Skip to content

Commit c7de4ad

Browse files
author
akocbek
committed
feat: add support to create container registry and secret inside build module
1 parent 303bfbe commit c7de4ad

File tree

13 files changed

+297
-45
lines changed

13 files changed

+297
-45
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ This module provisions the IBM Cloud Code Engine fully managed and serverless pl
2626
* [secret](./modules/secret)
2727
* [Examples](./examples)
2828
* [Apps example](./examples/apps)
29+
* [Build example](./examples/build)
2930
* [Jobs example](./examples/jobs)
3031
* [Contributing](#contributing)
3132
<!-- END OVERVIEW HOOK -->

‎examples/build/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Build example
2+
3+
An end-to-end apps example that will provision the following:
4+
- A new resource group if one is not passed in.
5+
- Code Engine project
6+
- Code Engine build
7+
- Code Engine registry secret
8+
- Container registry namespace

‎examples/build/main.tf‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
########################################################################################################################
2+
# Resource group
3+
########################################################################################################################
4+
5+
module "resource_group" {
6+
source = "terraform-ibm-modules/resource-group/ibm"
7+
version = "1.3.0"
8+
# if an existing resource group is not set (null) create a new one using prefix
9+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
10+
existing_resource_group_name = var.resource_group
11+
}
12+
13+
########################################################################################################################
14+
# Code Engine instance
15+
########################################################################################################################
16+
17+
module "code_engine" {
18+
source = "../.."
19+
ibmcloud_api_key = var.ibmcloud_api_key
20+
resource_group_id = module.resource_group.resource_group_id
21+
project_name = "${var.prefix}-project"
22+
builds = {
23+
"${var.prefix}-build1" = {
24+
source_url = "https://github.com/IBM/CodeEngine"
25+
container_registry_namespace = "cr-ce"
26+
prefix = var.prefix
27+
region = var.region
28+
}
29+
}
30+
}

‎examples/build/outputs.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
########################################################################################################################
2+
# Outputs
3+
########################################################################################################################
4+
5+
output "resource_group_id" {
6+
description = "The id of created resource group."
7+
value = module.resource_group.resource_group_id
8+
}
9+
10+
output "resource_group_name" {
11+
description = "The name of created resource group."
12+
value = module.resource_group.resource_group_name
13+
}
14+
15+
output "project_id" {
16+
description = "ID of the created code engine project."
17+
value = module.code_engine.project_id
18+
}
19+
20+
output "build" {
21+
description = "Configuration of the created code engine domain mapping."
22+
value = module.code_engine.build
23+
sensitive = true
24+
}

‎examples/build/provider.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
########################################################################################################################
2+
# Provider config
3+
########################################################################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
}

‎examples/build/variables.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
########################################################################################################################
2+
# Input variables
3+
########################################################################################################################
4+
5+
variable "ibmcloud_api_key" {
6+
type = string
7+
description = "The IBM Cloud API Key"
8+
sensitive = true
9+
}
10+
11+
variable "region" {
12+
type = string
13+
description = "Region to provision all resources created by this example"
14+
default = "us-south"
15+
}
16+
17+
variable "prefix" {
18+
type = string
19+
description = "Prefix to append to all resources created by this example"
20+
default = "ce-build"
21+
}
22+
23+
variable "resource_group" {
24+
type = string
25+
description = "The name of an existing resource group to provision resources in to. If not set a new resource group will be created using the prefix variable"
26+
default = null
27+
}

‎examples/build/version.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2+
terraform {
3+
required_version = ">= 1.9.0"
4+
# Ensure that there is always 1 example locked into the lowest provider version of the range defined in the main
5+
# module's version.tf (this example), and 1 example that will always use the latest provider version (jobs examples).
6+
required_providers {
7+
ibm = {
8+
source = "IBM-Cloud/ibm"
9+
version = ">= 1.79.0, < 2.0.0"
10+
}
11+
}
12+
}

‎main.tf‎

Lines changed: 21 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -99,24 +99,27 @@ module "secret" {
9999
# Code Engine Build
100100
##############################################################################
101101
module "build" {
102-
depends_on = [module.secret]
103-
source = "./modules/build"
104-
for_each = var.builds
105-
ibmcloud_api_key = var.ibmcloud_api_key
106-
existing_resource_group_id = var.resource_group_id
107-
project_id = local.project_id
108-
name = each.key
109-
output_image = each.value.output_image
110-
output_secret = each.value.output_secret
111-
source_url = each.value.source_url
112-
strategy_type = each.value.strategy_type
113-
source_context_dir = each.value.source_context_dir
114-
source_revision = each.value.source_revision
115-
source_secret = each.value.source_secret
116-
source_type = each.value.source_type
117-
strategy_size = each.value.strategy_size
118-
strategy_spec_file = each.value.strategy_spec_file
119-
timeout = each.value.timeout
102+
depends_on = [module.secret]
103+
source = "./modules/build"
104+
for_each = var.builds
105+
ibmcloud_api_key = var.ibmcloud_api_key
106+
existing_resource_group_id = var.resource_group_id
107+
project_id = local.project_id
108+
name = each.key
109+
output_image = each.value.output_image
110+
output_secret = each.value.output_secret
111+
source_url = each.value.source_url
112+
strategy_type = each.value.strategy_type
113+
source_context_dir = each.value.source_context_dir
114+
source_revision = each.value.source_revision
115+
source_secret = each.value.source_secret
116+
source_type = each.value.source_type
117+
strategy_size = each.value.strategy_size
118+
strategy_spec_file = each.value.strategy_spec_file
119+
timeout = each.value.timeout
120+
region = each.value.region
121+
container_registry_namespace = each.value.container_registry_namespace
122+
prefix = each.value.prefix
120123
}
121124

122125
##############################################################################

‎modules/build/README.md‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,11 @@ You need the following permissions to run this module.
4040

4141
### Modules
4242

43-
No modules.
43+
| Name | Source | Version |
44+
|------|--------|---------|
45+
| <a name="module_cr_endpoint"></a> [cr\_endpoint](#module\_cr\_endpoint) | terraform-ibm-modules/container-registry/ibm//modules/endpoint | 2.1.0 |
46+
| <a name="module_cr_namespace"></a> [cr\_namespace](#module\_cr\_namespace) | terraform-ibm-modules/container-registry/ibm | 2.1.0 |
47+
| <a name="module_secret"></a> [secret](#module\_secret) | ../../modules/secret | n/a |
4448

4549
### Resources
4650

@@ -54,21 +58,24 @@ No modules.
5458

5559
| Name | Description | Type | Default | Required |
5660
|------|-------------|------|---------|:--------:|
61+
| <a name="input_container_registry_api_key"></a> [container\_registry\_api\_key](#input\_container\_registry\_api\_key) | The API key for the container registry in the target account. This is only used if 'output\_secret' is not set and a new registry secret needs to be created. If not provided, the IBM Cloud API key (ibmcloud\_api\_key) will be used instead. | `string` | `null` | no |
62+
| <a name="input_container_registry_namespace"></a> [container\_registry\_namespace](#input\_container\_registry\_namespace) | The name of the namespace to create in IBM Cloud Container Registry for organizing container images. Must be set if 'output\_image' is not set. | `string` | `null` | no |
5763
| <a name="input_existing_resource_group_id"></a> [existing\_resource\_group\_id](#input\_existing\_resource\_group\_id) | The ID of an existing resource group where build will be provisioned. This must be the same resource group in which the code engine project was created. | `string` | n/a | yes |
5864
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key. | `string` | n/a | yes |
5965
| <a name="input_name"></a> [name](#input\_name) | The name of the build. | `string` | n/a | yes |
60-
| <a name="input_output_image"></a> [output\_image](#input\_output\_image) | The name of the image. | `string` | n/a | yes |
61-
| <a name="input_output_secret"></a> [output\_secret](#input\_output\_secret) | The secret that is required to access the image registry. | `string` | n/a | yes |
66+
| <a name="input_output_image"></a> [output\_image](#input\_output\_image) | A container image can be identified by a container image reference with the following structure: registry / namespace / repository:tag. [Learn more](https://cloud.ibm.com/docs/codeengine?topic=codeengine-getting-started).<br/><br/>If not provided, the value will be derived from the 'container\_registry\_namespace' input variable, which must not be null in that case. | `string` | `null` | no |
67+
| <a name="input_output_secret"></a> [output\_secret](#input\_output\_secret) | The secret that is required to access the IBM Cloud Container Registry. Make sure that the secret is granted with push permissions towards the specified container registry namespace. If not provided, it will be created using the value of 'container\_registry\_api\_key'; if that is not set, 'ibmcloud\_api\_key' will be used instead. | `string` | `null` | no |
68+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix appended to the container registry namespace and registry secret if created. | `string` | `null` | no |
6269
| <a name="input_project_id"></a> [project\_id](#input\_project\_id) | The ID of the project where build will be created. | `string` | n/a | yes |
6370
| <a name="input_region"></a> [region](#input\_region) | The region in which to provision the build. This must be the same region in which the code engine project was created. | `string` | `"us-south"` | no |
6471
| <a name="input_source_context_dir"></a> [source\_context\_dir](#input\_source\_context\_dir) | The directory in the repository that contains the buildpacks file or the Dockerfile. | `string` | `null` | no |
6572
| <a name="input_source_revision"></a> [source\_revision](#input\_source\_revision) | Commit, tag, or branch in the source repository to pull. | `string` | `null` | no |
66-
| <a name="input_source_secret"></a> [source\_secret](#input\_source\_secret) | The name of the secret that is used access the repository source. If the var.source\_type value is `local`, this field must be omitted. | `string` | `null` | no |
67-
| <a name="input_source_type"></a> [source\_type](#input\_source\_type) | Specifies the type of source to determine if your build source is in a repository or based on local source code. | `string` | `null` | no |
73+
| <a name="input_source_secret"></a> [source\_secret](#input\_source\_secret) | The name of the secret that is used access the repository source. If the var.source\_type value is `local`, this input must be omitted. | `string` | `null` | no |
74+
| <a name="input_source_type"></a> [source\_type](#input\_source\_type) | Specifies the type of source to determine if your build source is in a repository or based on local source code. If the value is `local`, then 'source\_secret' input must be omitted. | `string` | `null` | no |
6875
| <a name="input_source_url"></a> [source\_url](#input\_source\_url) | The URL of the code repository. | `string` | n/a | yes |
6976
| <a name="input_strategy_size"></a> [strategy\_size](#input\_strategy\_size) | The size for the build, which determines the amount of resources used. | `string` | `null` | no |
7077
| <a name="input_strategy_spec_file"></a> [strategy\_spec\_file](#input\_strategy\_spec\_file) | The path to the specification file that is used for build strategies for building an image. | `string` | `null` | no |
71-
| <a name="input_strategy_type"></a> [strategy\_type](#input\_strategy\_type) | The strategy to use for building the image. | `string` | n/a | yes |
78+
| <a name="input_strategy_type"></a> [strategy\_type](#input\_strategy\_type) | The strategy to use for building the image. | `string` | `"dockerfile"` | no |
7279
| <a name="input_timeout"></a> [timeout](#input\_timeout) | The maximum amount of time, in seconds, that can pass before the build must succeed or fail. | `number` | `600` | no |
7380

7481
### Outputs

‎modules/build/main.tf‎

Lines changed: 49 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,15 @@
44
# Create Code Engine build
55
##############################################################################
66

7+
locals {
8+
prefix = var.prefix != null ? (trimspace(var.prefix) != "" ? "${var.prefix}-" : "") : ""
9+
}
10+
711
resource "ibm_code_engine_build" "ce_build" {
812
project_id = var.project_id
913
name = var.name
10-
output_image = var.output_image
11-
output_secret = var.output_secret
14+
output_image = local.output_image
15+
output_secret = var.output_secret != null ? var.output_secret : module.secret[0].name
1216
source_url = var.source_url
1317
source_context_dir = var.source_context_dir
1418
source_revision = var.source_revision
@@ -39,3 +43,46 @@ resource "terraform_data" "run_build" {
3943
}
4044
}
4145
}
46+
47+
48+
##############################################################################
49+
# Container Registry
50+
##############################################################################
51+
52+
locals {
53+
create_cr_namespace = var.output_image == null && var.container_registry_namespace != null ? true : false
54+
image_container = local.create_cr_namespace ? "${module.cr_endpoint[0].container_registry_endpoint_private}/${module.cr_namespace[0].namespace_name}" : null
55+
output_image = local.create_cr_namespace ? "${local.image_container}/${var.name}" : var.output_image
56+
}
57+
58+
module "cr_namespace" {
59+
count = local.create_cr_namespace ? 1 : 0
60+
source = "terraform-ibm-modules/container-registry/ibm"
61+
version = "2.1.0"
62+
namespace_name = "${local.prefix}${var.container_registry_namespace}"
63+
resource_group_id = var.existing_resource_group_id
64+
}
65+
66+
module "cr_endpoint" {
67+
count = local.create_cr_namespace ? 1 : 0
68+
source = "terraform-ibm-modules/container-registry/ibm//modules/endpoint"
69+
version = "2.1.0"
70+
region = var.region
71+
}
72+
73+
##############################################################################
74+
# Code Engine Secret
75+
##############################################################################
76+
77+
module "secret" {
78+
count = var.output_secret == null ? 1 : 0
79+
source = "../../modules/secret"
80+
project_id = var.project_id
81+
name = "${local.prefix}registry-access-secret"
82+
data = {
83+
password = var.container_registry_api_key != null ? var.container_registry_api_key : var.ibmcloud_api_key,
84+
username = "iamapikey",
85+
server = module.cr_endpoint[0].container_registry_endpoint_private
86+
}
87+
format = "registry"
88+
}

0 commit comments

Comments
 (0)