Skip to main content

Publish a module

Coming soon

In preparation. This page describes the target interface to gather your feedback; nothing is usable yet.

A Workspace only references modules published as OCI (native format of OpenTofu 1.10 and later, artifact type application/vnd.opentofu.modulepkg). A git repository is not accepted: the applied version is always an immutable tag or digest.

Prerequisites​

  • OpenTofu ≥ 1.10 and oras on your machine, or in the CI.
  • A repository in your tenant's registry to host the module (Repositories), or an accessible external registry.

Package and push​

The module is an archive of its root folder (.tf files, submodules, README):

cd modules/ovh-network
tar -czf /tmp/ovh-network.tgz .
oras push ovh-gra-0.registry.dev.stackngo.fr/acme/ovh-network:1.4.0 \
  --artifact-type application/vnd.opentofu.modulepkg \
  /tmp/ovh-network.tgz:archive/tar+gzip
Pushed [registry] ovh-gra-0.registry.dev.stackngo.fr/acme/ovh-network:1.4.0
Digest: sha256:9f1c…

Keep the digest: a Workspace that references it is immune to a rewritten tag.

Check locally​

tofu init -from-module="oci://ovh-gra-0.registry.dev.stackngo.fr/acme/ovh-network?tag=1.4.0" /tmp/test

Good practices​

  • Version with semantic tags, and never rewrite a published tag.
  • Declare required_providers in the module: the platform compares them to the tenant's Provider resources.
  • Expose outputs for everything another Workspace or an App will need to know (identifiers, addresses, names): it is the only channel between Workspaces.
  • No backend or hard-coded provider block in the module: the platform generates them.
  • For reasonable retention, a keepTagsRegex: ["^\\d+\\.\\d+\\.\\d+$"] policy on the repository keeps the published versions and purges the trials.

See also​