-
-
Notifications
You must be signed in to change notification settings - Fork 553
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Create ecr_registry resource to login to ecr #216
Comments
@chrisferry Can you please explain how to use this "https://gist.github.com/chrisferry/f716d3e74d534598eaa5 " ? |
Here is a workaround for this issue.
docker_registry 'AWS ECR registry' do |
I'd like to begin work on this feature (have a dire use case for it), but it would require the |
+1 to this. Staggering that Chef has no native resource to be able to log into ECR. What year is this? |
@petewilcock 2018 apparently. |
@turtleDev Greetings from 2019. |
Are you all blocked or you just want a Chef resource? If blocked, I don't mind providing the way to do it. Ping me and I'll post solution here 👨🍳 |
@rashidmahmood already demonstrated how to work around the issue. But here's the thing, the cookbook should already provide a resource for ECR, since that's the 'proper' way of doing it. |
@turtleDev I don't think it's a good workaround as you refresh the token within the valid interval for no reason as well as having the username hardcoded (creds are base64 encoded with the username inside). But sure if it works 🤷♂ |
The username for the ECR login never changes as far as I’m aware, so there’s no huge issue with it being hard-coded. As far as refreshing the token, since it’s only valid for a relatively short amount Either way, the other solutions seemed to be missing things or weren’t as flexible as I’d hoped. I ended up writing a quick recipe that works with the Docker cookbook and allows me to login during the run. I’ll share the gist if anyone wants to use it. It’s pretty adaptable and could be converted into a resource. |
Have a look at: https://github.com/awslabs/amazon-ecr-credential-helper |
I totally agree. But rather than having another workaround, I'd rather have a resource to work with. That said, I think it's a good idea for you to post your work around here anyway, if you think it solves the problem better than the current fix. It maybe useful for other people who ran into the same problem as the rest of us. |
@scalp42 Ah, that's a great callout, actually, and a much better solution. I always forget about the credential helper (despite using it elsewhere). |
@charlieoleary I think so too as well.
Bonus point is that you can also have ECR, Quay.io etc working at the same time in the if node[cookbook_name][recipe_name]['my_registries']['quay']['enabled']
current_config['auths']['quay.io'] = {
'auth' => ::MyLib::KMS.decrypt(node[cookbook_name][recipe_name]['my_registries']['quay']['auth'])
}
else
current_config['auths'].delete('quay.io')
end I just don't think registries auth have much to do with Chef resources to be transparent but if it works for you 🤷♂ cc @turtleDev |
Yeah, totally. The previous use case was to avoid persisting a DockerHub / Quay / whatever login on each instance for anyone to use and making that only available to Chef. The |
Referencing sous-chefs/docker#660
To access docker images in ECR we need to login using awscli.
See https://gist.github.com/chrisferry/f716d3e74d534598eaa5 for an example.
The text was updated successfully, but these errors were encountered: