feat: add support to create container registry and secret inside build module #258

akocbek · 2025-10-16T12:43:31Z

Description

Issue: #243

we added:

support to pass region to build module from root
support to create container registry namespace inside build module
support to create code engine secret inside build module
refactored build input variables to simply the build (less inputs needed now)
build example
test to run build example

Release required?

No release
Patch release (x.x.X)
Minor release (x.X.x)
Major release (X.x.x)

Release notes content

Features & Improvements

Pass Region to Build Module
Added support to pass the region variable from the root module into the build module for more flexible regional deployments.
Container Registry Namespace Creation
The build module now supports automatic creation of container registry namespaces when required.
Code Engine Secret Creation
Added functionality to create Code Engine secrets directly inside the build module to simplify authentication setup.
Refactored Build Inputs
Simplified build input variables to reduce the number of required inputs, making the build configuration easier and cleaner.

Run the pipeline

If the CI pipeline doesn't run when you create the PR, the PR requires a user with GitHub collaborators access to run the pipeline.

Run the CI pipeline when the PR is ready for review and you expect tests to pass. Add a comment to the PR with the following text:

/run pipeline

Checklist for reviewers

If relevant, a test for the change is included or updated with this PR.
If relevant, documentation for the change is included or updated with this PR.

For mergers

Use a conventional commit message to set the release level. Follow the guidelines.
Include information that users need to know about the PR in the commit message. The commit message becomes part of the GitHub release notes.
Use the Squash and merge option.

akocbek · 2025-10-16T12:44:03Z

/run pipeline

akocbek · 2025-11-03T15:44:24Z

/run pipeline

modules/build/variables.tf

shemau · 2025-11-04T11:26:19Z

modules/build/variables.tf

+##############################################################################
+
+variable "container_registry_namespace" {
+  description = "The name of the namespace to create in IBM Cloud Container Registry for organizing container images. Must be set if 'output_image' is not set."


The namespace name will be extended when prefix is set, so prefix should be mentioned in the description.

good catch, done

shemau · 2025-11-04T11:50:28Z

modules/build/variables.tf

+}
+
+variable "output_secret" {
+  description = "The secret that is required to access the IBM Cloud Container Registry. Make sure that the secret is granted with push permissions towards the specified container registry namespace. If not provided, it will be created using the value of 'container_registry_api_key'; if that is not set, 'ibmcloud_api_key' will be used instead."


I am struggling to work out what this is.

I think it the name of a code engine secret that contains an api key to access container registry.
So the first sentence needs to be clear that it is a secret name, not a secret value. The second sentence needs to clear that the key in the named secret is an API key that has push permission. The third sentence needs to be clear that a code engine secret with a name of the format ${var.prefix}-registry-access-secret will be created with the value (as described already) in it.

yes, it is a secret name and not a value. I updated the description

shemau · 2025-11-04T11:59:36Z

modules/build/main.tf

+}
+
+module "cr_endpoint" {
+  count   = local.create_cr_namespace ? 1 : 0


Does the count cause an issue an existing namespace is passed?

It seems there should be no count and the module should always be created. The value is used when creating a code engine secret to access the container registry, which is unrelated to namespace creation.

Additional comment included where this is used.

you are right, updated

shemau · 2025-11-04T11:59:39Z

modules/build/main.tf

+  data = {
+    password = var.container_registry_api_key != null ? var.container_registry_api_key : var.ibmcloud_api_key,
+    username = "iamapikey",
+    server   = module.cr_endpoint[0].container_registry_endpoint_private


The value of server may be undefined.

When local.create_name_space is false module.cr_endpoint does not exist. See comment on module definition.

akocbek · 2025-11-14T11:17:40Z

/run pipeline

akocbek · 2025-11-14T12:05:49Z

/run pipeline

akocbek · 2025-11-14T12:55:57Z

/run pipeline

akocbek · 2025-11-17T09:36:30Z

/run pipeline

akocbek · 2025-11-19T10:02:11Z

/run pipeline

ocofaigh · 2025-11-25T11:05:07Z

@akocbek This is blocking cloud-native AI work - what is the latest?

akocbek · 2025-11-25T11:16:32Z

@ocofaigh it is ready for final review

shemau

All the reported issues are resolved. Spotted minor version downgrade that should not be included here.

shemau · 2025-11-25T11:32:22Z

examples/build/main.tf

 module "resource_group" {
  source  = "terraform-ibm-modules/resource-group/ibm"
-  version = "1.4.0"
+  version = "1.3.0"


We should not be reverting this.

