Yandex Cloud Functions trigger
A trigger for Cloud Functions runs a function when specific events occur with a Container Registry Docker image. The trigger must be in the same cloud as the registry whose events it is subscribed to.
A trigger for Container Registry needs a service account to invoke a function.
For more information about creating a trigger for Container Registry, see Creating a trigger for Container Registry that invokes Cloud Functions.
Events for setting up a trigger
Events with Docker images that can be tracked using a trigger:
- Creating a Docker image.
- Deleting a Docker image.
- Creating a Docker image tag.
- Deleting a Docker image tag.
A Docker image is always pushed with a tag (if no tag is specified, Docker automatically assigns the latest tag), meaning the CreateImage event always comes with CreateImageTag. You can add any number of tags to a Docker image by pushing the same image with different tags. In this case, only the CreateImageTag event occurs, without CreateImage.
A tag can be reassigned from one Docker image to another. This happens when pushing a new Docker image with a tag that is already used in another Docker image. In this case, the CreateImage event will occur for the new Docker image. In this case, changing the tag will trigger two events: DeleteImageTag (removing the tag from the old Docker image) and CreateImageTag (assigning the tag to the new Docker image).
Deleting a Docker image also deletes all its tags. This is why deleting a Docker image always triggers the DeleteImage event and as many DeleteImageTag events as the Docker image had tags at the time of deletion.
Filtering events
Events are filtered using tags and names of Docker images you push. When using a name and a tag at the same time, filtering is based on the logical AND: for the trigger to fire, the image must match both the name and the tag.
Event batching
Batching settings allow you to send multiple events to a function at the same time. They set a top limit on the event batch size and accumulation time. For example, if the event batch size is 3, the function can receive batches of one to three events.
Roles required for the proper operation of a trigger for Container Registry
- To create a trigger, you need:
- Permission for the service account used by the trigger to run the operation. This permission comes with the iam.serviceAccounts.user and editor roles or higher.
- The
container-registry.images.pullerrole for the registry whose events are processed by the trigger.
- For the trigger to fire, the service account needs the
functions.functionInvokerrole for the folder containing the function invoked by the trigger.
Learn more about access management here.
Container Registry trigger message format
Once the trigger fires, it will send the following message to the function:
{
"messages": [
{
"event_metadata": {
"cloud_id": "b1gvlrnlw2e6********",
"created_at": "2020-09-07T11:09:14Z",
"event_id": "crtpk611vb7g********",
"event_type": "yandex.cloud.events.containerregistry.CreateImage",
"folder_id": "b1g88tfl0pl8********",
"tracing_context": {
"parent_span_id": "-14915794679********",
"span_id": "-72326631357********",
"trace_id": "70e7m4n2********"
}
},
"details": {
"image_digest": "sha256:45f8f740272f1f2a053eade37d8d************************************",
"image_id": "crti2c9b************",
"registry_id": "crt2504s************",
"repository_name": "crt2504s************/ubuntu",
"tag": "latest"
}
}]
}