> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# coreweave_container_registry_namespace (Resource)

Manages a Container Registry namespace and its storage quota. Initial access configuration is historical create-only input. The resource never automatically adopts an existing namespace.

Destroy refuses to delete stored content unless `force_destroy` was applied beforehand. Action deadlines default to 20 minutes and are independent of HTTP attempt timeouts.

An interrupted create can leave a tainted resource. Inspect the remote namespace and explicitly import it when private recovery state is unavailable.

## Example usage

```terraform theme={"system"}
resource "coreweave_container_registry_namespace" "images" {
  name                = "example-images"
  zone                = "US-LAB-01A"
  storage_quota_bytes = 107374182400
  force_destroy       = false

  timeouts = {
    create = "30m"
    delete = "30m"
  }
}
```

## Schema

### Required

* `name` (String) Namespace name used in the registry hostname, such as example-images. Changing it replaces the namespace.
* `zone` (String) Upper-case zone identifier. Changing it replaces the namespace.

### Optional

* `force_destroy` (Boolean) Irreversibly delete content on destroy. Apply this setting before destroying; never enabled automatically.
* `initial_access_configuration` (Attributes) Historical create-only input. Omission selects the server default; {} atomically installs deny-all. Any change replaces the namespace. Import leaves this null; adding it after import replaces the namespace. (see [below for nested schema](#nestedatt--initial_access_configuration))
* `storage_quota_bytes` (Number) Namespace ceiling in bytes. Omission/null clears the ceiling; zero disables pushes after evaluation.
* `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))

### Read-Only

* `access_mode` (Attributes) Current effective namespace access mode. (see [below for nested schema](#nestedatt--access_mode))
* `content_status` (Attributes) Server-reported storage usage and content counts. These observations may lag content changes. (see [below for nested schema](#nestedatt--content_status))
* `created_at` (String) Creation timestamp in RFC3339 format.
* `created_by` (Attributes) Identity that created the namespace. (see [below for nested schema](#nestedatt--created_by))
* `dns_name` (String) Registry hostname used for OCI pushes and pulls.
* `etag` (String) Current concurrency token. Changes when the server updates the resource.
* `id` (String) Canonical API resource name used as the Terraform identifier.
* `org_id` (String) Organization that owns the namespace.
* `status` (String) Current namespace provisioning state.
* `updated_at` (String) Last update timestamp in RFC3339 format.
* `updated_by` (Attributes) Identity that last updated the namespace. (see [below for nested schema](#nestedatt--updated_by))

<h3 id="nestedatt--initial_access_configuration">
  Nested Schema for `initial_access_configuration`
</h3>

Optional:

* `policy_sets` (Attributes Map) Authoritative policy sets keyed by stable IDs. Omitted entries are removed. COREWEAVE\_KUBERNETES is deprecated; use WORKLOAD\_FEDERATION. (see [below for nested schema](#nestedatt--initial_access_configuration--policy_sets))
* `request_ip_acl` (Attributes) Optional request filter. At least one allow or deny network is required; omission removes the ACL. An ACL grants no authorization. (see [below for nested schema](#nestedatt--initial_access_configuration--request_ip_acl))

<h3 id="nestedatt--initial_access_configuration--policy_sets">
  Nested Schema for `initial_access_configuration.policy_sets`
</h3>

Required:

* `identity_selector` (String) Identity class evaluated by this policy set. Supported values: `COREWEAVE`, `WORKLOAD_FEDERATION`, `ANY_AUTHENTICATED`, `ANONYMOUS`, `COREWEAVE_KUBERNETES`. COREWEAVE\_KUBERNETES is deprecated; use WORKLOAD\_FEDERATION.
* `rules` (Attributes Map) Authoritative rules keyed by stable IDs. Omitted rules are removed. (see [below for nested schema](#nestedatt--initial_access_configuration--policy_sets--rules))

<h3 id="nestedatt--initial_access_configuration--policy_sets--rules">
  Nested Schema for `initial_access_configuration.policy_sets.rules`
</h3>

Required:

* `expression` (String) CEL expression evaluated against the request identity and context.

<h3 id="nestedatt--initial_access_configuration--request_ip_acl">
  Nested Schema for `initial_access_configuration.request_ip_acl`
</h3>

Optional:

* `allow_cidrs` (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.
* `deny_cidrs` (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.

<h3 id="nestedatt--timeouts">
  Nested Schema for `timeouts`
</h3>

Optional:

* `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
* `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
* `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
* `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

<h3 id="nestedatt--access_mode">
  Nested Schema for `access_mode`
</h3>

Read-Only:

* `mode` (String) Effective access mode reported by the server.
* `reasons` (Set of String) Server-reported reasons for the effective access mode.
* `updated_at` (String) Last update timestamp in RFC3339 format.

<h3 id="nestedatt--content_status">
  Nested Schema for `content_status`
</h3>

Read-Only:

* `blob_count` (Number) Number of stored blobs.
* `manifest_count` (Number) Number of stored manifests.
* `repository_count` (Number) Number of repositories.
* `tag_count` (Number) Number of tags.
* `updated_at` (String) Last update timestamp in RFC3339 format.
* `usage_bytes` (Number) Total stored content size in bytes.

<h3 id="nestedatt--created_by">
  Nested Schema for `created_by`
</h3>

Read-Only:

* `user_uid` (String) CoreWeave user identifier.
* `username` (String) CoreWeave username.

<h3 id="nestedatt--updated_by">
  Nested Schema for `updated_by`
</h3>

Read-Only:

* `user_uid` (String) CoreWeave user identifier.
* `username` (String) CoreWeave username.

## Import

Import is supported using the following syntax:

```bash theme={"system"}
terraform import coreweave_container_registry_namespace.images example-images
```