akocbek · 2025-11-25T11:48:57Z

/run pipeline

…d module

akocbek · 2025-11-25T11:58:54Z

/run pipeline

shemau

LGTM

akocbek · 2025-11-25T12:34:46Z

      2025/11/25 12:25:02 Terraform apply | 
         2025/11/25 12:25:02 Terraform apply | Error: ---
         2025/11/25 12:25:02 Terraform apply | id: terraform-184925c5
         2025/11/25 12:25:02 Terraform apply | summary: 'Error waiting for resource IbmSmPublicCertificate (us-south/79c6d411-c18f-4670-b009-b0044a238667/f61fe906-0ead-8fcf-9614-61dc87789952)
         2025/11/25 12:25:02 Terraform apply |   to be created: unexpected state ''deactivated'', wanted target ''active''. last
         2025/11/25 12:25:02 Terraform apply |   error: %!!(MISSING)s(<nil>)'
         2025/11/25 12:25:02 Terraform apply | severity: error
         2025/11/25 12:25:02 Terraform apply | resource: ibm_sm_public_certificate
         2025/11/25 12:25:02 Terraform apply | operation: create
         2025/11/25 12:25:02 Terraform apply | component:
         2025/11/25 12:25:02 Terraform apply |   name: github.com/IBM-Cloud/terraform-provider-ibm
         2025/11/25 12:25:02 Terraform apply |   version: 1.85.0
         2025/11/25 12:25:02 Terraform apply | ---
         2025/11/25 12:25:02 Terraform apply | 
         2025/11/25 12:25:02 Terraform apply | 
         2025/11/25 12:25:02 Terraform apply |   with ibm_sm_public_certificate.secrets_manager_public_certificate[0],
         2025/11/25 12:25:02 Terraform apply |   on main.tf line 76, in resource "ibm_sm_public_certificate" "secrets_manager_public_certificate":
         2025/11/25 12:25:02 Terraform apply |   76: resource "ibm_sm_public_certificate" "secrets_manager_public_certificate" {
         2025/11/25 12:25:02 Terraform apply |

akocbek · 2025-11-25T12:34:55Z

/run pipeline

terraform-ibm-modules-ops · 2025-11-25T13:20:47Z

🎉 This PR is included in version 4.7.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

akocbek requested a review from shemau as a code owner October 16, 2025 12:43

akocbek requested a review from mukulpalit-ibm October 16, 2025 12:49

akocbek force-pushed the fix_build branch from 9fd4e8f to c2563c8 Compare November 3, 2025 15:44

shemau requested changes Nov 4, 2025

View reviewed changes

akocbek requested a review from rajatagarwal-ibm as a code owner November 14, 2025 09:08

akocbek force-pushed the fix_build branch from 0cb93c3 to e117634 Compare November 14, 2025 09:12

akocbek force-pushed the fix_build branch from 511e1f6 to b9c3e7a Compare November 17, 2025 09:33

shemau requested changes Nov 25, 2025

View reviewed changes

akocbek force-pushed the fix_build branch from 9816405 to 52abcc3 Compare November 25, 2025 11:48

akocbek added 9 commits November 25, 2025 11:56

feat: add support to create container registry and secret inside buil…

9c47ef5

…d module

update merge conflicts

c14706d

address PR comments

6ebfc4d

address PR comments

5fa71d6

remove unused code and add tests

b51cd3f

remove unused code and add tests

fcc12ba

merge conflicts

5b60ee3

revert change

70025e6

add new submodule

365a972

akocbek force-pushed the fix_build branch from 2ccad19 to 365a972 Compare November 25, 2025 11:58

shemau approved these changes Nov 25, 2025

View reviewed changes

ocofaigh merged commit 7c3cff0 into main Nov 25, 2025
2 checks passed

ocofaigh deleted the fix_build branch November 25, 2025 13:20

terraform-ibm-modules-ops added the released label Nov 25, 2025

feat: add support to create container registry and secret inside build module #258

feat: add support to create container registry and secret inside build module #258

Uh oh!

Conversation

akocbek commented Oct 16, 2025

Description

Release required?

Release notes content

Run the pipeline

Checklist for reviewers

For mergers

Uh oh!

akocbek commented Oct 16, 2025

Uh oh!

akocbek commented Nov 3, 2025

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akocbek commented Nov 14, 2025

Uh oh!

akocbek commented Nov 14, 2025

Uh oh!

akocbek commented Nov 14, 2025

Uh oh!

akocbek commented Nov 17, 2025

Uh oh!

akocbek commented Nov 19, 2025

Uh oh!

ocofaigh commented Nov 25, 2025

Uh oh!

akocbek commented Nov 25, 2025

Uh oh!

shemau left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akocbek commented Nov 25, 2025

Uh oh!

akocbek commented Nov 25, 2025

Uh oh!

shemau left a comment

Choose a reason for hiding this comment

Uh oh!

akocbek commented Nov 25, 2025

Uh oh!

akocbek commented Nov 25, 2025

Uh oh!

Uh oh!

terraform-ibm-modules-ops commented Nov 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants