-
Notifications
You must be signed in to change notification settings - Fork 28
/
dockerhub-mirror.tf
150 lines (127 loc) · 6.78 KB
/
dockerhub-mirror.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
#### ACR to use as DockerHub (and other) Registry mirror
resource "azurerm_resource_group" "dockerhub_mirror" {
name = "dockerhub-mirror"
provider = azurerm.jenkins-sponsorship
location = var.location
}
resource "azurerm_container_registry" "dockerhub_mirror" {
name = "dockerhubmirror"
provider = azurerm.jenkins-sponsorship
resource_group_name = azurerm_resource_group.dockerhub_mirror.name
location = azurerm_resource_group.dockerhub_mirror.location
sku = "Premium"
admin_enabled = false
public_network_access_enabled = false # private links are used to reach the registry
anonymous_pull_enabled = true # Requires "Standard" or "Premium" sku. Docker Engine cannot use auth. for pull trough cache - ref. https://github.com/moby/moby/issues/30880
data_endpoint_enabled = true # Required for endpoint private link. Requires "Premium" sku.
tags = local.default_tags
}
locals {
acr_private_links = {
"cijenkinsio" = {
"subnet_id" = data.azurerm_subnet.ci_jenkins_io_kubernetes_sponsorship.id
"vnet_id" = data.azurerm_virtual_network.public_jenkins_sponsorship.id
"rg_name" = data.azurerm_virtual_network.public_jenkins_sponsorship.resource_group_name
},
"certcijenkinsio" = {
"subnet_id" = data.azurerm_subnet.cert_ci_jenkins_io_sponsorship_ephemeral_agents.id,
"vnet_id" = data.azurerm_virtual_network.cert_ci_jenkins_io_sponsorship.id
"rg_name" = data.azurerm_virtual_network.cert_ci_jenkins_io_sponsorship.resource_group_name
},
"trustedcijenkinsio" = {
"subnet_id" = data.azurerm_subnet.trusted_ci_jenkins_io_sponsorship_ephemeral_agents.id,
"vnet_id" = data.azurerm_virtual_network.trusted_ci_jenkins_io_sponsorship.id
"rg_name" = data.azurerm_virtual_network.trusted_ci_jenkins_io_sponsorship.resource_group_name
},
"infracijenkinsio" = {
"subnet_id" = data.azurerm_subnet.infra_ci_jenkins_io_sponsorship_ephemeral_agents.id,
"vnet_id" = data.azurerm_virtual_network.infra_ci_jenkins_io_sponsorship.id
"rg_name" = data.azurerm_virtual_network.infra_ci_jenkins_io_sponsorship.resource_group_name
},
}
}
resource "azurerm_private_endpoint" "dockerhub_mirror" {
for_each = local.acr_private_links
name = "acr-${each.key}"
provider = azurerm.jenkins-sponsorship
location = azurerm_resource_group.dockerhub_mirror.location
resource_group_name = azurerm_resource_group.dockerhub_mirror.name
subnet_id = each.value.subnet_id
custom_network_interface_name = "acr-${each.key}-nic"
private_service_connection {
name = "acr-${each.key}"
private_connection_resource_id = azurerm_container_registry.dockerhub_mirror.id
subresource_names = ["registry"]
is_manual_connection = false
}
private_dns_zone_group {
name = "privatelink.azurecr.io"
private_dns_zone_ids = [azurerm_private_dns_zone.dockerhub_mirror[each.key].id]
}
tags = local.default_tags
}
resource "azurerm_private_dns_zone" "dockerhub_mirror" {
for_each = local.acr_private_links
# Conventional and static name required by Azure (otherwise automatic record creation does not work)
name = "privatelink.azurecr.io"
provider = azurerm.jenkins-sponsorship
# Private DNS zone name is static: we can only have one per RG
resource_group_name = each.value.rg_name
tags = local.default_tags
}
resource "azurerm_private_dns_zone_virtual_network_link" "dockerhub_mirror" {
for_each = local.acr_private_links
name = "privatelink.azurecr.io"
provider = azurerm.jenkins-sponsorship
# Private DNS zone name is static: we can only have one per RG
resource_group_name = each.value.rg_name
private_dns_zone_name = azurerm_private_dns_zone.dockerhub_mirror[each.key].name
virtual_network_id = each.value.vnet_id
registration_enabled = true
tags = local.default_tags
}
#trivy:ignore:avd-azu-0016
resource "azurerm_key_vault" "dockerhub_mirror" {
name = "dockerhubmirror"
provider = azurerm.jenkins-sponsorship
location = azurerm_resource_group.dockerhub_mirror.location
resource_group_name = azurerm_resource_group.dockerhub_mirror.name
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = false
enable_rbac_authorization = true
enabled_for_deployment = true
enabled_for_disk_encryption = true
enabled_for_template_deployment = true
public_network_access_enabled = false
network_acls {
bypass = "AzureServices"
default_action = "Deny"
}
sku_name = "standard"
tags = local.default_tags
}
# IMPORTANT: when bootstraping, multiple Terraform apply are required until ACR CredentialSet can be created by Terraform (unsupported by Terraform until https://github.com/hashicorp/terraform-provider-azurerm/issues/26539 is done).
# 1. Start by creating the dockerhub-username and docker-password in the Keyvault (once created) which requires the "Key Vault Secrets Officer" or "Owner" role temporarily
# 2. Then create the CredentialSet in the registry (once created) with the name 'dockerhub'. It will be marked as "Unhealthy" (expected).
# 3. Then retrieve the principal ID and set it in the attributes below.
# 4. Finally re-run terraform apply one last time to create this role_assignement and the ACR cache rule. The CrednetialSet in ACR willb e marked as "Helathy" right after this apply.
resource "azurerm_role_assignment" "acr_read_keyvault_secrets" {
provider = azurerm.jenkins-sponsorship
scope = azurerm_key_vault.dockerhub_mirror.id
role_definition_name = "Key Vault Secrets User"
skip_service_principal_aad_check = true
# Need to be retrieved manually from Azure UI -> Container Registries -> Select the "azurerm_key_vault.dockerhub_mirror" resource -> Services -> Cache -> Crerdentials -> select "dockerhub"
principal_id = "90872c87-43ab-446d-89b2-741693c34b90"
}
resource "azurerm_container_registry_cache_rule" "mirror_dockerhub" {
name = "mirror"
provider = azurerm.jenkins-sponsorship
container_registry_id = azurerm_container_registry.dockerhub_mirror.id
source_repo = "docker.io/*"
target_repo = "*"
# Credential created manually (unsupported by Terraform until https://github.com/hashicorp/terraform-provider-azurerm/issues/26539 is done).
# Check dependent resource
depends_on = [azurerm_role_assignment.acr_read_keyvault_secrets]
credential_set_id = "${azurerm_container_registry.dockerhub_mirror.id}/credentialSets/dockerhub"
}