Creating a trigger for Container Registry that invokes a container from Serverless Containers

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To create a trigger that invokes a container, run this command:

yc serverless trigger create container-registry \
  --name <trigger_name> \
  --registry-id <registry_ID> \
  --events 'create-image','delete-image','create-image-tag','delete-image-tag' \
  --batch-size <event_batch_size> \
  --batch-cutoff <maximum_timeout> \
  --invoke-container-id <container_ID> \
  --invoke-container-service-account-id <service_account_ID> \
  --retry-attempts <number_of_retry_attempts> \
  --retry-interval <interval_between_retry_attempts> \
  --dlq-queue-id <dead-letter_queue_ID> \
  --dlq-service-account-id <service_account_ID>

Where:

• --name: Trigger name.
• --registry-id: Registry ID.
• --events: Events that set off the trigger.

• --batch-size: Event batch size. This is an optional setting. The values may range from 1 to 10. The default value is 1.
• --batch-cutoff: Maximum wait time. This is an optional setting. The values may range from 1 to 60 seconds. The default value is 1 second. The trigger groups events within the batch-cutoff period and sends them to the container. The number of events cannot exceed batch-size.

• --invoke-container-id: Container ID.
• --invoke-container-service-account-id: ID of the service account with permissions to invoke the container.
• --retry-attempts: Number of invocation retries before the trigger moves a message to the dead-letter queue. This is an optional setting. The values may range from 1 to 5. The default value is 1.
• --retry-interval: Time to wait before retrying the container invocation if it fails. This is an optional setting. The values may range from 10 to 60 seconds. The default value is 10 seconds.
• --dlq-queue-id: Dead-letter queue ID. This is an optional setting.
• --dlq-service-account-id: ID of the service account with write permissions for the dead-letter queue. This is an optional setting.

Result:

id: a1s5msktijh2********
folder_id: b1gmit33hgh2********
created_at: "2022-10-24T15:19:15.353909857Z"
name: registry-trigger
rule:
  container_registry:
    event_type:
    - CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE
    - CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE
    - CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE_TAG
    - CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE_TAG
    registry_id: crtlds4tdfg12kil77h2********
    batch_settings:
      size: "3"
      cutoff: 20s
    invoke_container:
      container_id: bba5jb38o8h2********
      service_account_id: aje3932acdh2********
      retry_settings:
        retry_attempts: "1"
        interval: 10s
      dead_letter_queue:
        queue-id: yrn:yc:ymq:ru-central1:aoek49ghmkh2********:dlq
        service-account-id: aje3932acdh2********
status: ACTIVE

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To create a trigger for Container Registry:

1. In the Terraform configuration file, describe the resources you want to create:

   resource "yandex_serverless_triggers" "my_trigger" {
     name = "<trigger_name>"
     source {
       container_registry {
         registry_id = "<registry_ID>"
         image_name  = "<image_name>"
         tag         = "<image_tag>"
         event_type = [
           "CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE",
           "CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE",
           "CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE_TAG",
           "CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE_TAG",
         ]
         batch_settings {
           max_count = "<max_number_of_events>"
           max_bytes = "<max_group_size_in_bytes>"
           cutoff    = "<maximum_wait_time>"
         }
       }
     }
     action {
       invoke_container {
         container_id       = "<container_ID>"
         path               = "<HTTP_path>"
         service_account_id = "<service_account_ID>"
       }
       retry_policy {
         retry_attempts = "<number_of_retries>"
         interval       = "<interval_between_retries>"
       }
       dead_letter {
         dead_letter_queue {
           queue_arn          = "<Dead_Letter_Queue_ARN>"
           service_account_id = "<service_account_ID>"
         }
       }
     }
   }
   

   Where:

   • name: Trigger name. The name format is as follows:

     • Length: between 3 and 63 characters.
     • It can only contain lowercase Latin letters, numbers, and hyphens.
     • It must start with a letter and cannot end with a hyphen.

   • description: Trigger description. This is an optional parameter.

   • labels: Trigger labels in key:value format. This is an optional parameter.

   • source: Event source settings:

     • container_registry: Registry settings:

       • registry_id: Registry ID.

       • image_name: Name of the image for filtering. To find out the Docker image name, get the list of Docker images in the registry.

       • tag: Tag of the image for filtering.

       • event_type: List of events to set off the trigger. Specify at least one value:

         • CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE: Creating a new Docker image in the registry.
         • CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE: Deleting a Docker image from the registry.
         • CONTAINER_REGISTRY_EVENT_TYPE_CREATE_IMAGE_TAG: Creating a new Docker image tag in the registry.
         • CONTAINER_REGISTRY_EVENT_TYPE_DELETE_IMAGE_TAG: Deleting a Docker image tag from the registry.

