Add support for container images

[mjrlee]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

I would like to use the latest digest of a tagged image in GCR for the metadata for an instance group.

At the moment I have to use the Docker provider, which adds an authentication step and requires Docker to be installed on the CI/CD runner.

This could be greatly simplified by having a terraform data source that does something like:

gcloud container images describe gcr.io/google-containers/busybox:latest
image_summary:
  digest: sha256:326f5d6db34dbc2292c6a58a0f8a0a90f185beae923568907b0365bd892b7458
  fully_qualified_digest: gcr.io/google-containers/busybox@sha256:326f5d6db34dbc2292c6a58a0f8a0a90f185beae923568907b0365bd892b7458
  registry: gcr.io
  repository: google-containers/busybox

Affected Resource(s)

Datasource:

• google_container_image

Potential Terraform Configuration

data "google_container_image" "busybox" {
  name "gcr.io/google-containers/busybox:latest"
}

module "gce-container" {
  source  = "terraform-google-modules/container-vm/google"
  version = "1.0.0"

  container = {
    image = data.google_container_image.busybox.fully_qualified_digest
  }

  restart_policy = "Always"
}

References

[Capstan]

I ran into this wrt google_container_registry_image, wanting to have automatic resolution if I provide a tag that is mutable, and I do not provide a digest, that I can still read the digest out of the data and have the provider facilitate that lookup for me. This would improve release processes where the image reference is never re-pulled by the underlying facility, since terraform naturally won't see a difference between :latest and :latest images, even if between the two apply phases, someone changed the tag.

I would expect that Artifact Registry would have the same issue, but individual packages don't appear to be part of the provider yet.