kupe_registry_binding

Connect a cluster so all its namespaces can pull your private images without imagePullSecrets. List push_namespaces only for image builds. Wait for Ready, and restart existing pods if they need access.

Example Usage

resource "kupe_registry_binding" "prod" {
  registry = kupe_registry.this.name
  cluster  = kupe_cluster.prod.name
}

resource "kupe_registry_binding" "ci" {
  registry        = kupe_registry.this.name
  cluster         = kupe_cluster.ci.name
  push_namespaces = ["builds"]
}

Pulling

Once the connection is Ready, every pod of the cluster can pull registry.kupe.cloud/<tenant>/<repository>:<tag> with no imagePullSecrets. Create gives a warning as a reminder: pods that were already running pick it up only when they restart.

Pushing from inside the cluster

Each namespace in push_namespaces gets a Secret named secret_name (default kupe-registry-push) of type kubernetes.io/dockerconfigjson. Build tools that read a Docker config file can push with it: mount its .dockerconfigjson key as config.json. Each namespace receives a Secret named secret_name that can pull from and push to every repository in your registry, including replacing existing tags, so list only the namespaces that build images.

push_namespaces changes in place, and the connection’s pull credential is untouched: running pods keep pulling. A namespace taken out loses its Secret, and the push credential is replaced, so build jobs in the remaining push namespaces must restart to read the new Secret. Changing secret_name, cluster or registry replaces the connection instead: it is deleted and created again, so its pull and push credentials are reissued.

A connection lists at most 10 push namespaces, which the plan checks. The registry’s connections list at most 20 between them; the Kupe platform refuses a change that breaks that when it is applied.

When a connection fails

A push namespace is Failed when it already has a Secret named secret_name that the Kupe platform did not create. Create and Update stop at once with an error that names the namespace; every pod of the cluster can still pull. Rename or remove that Secret, or set a different secret_name. After a failed Create, Terraform keeps the connection in state, marked tainted, and the next terraform apply replaces it.

Schema

Required

• cluster (String) Cluster to connect. It must exist. A different cluster replaces the connection.

Optional

• push_namespaces (Set of String) Namespaces inside the cluster that receive a push credential Secret named secret_name: up to 10, none kube-* or argocd. Each namespace receives a Secret named secret_name that can pull from and push to every repository in your registry, including replacing existing tags. Default none: the cluster can pull only. Changes in place: a namespace added gets the Secret; one taken out loses it, and the push credential is replaced, so build jobs in the remaining push namespaces must restart to read the new Secret. Pulls keep working throughout. The registry’s connections can list at most 20 push namespaces between them; the Kupe platform checks that when the change is applied.
• registry (String) Registry to connect to. A tenant has one registry, named registry: this is the default and the only value accepted.
• secret_name (String) Name of the push credential Secret in each push namespace. Default kupe-registry-push; it cannot be kupe-registry-pull. It cannot change in place: a different name replaces the cluster connection (it is deleted and created again, so its pull and push credentials are reissued).
• timeouts (Attributes) (see below for nested schema)

Read-Only

• created_at (String) Timestamp when the cluster connection was created.
• etag (String) Resource version used for optimistic locking during updates.
• message (String) What the platform says about the connection.
• name (String) Connection name: always the cluster’s name.
• namespace_status (Attributes List) What the connection delivered into each push namespace, sorted by name. A namespace taken out of push_namespaces stays listed until its Secret is withdrawn. (see below for nested schema)
• phase (String) Current phase: Pending, Ready (every pod can pull and every push namespace is delivered) or Failed (a push namespace could not be delivered).
• pull_username (String) Registry username of the cluster’s pull credential.
• push_username (String) Registry username of the push credential; empty without push namespaces.

Nested Schema for timeouts

Optional:

• create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as “30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).
• delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as “30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
• update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as “30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).

Nested Schema for namespace_status

Read-Only:

• message (String) Why the namespace is not Ready; empty when it is.
• name (String) Namespace inside the cluster.
• phase (String) Pending, Ready or Failed.

Import

Import is supported using the following syntax:

terraform import kupe_registry_binding.prod registry/prod