       • batch_settings: Event grouping settings. This is an optional section.

         • cutoff: Maximum event grouping time. This is a required setting. After the specified time has passed, the trigger sends the event group, even if it is not complete.
         • max_count: Maximum number of events per group.
         • max_bytes: Maximum total size of events per group, in bytes.

         At least one of the parameters, max_count or max_bytes, must be greater than 0.

   • action: Target settings. You can specify this section multiple times so the trigger calls multiple resources, including those of different types. There are limits on the maximum number of resources.

     • invoke_container: Container settings:

       • container_id: Container ID.
       • path: HTTP path to call the container at. This is an optional parameter.
       • service_account_id: ID of the service account with permissions to invoke the container.

     • filter: Filtering events before sending them to the target. This is an optional section.

       • jq: jq template to filter events sent to the target. It not specified, all events reach the target.

     • transformer: Transforming events before sending them to the target. This is an optional section.

       • jq: jq template to transform events before sending them to the target. It omitted, no transformations apply to the events.

     • retry_policy: Repeated request settings. This is an optional section.

       • interval: Time interval before a retry attempt to send the event if the current attempt fails.
       • retry_attempts: Number of retry attempts before the trigger moves the event to the dead-letter queue.

     • dead_letter: Dead-letter queue settings. This is an optional section.

       • dead_letter_queue: Queue settings:

         • queue_arn: Queue ARN.
         • service_account_id: ID of the service account with permissions to write to the queue.
         • message_attributes: Attributes to add to each message in the queue, in key:value format. This is an optional parameter.

   For more on the properties of the yandex_serverless_triggers resource, see this provider guide.

   Configuration for the yandex_function_trigger resource

   resource "yandex_function_trigger" "my_trigger" {
     name = "<trigger_name>"
     container {
       id                 = "<container_ID>"
       service_account_id = "<service_account_ID>"
       retry_attempts     = "<number_of_retry_attempts>"
       retry_interval     = "<time_between_retry_attempts>"
     }
     container_registry {
       registry_id      = "<registry_ID>"
       image_name       = "<image_name>"
       tag              = "<image_tag>"
       create_image     = true
       delete_image     = true
       create_image_tag = true
       delete_image_tag = true
       batch_cutoff     = "<maximum_wait_time>"
       batch_size       = "<event_batch_size>"
     }
     dlq {
       queue_id           = "<dead-letter_queue_ID>"
       service_account_id = "<service_account_ID>"
     }
   }
   

   Where:

   • name: Trigger name. Follow these naming requirements:

     • Length: between 3 and 63 characters.
     • It can only contain lowercase Latin letters, numbers, and hyphens.
     • It must start with a letter and cannot end with a hyphen.

   • container: Container settings:

     • id: Container ID.
     • service_account_id: ID of the service account with permissions to invoke the container.
     • retry_attempts: Number of invocation retries before the trigger moves a message to the dead-letter queue. This is an optional setting. The values may range from 1 to 5. The default value is 1.
     • retry_interval: Time to wait before retrying the container invocation if it fails. This is an optional setting. The values may range from 10 to 60 seconds. The default value is 10 seconds.

   • container_registry: Trigger settings:

     • registry_id: Registry ID.

     • image_name: Name of the image for filtering. To find out the Docker image name, get the list of Docker images in the registry.

     • tag: Tag of the image for filtering.

     • Events that set off the trigger:

       • create_image: Trigger will invoke the container when a new Docker image is created in the registry. The possible values are true or false.
       • delete_image: Trigger will invoke the container when a Docker image is deleted from the registry. It can either be true or false.
       • create_image_tag: Trigger will invoke the container when a new Docker image tag is created in the registry. It can either be true or false.
       • delete_image_tag: Trigger will invoke the container when a Docker image tag is deleted from the registry. It can either be true or false.
     • batch_cutoff: Maximum wait time. This is an optional setting. The values may range from 1 to 60 seconds. The default value is 1 second. The trigger groups events within the batch_cutoff period and sends them to the container. The number of events cannot exceed batch_size.
     • batch_size: Event batch size. This is an optional setting. The values may range from 1 to 10. The default value is 1.
     • dlq: Dead-letter queue settings:
       • queue_id: Dead-letter queue ID.
       • service_account_id: ID of the service account with write permissions for the dead-letter queue.

   For more on the properties of the yandex_function_trigger resource, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   Terraform will create all the required resources. You can check the new resources using the management console or this CLI command:

   yc serverless trigger list
   

To create a trigger for Container Registry, use the create REST API method for the Trigger resource or the TriggerService/Create gRPC API call.