frostmoln_container_registry_cache_upstreams (Data Source)

The upstreams a frostmoln_container_registry_cache may front, and how many caches this tenant may hold.

THE CATALOG IS SERVER-OWNED AND THIS IS THE ONLY PLACE TO READ IT. Rows are added and retired without a provider release, so no list published in documentation is authoritative — drive a for_each from this data source rather than from a literal set of keys, and expect a key that worked last quarter to be gone.

A cache whose upstream has since been retired keeps working and stays deletable, but it will NOT have a row here — so a lookup from a cache's upstream into this list must tolerate a miss.

A tenant that has NOT enabled its registry is an error here, not an empty catalog: an empty list would make "this tenant has no registry" and "this platform offers no upstreams" indistinguishable, and a for_each reading the second would quietly destroy every cache in the configuration.

Example Usage

# The upstreams a pull-through cache may front, and how many caches this tenant
# may hold.
#
# THIS IS THE ONLY AUTHORITATIVE COPY OF THAT CATALOG. It is server-owned: rows
# are added and retired without a provider release, so nothing published in
# documentation — and nothing hardcoded in a configuration — stays correct. The
# registry must already be enabled: a tenant that has not opted in gets an error
# here, not an empty catalog.
data "frostmoln_container_registry_cache_upstreams" "available" {}

output "upstream_keys" {
  value = [for u in data.frostmoln_container_registry_cache_upstreams.available.upstreams : u.key]
}

# Which upstreams demand your own credentials at that registry. Read the flag
# rather than special-casing a key: it is a property of the row, and the server
# enforces it either way.
output "upstreams_needing_credentials" {
  value = {
    for u in data.frostmoln_container_registry_cache_upstreams.available.upstreams :
    u.key => u.display if u.requires_credentials
  }
}

# The real cap, so a configuration is written against it instead of a number
# copied from documentation. Exceeding it is refused at apply time with a 403.
output "cache_limit" {
  value = data.frostmoln_container_registry_cache_upstreams.available.cache_limit
}

Schema

Read-Only

• cache_limit (Number) How many caches this tenant may hold in total. Served so a configuration can be written against the real cap instead of a number copied from documentation. Exceeding it is refused at apply time with a 403.
• upstreams (Attributes List) Every upstream currently on offer. (see below for nested schema)

Nested Schema for upstreams

Read-Only:

• display (String) The upstream in human-readable form, naming the real host (for example "GitHub Container Registry (ghcr.io)"). The key is opaque because it has to be safe in a namespace, so this is the only place a person sees where the images come from.
• key (String) The value to set as upstream on a frostmoln_container_registry_cache, and the -cache-<key> suffix of the namespace it occupies. A key, never a URL.
• requires_credentials (Boolean) Whether this upstream demands your own credentials, because an anonymous mirror of it draws on an allowance shared with other customers. When true, a cache for this upstream must set username and password. Read the flag rather than special-casing a key: it is a property of the row and the server enforces it either way.