0

For context, I am trying to deploy a containerized (via Docker) R application to GCP's cloud run service. As part of my stack, I wanted to use Terraform to manage and provision all necessary infrastructure. I am running into a 403 forbidden error when executing terraform plan.

Here is my terraform configuration (Assume that all other .tf files are correctly written).

terraform {
  required_version = ">=0.13"
  backend "gcs" {
    bucket = "<project_id>-tf-states"
  }
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
      version = ">= 3.0.1"
    }
  }
}

# -- Specifies GCP Project which Terraform will manage -- # 

provider "google" {
  project = "<project_id>"
  region  = "europe-west4"
  zone    = "europe-west4"
}



# -- Specifies the service account that terraform will use to manage infrastructure -- #
locals {
  tf_sa = "<sa_account>"
}

# ----- Artifact registry to which docker containers will be deployed ----- #

resource "google_artifact_registry_repository" "main" {
  project       = "<project_id>"
  location      = "europe-west4"
  repository_id = "deploy-ml-model"
  description   = "Repository for Cloud Run images"
  format        = "DOCKER"
  
  lifecycle {
    prevent_destroy = true
  }
}


# ----- Define properly formatted variable names to be used as image address ----- #

locals {
  artifact_storage_address = "europe-west4-docker.pkg.dev/<project_id>/deploy-ml-model/model"
}

data "docker_registry_image" "main" {
  name = "${local.artifact_storage_address}"
}



# ----- Custom action used to build & bush image when tf configuration is updated ----- # 

resource "null_resource" "docker_build" {

    triggers = {
        always_run  = timestamp()
    }

    provisioner "local-exec" {
        working_dir = path.module
        command     = "docker build -t ${local.artifact_storage_address} . && docker push ${local.artifact_storage_address}"
    }
}


# ----- Create GCP cloud run service on which to deploy our containerized ML model & API ----- # 

resource "google_cloud_run_service" "default" {
    name     = "containerized-model"
    location = "europe-west4"
    project  = "<project_id>"

    metadata {
      annotations = {
        "run.googleapis.com/client-name" = "terraform"
      }
    }

    template {
      spec {
        containers {
          image = "${local.artifact_storage_address}"
        }
      }
    }

    traffic {
    percent         = 100
    latest_revision = true
  }
 }


# ----- Cloud run invoker ----- # 

data "google_iam_policy" "noauth" {
   binding {
     role = "roles/run.invoker"
     members = ["allUsers"]
   }
 }

 resource "google_cloud_run_service_iam_policy" "noauth" {
   location    = "europe-west4"
   project     = google_cloud_run_service.default.project
   service     = google_cloud_run_service.default.name

   policy_data = data.google_iam_policy.noauth.policy_data
}

The Dockerfile (which is in the same directory as my terraform config):

# Install R-version 3.6.3 as image
FROM rocker/r-ver:3.6.3

# Install required ubuntu libraries for 'mlr'
RUN apt-get update -qq && apt-get install -y \
  libgdal-dev libgeos-dev libproj-dev r-cran-udunits2 libgsl-dev libgmp-dev libglu-dev  r-cran-rjags libmpfr-dev libopenmpi-dev

# Install required libraries
RUN R -e "install.packages('beakr')"
RUN R -e "install.packages('mlr')"
RUN R -e "install.packages('randomForest')"
RUN R -e "install.packages('caret')"

# Expose the used port from beakr
EXPOSE 8001

# Load Script with model
# ADD . /app

# set current working directory to the added app directory
# WORKDIR /app

# Run the R script that contains the application
CMD ["Rscript", "./../src/backend.R"]

And here is the error message I am getting whenever GitHub Actions tries to execute terraform plan:

Error: Got error when attempting to fetch image version <project_id>/deploy-ml-model/model:latest from registry: Got bad response from registry: 403 Forbidden

Does anyone know if I am missing anything, or why I would be getting this error? Please let me know if I need to provide any further information. Thanks

  • Fixed the issue by removing the `data "docker_registry_image" "main" { name = "${local.artifact_storage_address}" }` resource altogether – Keith Cozart May 25 '23 at 08:49

0 Answers0