kupe_registry_token

Manages an access token for the tenant’s Kupe container registry: a registry username and secret for CI and anything else that pulls or pushes images without a person signed in. Sign in with docker login <registry_host> --username <username> --password-stdin. Create waits until the platform has issued the token (seconds); until then the registry refuses it.

A token never changes: changing any argument replaces it with a new token and a new secret. It stops working when it expires, when it is revoked, and when the member who created it leaves the tenant (or, for a push token, loses the admin role); once the platform has removed it, the next plan creates a new one. A registry holds at most 50 access tokens.

Secret in state

The token’s secret, returned only when the token is created. It is stored in Terraform state in plain text: Sensitive hides it from plan and apply output but does not keep it out of the state file. Keep state in an encrypted backend with restricted access, or create tokens outside Terraform.

Example Usage

resource "kupe_registry_token" "ci" {
  registry        = kupe_registry.this.name
  display_name    = "GitHub Actions"
  access          = "push"
  expires_in_days = 30
}

output "registry_login" {
  description = "Pass the secret to docker login --password-stdin."
  value = {
    host     = kupe_registry_token.ci.registry_host
    username = kupe_registry_token.ci.username
  }
}

Renewing a token

A token never changes in place. When it expires, the platform removes it within a day, and the next terraform plan shows it being created again, with a new secret. Until then a refresh warns that it has expired. To renew earlier, change display_name or expires_in_days, or run terraform apply -replace=kupe_registry_token.ci.

A token is also revoked when the member whose credentials created it leaves the tenant, and a push token when that member loses the admin role.

Keeping the secret out of state

secret is in Terraform state in plain text. Marking it Sensitive only hides it from plan and apply output. If your state backend is not encrypted and access-controlled, create the token in the Kupe Console or with kupe registry token create instead, and store the secret in your CI system’s secret store.

Schema

Required

• access (String) pull, or push (which includes pull). Only a member with the admin role, or an admin API key, can create a token. A different value replaces the token.
• display_name (String) A name to recognise the token by, 1 to 128 characters. A different name replaces the token.

Optional

• expires_in_days (Number) Days until the token stops working, 1 to 365. When unset, the platform’s default (90 days) is used and recorded here. A different value replaces the token.
• registry (String) Registry the token signs in to. A tenant has one registry, named registry: this is the default and the only value accepted.
• timeouts (Attributes) (see below for nested schema)

Read-Only

• created_at (String) Timestamp when the token was created.
• created_by (String) Email of the member whose credentials created the token.
• expires_at (String) When the token stops working (RFC 3339).
• id (String) Token ID: rt- and 16 hex characters.
• last_used_at (String) When the token last pulled or pushed (RFC 3339), read hourly at most. Null until it is first used.
• phase (String) Pending until the platform has issued the token, then Ready. Failed means it can never work: replace it.
• registry_host (String) Registry host to sign in to, e.g. registry.kupe.cloud. Returned when the token is created, so it is null after import.
• secret (String, Sensitive) The token’s secret, returned only when the token is created. It is stored in Terraform state in plain text: Sensitive hides it from plan and apply output but does not keep it out of the state file. Keep state in an encrypted backend with restricted access, or create tokens outside Terraform. Null after import.
• username (String) Registry username to sign in with, e.g. kupe+acme+tok-0a1b2c3d4e5f6a7b.

Nested Schema for timeouts

Optional:

• create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as “30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).

Import

Import is supported using the following syntax:

terraform import kupe_registry_token.ci registry/rt-0a1b2c3d4e5f6a7b