frostmoln_container_registry_credential (Resource)

Mints a container registry credential — the username and secret used to docker login to the registry endpoint.

THE SECRET IS RETURNED ONCE, AT CREATION, and there is no rotation endpoint. Terraform persists it to state (so keep your state encrypted and access-controlled) and never expects it on read. A secret lost outside Terraform is recovered by revoking the credential and minting a new one — terraform taint or changing name/capability both do exactly that.

Credentials are immutable: there is no update route, so changing any argument replaces the credential and issues a new secret. Update your downstream consumers.

This resource cannot be imported: an imported credential's secret could never be populated, and every subsequent plan would show it as unknown. Revoke and mint instead.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Create-immutable — capability, name: a registry credential has no update route at all — its capability is fixed when minted, so a change replaces the credential and issues a new secret.

Observed, not enacted — secret: returned once at create and never again — a refresh cannot read it back.

Example Usage

resource "frostmoln_container_registry" "example" {}

# The secret is returned ONCE, at creation, and there is no rotation endpoint.
# Terraform keeps it in state — so keep your state encrypted and access
# controlled. A secret lost outside Terraform is recovered by replacing the
# credential (`terraform taint`, or changing name/capability), which mints a new
# one and revokes the old.
resource "frostmoln_container_registry_credential" "ci" {
  name       = "ci-pipeline"
  capability = "push" # "pull" (the default) or "push"; push implies pull

  # The credential cannot be minted before the registry exists.
  depends_on = [frostmoln_container_registry.example]
}

output "docker_login" {
  # The username is single-quoted on purpose: it carries a `robot$` prefix, and
  # unquoted in bash or zsh the `$t...` is expanded away, so the login is refused
  # and the credential looks broken.
  description = "How to authenticate to the registry."
  value = format(
    "docker login %s -u '%s'",
    frostmoln_container_registry_credential.ci.endpoint,
    frostmoln_container_registry_credential.ci.username,
  )
}

output "registry_password" {
  value     = frostmoln_container_registry_credential.ci.secret
  sensitive = true
}

Schema

Required

• name (String) Your own label for the credential. It is not part of the credential's username. Changing it replaces the credential and issues a new secret.

Optional

• capability (String) What the credential may do at the registry endpoint: pull or push (push implies pull). Changing it replaces the credential and issues a new secret.

Read-Only

• created_at (String) When the credential was minted.
• disabled (Boolean) True while the tenant's registry is suspended. It is a property of the registry, not something done to this credential.
• endpoint (String) The host to docker login to.
• id (String) The credential's id.
• namespaces (List of String) The namespaces this credential reaches — the tenant's repository namespace and each of its pull-through caches (frostmoln_container_registry_cache). One credential covers all of them, because docker login is per host. A cache created AFTER this credential is extended onto it by the platform, so pulling through a new cache needs no new credential and no replacement of this one — but the list is read at refresh, so it lags a cache created in the same apply until the next one.
• secret (String, Sensitive) The docker login password. Returned only when the credential is first created, and it cannot be fetched again. Stored in Terraform state in plaintext — sensitive redacts CLI output, not the state file. See the Secrets in Terraform state guide.
• username (String) The docker login username, including its robot$ prefix.