Skip to content

Commit

Permalink
Add support for time based rotation (#132)
Browse files Browse the repository at this point in the history
* Add support for time based rotation

* Add brackets

* Typo

* Add support for count/time based rotation simultaneously

* Clean code

* Add missing description

* Revert simultaneous rotation

* Remove old section

* Change message order

* Change message

* Running terraform fmt

---------

Co-authored-by: Honza Uhlík <januhlik@isee.ai>
uhlajs and Honza Uhlík authored Jul 30, 2024
1 parent 6b26d1c commit 2a4b139
Showing 5 changed files with 29 additions and 9 deletions.
3 changes: 2 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
@@ -171,7 +171,7 @@ Available targets:
| <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,<br>set as tag values, and output by this module individually.<br>Does not affect values of tags passed in via the `tags` input.<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.<br>Default value: `lower`. | `string` | `null` | no |
| <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br>Default is to include all labels.<br>Tags with empty values will not be included in the `tags` output.<br>Set to `[]` to suppress all generated tags.<br>**Notes:**<br> The value of the `name` tag, if included, will be the `id`, not the `name`.<br> Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br> changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br> "default"<br>]</pre> | no |
| <a name="input_max_image_count"></a> [max\_image\_count](#input\_max\_image\_count) | How many Docker Image versions AWS ECR will store | `number` | `500` | no |
| <a name="input_max_image_count"></a> [max\_image\_count](#input\_max\_image\_count) | How many Docker Image versions AWS ECR will store. Only used when [count\_based\_rotation](#count\_based\_rotation) is true | `number` | `500` | no |
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_organizations_full_access"></a> [organizations\_full\_access](#input\_organizations\_full\_access) | Organization IDs to provide with full access to the ECR. | `list(string)` | `[]` | no |
@@ -190,6 +190,7 @@ Available targets:
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
| <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
| <a name="input_time_based_rotation"></a> [time\_based\_rotation](#time\_based\_rotation) | Set to true to filter image based on the `sinceImagePushed` count type. [max\_image\_count](#input\_max\_image\_count) coresponds to number of days before expiration | `bool` | `false` | no |
| <a name="input_use_fullname"></a> [use\_fullname](#input\_use\_fullname) | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | `bool` | `true` | no |

## Outputs
3 changes: 2 additions & 1 deletion docs/terraform.md
Original file line number Diff line number Diff line change
@@ -59,7 +59,7 @@
| <a name="input_label_order"></a> [label\_order](#input\_label\_order) | The order in which the labels (ID elements) appear in the `id`.<br>Defaults to ["namespace", "environment", "stage", "name", "attributes"].<br>You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present. | `list(string)` | `null` | no |
| <a name="input_label_value_case"></a> [label\_value\_case](#input\_label\_value\_case) | Controls the letter case of ID elements (labels) as included in `id`,<br>set as tag values, and output by this module individually.<br>Does not affect values of tags passed in via the `tags` input.<br>Possible values: `lower`, `title`, `upper` and `none` (no transformation).<br>Set this to `title` and set `delimiter` to `""` to yield Pascal Case IDs.<br>Default value: `lower`. | `string` | `null` | no |
| <a name="input_labels_as_tags"></a> [labels\_as\_tags](#input\_labels\_as\_tags) | Set of labels (ID elements) to include as tags in the `tags` output.<br>Default is to include all labels.<br>Tags with empty values will not be included in the `tags` output.<br>Set to `[]` to suppress all generated tags.<br>**Notes:**<br> The value of the `name` tag, if included, will be the `id`, not the `name`.<br> Unlike other `null-label` inputs, the initial setting of `labels_as_tags` cannot be<br> changed in later chained modules. Attempts to change it will be silently ignored. | `set(string)` | <pre>[<br> "default"<br>]</pre> | no |
| <a name="input_max_image_count"></a> [max\_image\_count](#input\_max\_image\_count) | How many Docker Image versions AWS ECR will store | `number` | `500` | no |
| <a name="input_max_image_count"></a> [max\_image\_count](#input\_max\_image\_count) | How many Docker Image versions AWS ECR will store. Only used when [count\_based\_rotation](#count\_based\_rotation) is true | `number` | `500` | no |
| <a name="input_name"></a> [name](#input\_name) | ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.<br>This is the only ID element not also included as a `tag`.<br>The "name" tag is set to the full `id` string. There is no tag with the value of the `name` input. | `string` | `null` | no |
| <a name="input_namespace"></a> [namespace](#input\_namespace) | ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique | `string` | `null` | no |
| <a name="input_organizations_full_access"></a> [organizations\_full\_access](#input\_organizations\_full\_access) | Organization IDs to provide with full access to the ECR. | `list(string)` | `[]` | no |
@@ -78,6 +78,7 @@
| <a name="input_stage"></a> [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| <a name="input_tags"></a> [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).<br>Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
| <a name="input_tenant"></a> [tenant](#input\_tenant) | ID element \_(Rarely used, not included by default)\_. A customer identifier, indicating who this instance of a resource is for | `string` | `null` | no |
| <a name="input_time_based_rotation"></a> [time\_based\_rotation](#time\_based\_rotation) | Set to true to filter image based on the `sinceImagePushed` count type. [max\_image\_count](#input\_max\_image\_count) coresponds to number of days before expiration | `bool` | `false` | no |
| <a name="input_use_fullname"></a> [use\_fullname](#input\_use\_fullname) | Set 'true' to use `namespace-stage-name` for ecr repository name, else `name` | `bool` | `true` | no |

## Outputs
3 changes: 2 additions & 1 deletion examples/complete/variables.tf
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
variable "region" {
type = string
type = string
description = "AWS region"
}

variable "encryption_configuration" {
23 changes: 17 additions & 6 deletions main.tf
Original file line number Diff line number Diff line change
@@ -65,12 +65,23 @@ locals {
remove_old_image_rule = [
{
rulePriority = length(var.protected_tags) + 2
description = "Rotate images when reach ${var.max_image_count} images stored",
selection = {
tagStatus = "any"
countType = "imageCountMoreThan"
countNumber = var.max_image_count
}
description = (
var.time_based_rotation ?
"Rotate images older than ${var.max_image_count} days old" :
"Rotate images when reach ${var.max_image_count} images stored"
)
selection = merge(
{
tagStatus = "any"
countType = (
var.time_based_rotation ?
"sinceImagePushed" :
"imageCountMoreThan"
)
countNumber = var.max_image_count
},
var.time_based_rotation ? { countUnit = "days" } : {}
)
action = {
type = "expire"
}
6 changes: 6 additions & 0 deletions variables.tf
Original file line number Diff line number Diff line change
@@ -46,6 +46,12 @@ variable "max_image_count" {
default = 500
}

variable "time_based_rotation" {
type = bool
description = "Set to true to filter image based on the `sinceImagePushed` count type."
default = false
}

variable "image_names" {
type = list(string)
default = []

0 comments on commit 2a4b139

Please sign in to comment.