frostmoln_container_registry_retention (Resource)

Manages the tag-retention policy on this tenant's container registry. A tenant has one policy, and it applies to every repository in the tenant's registry namespace.

The policy runs nightly, between 00:00 and 06:00 UTC. Images are counted per repository: each repository is evaluated separately. Pull-through caches are never touched; they keep their own platform-managed cleanup. Storage freed by the policy shows in the registry's usage after the nightly run, not when you apply.

At least one of keep_last_tagged and delete_untagged_after_days must be set. A rule that is not set keeps everything in its class. Applying REPLACES the whole policy, so a policy set elsewhere (the portal or the fm CLI) is overwritten. Destroying the resource removes the policy, after which nothing is deleted.

Setting a policy is a deferred bulk delete, so it needs permission to delete images (registry:artifacts:delete) as well as registry:settings:update. Images it deletes cannot be recovered.

The container registry must be enabled first (frostmoln_container_registry).

Authoritative scope. Every configurable attribute of this resource is enacted and reconciled: the platform applies it and a refresh reads the truth back. No attribute forces replacement, and no platform-invented default attaches. Declared in internal/scopedecl, machine-checked against the schema.

Example Usage

# The tenant's single tag-retention policy. It runs nightly, between 00:00
# and 06:00 UTC, and counts images per repository. Pull-through caches are
# never touched.
#
# Applying replaces the whole policy. A rule left unset keeps everything in its
# class: here, untagged images older than 14 days are deleted and every
# repository keeps its 20 most recently pushed tagged images.
resource "frostmoln_container_registry" "example" {}

resource "frostmoln_container_registry_retention" "example" {
  keep_last_tagged           = 20
  delete_untagged_after_days = 14

  depends_on = [frostmoln_container_registry.example]
}

Schema

Optional

• delete_untagged_after_days (Number) Delete untagged images whose last push is more than this many days old. Between 1 and 365. When unset, untagged images are never deleted.
• keep_last_tagged (Number) Keep the N most recently pushed tagged images in each repository; older tagged images are deleted. Between 1 and 1000. When unset, tagged images are never deleted.

Read-Only

• id (String) The tenant id. A tenant has exactly one retention policy and its id is the tenant's.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# The import id is the tenant id: a tenant has exactly one retention policy.
terraform import frostmoln_container_registry_retention.example <tenant-id>