Artifact Registry
ArtifactRegistry
Defines a private Google Artifact Registry repository.
Declares intent for a repository that stores container images or language packages (Maven, Python, etc.); the engine translates it into a google_artifact_registry_repository resource with scoped IAM bindings and, for custom proxy formats (BUF, DART), a Cloud Run proxy service. Supports declaring TrustedRepository children to model trust relationships.
| Property | Type | Description |
|---|---|---|
| apiVersion | string | API schema version. Pins the manifest to a specific schema contract for backward-compatibility. Must be the constant lowops.manifests.v1. |
| kind | string | Resource kind discriminator. Identifies this document as an ArtifactRegistry so the engine routes it to the correct defaulter, validator, computer, and executor. Must be the constant ArtifactRegistry. |
| metadata | map | Classification labels and graph linkage. Free-form key/value pairs used to classify the manifest. Certain reserved keys (e.g. name, organization) are read by the engine to resolve this manifest's identity and its parent Organization in the dependency graph. |
| spec | Spec | Desired repository configuration. The authoritative, user-authored specification for this repository. See Spec. |
Spec
Desired repository configuration.
User-authored settings for the Artifact Registry repository: package format, region, public exposure, and reader/writer IAM permissions. Drives the provisioned google_artifact_registry_repository and its access bindings.
| Property | Type | Description |
|---|---|---|
| enabled | bool | Whether this repository configuration is active. NOT YET IMPLEMENTED. Declared in the schema but currently ignored by the engine (no consumer reads it); the repository is always provisioned regardless of this value. Intended future behavior: when false, omit this configuration from the execution graph and schedule the existing repository for destruction. |
| description | string | Human-readable description of this repository. Optional free text describing the repository's role. Propagated onto the provisioned google_artifact_registry_repository description field, and used as context by AI assistants when reasoning about the manifest. |
| public | bool | Grant unauthenticated public read access. When true, adds an IAM binding granting roles/artifactregistry.reader to allUsers, allowing anyone to pull artifacts without authentication. When false, access is restricted to the principals in permissions. |
| type | string | Package format of the repository. The artifact format enforced on the repository, mapped to the underlying GCP repository format. Custom proxy formats BUF and DART are stored as GENERIC and served through a Cloud Run proxy. Must be one of DOCKER, MAVEN, NPM, GO, PYTHON, HELM, BUF, DART, or AGENT. |
| region | string | GCP region for the repository. The location where the repository is created. When unset, it falls back to the parent Organization's default region. The value is resolved to a multi-region location for the Artifact Registry repository. |
| permissions | ArtifactRegistryAccessPermissions | Reader and writer access grants. Maps organization users and groups to read (roles/artifactregistry.reader) and write (roles/artifactregistry.writer) roles on the repository. Referenced principals are validated against the parent Organization and resolved to IAM bindings during execution. See ArtifactRegistryAccessPermissions. |
ArtifactRegistryAccessPermissions
Defines access levels specifically for Artifact Registry repositories.
Maps readers and writers to roles/artifactregistry.reader and roles/artifactregistry.writer respectively on the targeted google_artifact_registry_repository.
| Property | Type | Description |
|---|---|---|
| readers | DetailedAccessPermissions | A list of users and groups who are granted read-only access to the repository. Corresponds to the 'roles/artifactregistry.reader' IAM role. |
| writers | DetailedAccessPermissions | A list of users and groups who are granted read and write access to the repository. Corresponds to the 'roles/artifactregistry.writer' IAM role. |
DetailedAccessPermissions
Aggregation of specific user and group access definitions.
Refers to lists of OrganizationUser and OrganizationUserGroup manifests that will be parsed to retrieve actual Google Workspace identity emails for IAM binding construction.
| Property | Type | Description |
|---|---|---|
| members | list of string | A list of 'OrganizationUser' manifest names to be included in this permission set. |
| groups | list of string | A list of 'OrganizationUserGroup' manifest names to be included in this permission set. |