JFrog Artifactory Terraform Provider

The tf-v5-migrator is a CLI tool designed to transform Artifactory Terraform repository resources. It converts generic repository types used in version 5 of the provider into the package-specific types required in version 6.

The tool performs two main functions:

1. Code Transformation: It parses input Terraform configuration files and generates new files where V5 resources are replaced with their V6 equivalents.
2. State Import Generation: It can generate terraform import commands for the migrated resources to facilitate the migration of existing Terraform state.

# Basic transformation
tf-v5-migrator --input sample.v5.tf --output sample.v6.tf

# Transformation with import command generation
tf-v5-migrator --input sample.v5.tf --output sample.v6.tf --import

The artifactory_scoped_token resource allows you to create and manage Scoped Tokens in Artifactory. These tokens can be tied to specific users, groups, or roles and can have restricted scopes, expiration times, and audiences.

Security Warning: Scoped tokens are stored in the Terraform state as plain-text. Ensure your state backend is secured.

Persistence Note: If you set expires_in to a value less than the Artifactory Access configuration's persistency threshold (default is 10800 seconds), Artifactory will not save the token.

resource "artifactory_scoped_token" "scoped_token" {
  username = "existing-user"
}

The artifactory_package_cleanup_policy resource allows system administrators to define and automate the removal of unused binaries across the JFrog platform. Policies can be based on time (age), version counts (retention), or specific package properties.

Platform Requirements:

• Cloud: Supported on version 7.98.2+" with an Enterprise+ license.
• Self-Hosted: Supported on version 7.98.7+ with an Enterprise+ license.
• Enterprise X (EntX): Supported on Cloud (7.139+) and Self-Hosted (7.146+).

resource "artifactory_package_cleanup_policy" "example" {
  key = "example-policy"
  description = "Example policy"
  cron_expression = "0 0 2 ? * MON-SAT *"
  duration_in_minutes = 60
  enabled = true
  skip_trashcan = false
  
  search_criteria = {
    package_types = ["docker"]
    repos = ["**"]
    include_all_projects = true
    included_packages = ["**"]
  }
}

Terraform providers operate as independent RPC (Remote Procedure Call) servers. When you execute a Terraform command, the CLI starts the provider as a new, separate process and communicates with it via an RPC channel.

This architecture creates two main challenges for developers:

1. Process Isolation: The provider runs in its own memory space, separate from the Terraform CLI process.
2. Ephemeral Lifecycles: The provider process is often short-lived, existing only for the duration of a specific resource operation. This makes it difficult for a debugger to attach before the process completes and exits.

To solve this, developers must use a 'remote debug' pattern: injecting a blocking loop into the provider code to keep the process alive, and then using a tool like delve to attach to the process ID (PID) while it is in that blocked state.

You can archive packages based on how long ago they were created or last downloaded.

Note: These fields require Artifactory 7.111.2 or later.

Time-based Conditions

• created_before_in_days: Archives packages created more than $N$ days ago.
• last_downloaded_before_in_days: Archives packages last downloaded more than $N$ days ago.

Note: created_before_in_months and last_downloaded_before_in_months are deprecated. Use the _in_days variants instead.

Remote repositories can be assigned to Artifactory Projects using project_key and project_environments.

• project_key: The project key (2-32 lowercase alphanumeric and hyphen characters). Note: When assigning via this attribute, the repository key must be prefixed with the project key, separated by a dash.
• project_environments: Assigns the repository to a specific environment (e.g., DEV, PROD, or custom).

Version-specific behavior for project_environments:

• Before Artifactory 7.53.1: Up to 2 values allowed (DEV and PROD).
• 7.53.1 to 7.107.1: Only one value allowed.
• 7.107.1 and later: Multiple values allowed.

Warning: Only use these attributes if the repository is already assigned to an existing project. If not, Artifactory will ignore them, but they will remain in the Terraform state, causing state drift during updates.

Time-based policies archive binaries that meet age criteria. You can use either days or months, but not both in the same policy.

Note on Version Compatibility:

• For Artifactory 7.111.2 and later: Use created_before_in_days and last_downloaded_before_in_days.
• For earlier versions: Use created_before_in_months and last_downloaded_before_in_months.

search_criteria = {
  package_types = ["docker"]
  repos = ["**"]
  include_all_projects = true
  included_projects = []
  included_packages = ["**"]
  excluded_packages = ["com/jfrog/latest"]
  created_before_in_days = 30
  last_downloaded_before_in_days = 60
}

The artifactory_pull_replication resource allows you to proactively populate a remote cache by pulling artifacts from a source repository. This is useful for reducing network latency by ensuring artifacts are already present at the destination before they are requested on demand.

Note: This resource is deprecated. It is replaced by artifactory_remote_repository_replication for improved clarity. Use the newer resource for new implementations.

resource "artifactory_pull_replication" "remote-rep" {
	repo_key                 = "destination-repo-key"
	cron_exp                 = "0 0 * * * ?"
	enable_event_replication = true
}