Repository navigation
fix(infra): arm Artifact Registry cleanup policy (dry_run=false, D115) - #90
Merged
Merged
Conversation
The cleanup policy (keep 3 most recent versions) was running in dry-run mode: it logged what it would delete without deleting anything. Result: 22 ingestion + 27 dbt versions accumulated, repo at 8.9 GB (~17x the 0.5 GB free tier). Root cause: cleanup_policy_dry_run was never set in HCL. The provider writes the schema default (false) to state but does not propagate an implicit false to the API, so the repo stayed in API-side dry-run. Note: on the existing repo this HCL line is a no-op at plan time (HCL = state, both false, never sent to API). The dry-run was actually disabled out-of-band via 'gcloud artifacts repositories set-cleanup-policies --no-dry-run'. The line guarantees correct behaviour on repo recreation.
ESNAULTQ
self-requested a review
June 2, 2026 07:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Contexte
Le dashboard coûts a révélé un poste Artifact Registry anormalement élevé.
Investigation : le repo
datatalentpesait 8,9 Go (≈ 17× le free tier de 0,5 Go,≈ 0,82 $/mois) avec 22 versions
ingestion+ 27dbtaccumulées — alors que lacleanup policy
keep_count = 3est censée n'en garder que 3 par image.Cause racine : la policy tournait en dry-run (elle journalise ce qu'elle
supprimerait sans rien supprimer). Le champ
cleanup_policy_dry_runn'avait jamais étépositionné dans le HCL ; le provider écrit son défaut (
false) au state mais ne propagepas ce
falseimplicite à l'API → le repo restait en dry-run côté serveur.Décisions techniques (le point à comprendre pour la review)
terraform planrépondNo changes: le state porte déjàfalse, jamais envoyé à l'API.plancompare HCL ↔ state, pas HCL ↔ API. Terraform seul ne corrige pas ce bug.gcloud … set-cleanup-policies --no-dry-run(déjà exécuté, réponseDry run is disabled.).ingestion/dbt) vérifiées = #1 du top 3 conservé. La purge ne touche aucune image en service.Changements
infra/main.tf: ajoutcleanup_policy_dry_run = falsesur le repository AR + commentaireexpliquant le caractère documentaire de la ligne. Correction d'un renvoi erroné (
D69→D115; D69 = schémas BigQuery, sans rapport).Validation
terraform plansur cette branche =No changes(attendu, cf. tableau ci-dessus —le fix opérationnel est l'appel
gcloud, pas l'apply).Action requise côté reviewers
l'intention dans le HCL.
describepour vérifier : l'API ometcleanupPolicyDryRunquandil vaut
false(doncABSENT=false, ambigu). Vérifier par le compte de versions(doit tomber à 3/3 dans les heures qui suivent l'armement).
limite documentée dans D115, pas un oubli.
Refs
D115 (cleanup policy inerte, tension IaC ↔ API), D26 (free tier AR), D69 (renvoi corrigé).