Authoritatively manages the complete Container Registry lifecycle policy. Omitted entries are removed. Use one owner per namespace; avoid concurrent changes from the console, CLI or another Terraform resource.
Destroy disables retention and removes all lifecycle rules. It does not restore an earlier policy. Use terraform state rm or a removed block with destroy = false to relinquish ownership without resetting the policy.
If the parent is not ACTIVE, destroy warns and relinquishes ownership because the API cannot reset the policy. A retained namespace keeps its policy if it later becomes ACTIVE. Parent references establish deletion ordering.
Action deadlines default to 20 minutes.
Example usage
Schema
Required
namespace (String) Parent namespace name, such as example-images. Changing it replaces this policy resource.
Optional
enabled (Boolean) Whether lifecycle retention is enabled. Defaults to false.
rules (Attributes Map) Authoritative rules keyed by stable IDs. Omitted rules are removed. (see below for nested schema)
timeouts (Attributes) (see below for nested schema)
Read-Only
applied_revision (Number) Last lifecycle policy revision acknowledged by the worker. Acknowledgement does not indicate completed retention or garbage collection.
created_at (String) Creation timestamp in RFC3339 format.
etag (String) Current concurrency token. Changes when the server updates the resource.
id (String) Canonical API resource name used as the Terraform identifier.
name (String) Canonical API resource name.
revision (Number) Current desired policy revision.
updated_at (String) Last update timestamp in RFC3339 format.
Nested Schema for rules
Required:
regex (String) Go RE2 expression matched against the complete repository name or repository:tag. Matching is anchored to the whole input.
Optional:
keep_newest (Number) Number of newest matching images to retain, from 1 to 100.
older_than (String) Canonical positive protobuf duration, such as 86400s.
Nested Schema for timeouts
Optional:
create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).
delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
read (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).
Import
Import is supported using the following syntax:
Last modified on October 14, 2026