container documentation.
11+
912
The `scaleway_container_token` resource allows you to create and manage authentication tokens for Scaleway [Serverless Containers](https://www.scaleway.com/en/docs/serverless/containers/).
1013

1114
Refer to the Containers tokens [documentation](https://www.scaleway.com/en/docs/serverless/containers/how-to/create-auth-token-from-console/) and [API documentation](https://www.scaleway.com/en/developers/api/serverless-containers/#path-tokens-list-all-tokens) for more information.

0 commit comments

Comments
 (0)