Skip to content

Commit f2ca76c

Browse files
marboledaccimarboledacci
authored
Add parameter to use or not the ecr-credentials-helper (#350)
* Test build-test-then-push-with-buildx without context to replicate issue * Readd context * Add a new parameter to avoid using the credentials helper * Fix error in condition syntax * Fix job parameters * Fix requirements in tests jobs * Fix requirements in tests jobs * Add matrix paramater to repository name to avoid concurrency issues * Remove matrix from public registry test * Fix name on requirements * Fix name on requirements * Add extra matrix and conditions * Simplify matrix behavior * Remove requirement * Use just one image * Fix repo name * Fix repo name * Update description of new parameter
1 parent 1d120cb commit f2ca76c

File tree

5 files changed

+36
-9
lines changed

5 files changed

+36
-9
lines changed

‎.circleci/test-deploy.yml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -252,17 +252,20 @@ workflows:
252252
- run:
253253
name: "Export NPM_TOKEN"
254254
command: echo 'export NPM_TOKEN="00000000-0000-0000-0000-000000000000"' >> "$BASH_ENV"
255-
name: integration-test-named-profile
255+
name: integration-test-named-profile-<<matrix.use_credentials_helper>>-helper
256256
auth:
257257
- aws-cli/setup:
258258
role_arn: arn:aws:iam::122211685980:role/CPE_ECR_OIDC_TEST
259259
profile_name: "OIDC-User"
260260
attach_workspace: true
261261
region: "us-west-2"
262262
profile_name: "OIDC-User"
263+
matrix:
264+
parameters:
265+
use_credentials_helper: [true, false]
263266
context: [CPE-OIDC]
264267
workspace_root: workspace
265-
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile
268+
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile-<<matrix.use_credentials_helper>>
266269
create_repo: true
267270
tag: integration,myECRRepoTag
268271
dockerfile: sample/Dockerfile
@@ -281,21 +284,21 @@ workflows:
281284
- aws-cli/setup:
282285
role_arn: arn:aws:iam::122211685980:role/CPE_ECR_OIDC_TEST
283286
profile_name: "OIDC-User"
284-
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile
287+
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile-true
285288
region: "us-west-2"
286289
profile_name: "OIDC-User"
287290
context: [CPE-OIDC]
288291
source_tag: integration
289292
target_tag: latest
290293
requires:
291-
- integration-test-named-profile
294+
- integration-test-named-profile-true-helper
292295
- tag-ecr-image:
293296
name: integration-test-tag-image-with-existing-tag
294297
auth:
295298
- aws-cli/setup:
296299
role_arn: arn:aws:iam::122211685980:role/CPE_ECR_OIDC_TEST
297300
profile_name: "OIDC-User"
298-
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile
301+
repo: aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile-true
299302
region: "us-west-2"
300303
profile_name: "OIDC-User"
301304
context: [CPE-OIDC]
@@ -305,7 +308,7 @@ workflows:
305308
post-steps:
306309
- run:
307310
name: "Delete repository"
308-
command: aws ecr delete-repository --repository-name aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile --force --profile OIDC-User
311+
command: aws ecr delete-repository --repository-name aws-ecr-orb-${CIRCLE_SHA1:0:7}-named-profile-true --force --profile OIDC-User
309312
filters: *filters
310313
requires:
311314
- integration-test-tag-existing-image
@@ -373,7 +376,7 @@ workflows:
373376
vcs_type: << pipeline.project.type >>
374377
pub_type: production
375378
enable_pr_comment: true
376-
requires: [ orb-tools/lint, orb-tools/review, orb-tools/pack, integration-test-default-profile, integration-test-pubic-registry, integration-test-skip_when_tags_exist-amd64, integration-test-skip_when_tags_exist-arm64, integration-test-named-profile, integration-test-tag-existing-image, integration-test-tag-image-with-existing-tag ]
379+
requires: [ orb-tools/lint, orb-tools/review, orb-tools/pack, integration-test-default-profile, integration-test-pubic-registry, integration-test-skip_when_tags_exist-amd64, integration-test-skip_when_tags_exist-arm64, integration-test-named-profile-true-helper, integration-test-named-profile-false-helper, integration-test-tag-existing-image, integration-test-tag-image-with-existing-tag ]
377380
github_token: GHI_TOKEN
378381
context: orb-publisher
379382
filters: *release-filters

‎src/commands/build_and_push_image.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,12 @@ parameters:
201201
The alias, key ID, or full ARN of the KMS key can be specified.
202202
default: ""
203203

204+
use_credentials_helper:
205+
type: boolean
206+
default: true
207+
description: >
208+
When true the authentication to docker registry will be done using the ecr-credential-helper. This avoids having
209+
the password saved in plain text. Otherwise it will use the classic docker login command which is more compatible.
204210
steps:
205211
- when:
206212
condition: <<parameters.checkout>>
@@ -230,6 +236,7 @@ steps:
230236
region: <<parameters.region>>
231237
account_id: <<parameters.account_id>>
232238
public_registry: <<parameters.public_registry>>
239+
use_credentials_helper: <<parameters.use_credentials_helper>>
233240
- when:
234241
condition: <<parameters.create_repo>>
235242
steps:

‎src/commands/ecr_login.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,14 @@ parameters:
3333
description: >
3434
AWS domain, China regions will require override.
3535
36+
use_credentials_helper:
37+
type: boolean
38+
default: true
39+
description: >
40+
When true the authentication to docker registry will be done using the ecr-credential-helper. This avoids having
41+
the password saved in plain text. Otherwise it will use the classic docker login command which is more compatible.
42+
If you are having issues with credentials helper login, set this to false.
43+
3644
steps:
3745
- run:
3846
name: Log into Amazon ECR with profile <<parameters.profile_name>>
@@ -42,5 +50,6 @@ steps:
4250
AWS_ECR_STR_REGION: <<parameters.region>>
4351
AWS_ECR_BOOL_PUBLIC_REGISTRY: <<parameters.public_registry>>
4452
AWS_ECR_STR_AWS_DOMAIN: <<parameters.aws_domain>>
53+
AWS_ECR_BOOL_HELPER: <<parameters.use_credentials_helper>>
4554
SCRIPT_UTILS: << include(scripts/utils.sh) >>
4655
command: <<include(scripts/ecr_login.sh)>>

‎src/jobs/build_and_push_image.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,12 @@ parameters:
206206
The AWS domain for your region, e.g in China, the AWS domain is amazonaws.com.cn
207207
The default value is amazonaws.com
208208
209+
use_credentials_helper:
210+
type: boolean
211+
default: true
212+
description: >
213+
When true the authentication to docker registry will be done using the ecr-credential-helper. This avoids having
214+
the password saved in plain text. Otherwise it will use the classic docker login command which is more compatible.
209215
210216
steps:
211217
- build_and_push_image:
@@ -240,4 +246,5 @@ steps:
240246
auth: <<parameters.auth>>
241247
repo_encryption_type: <<parameters.repo_encryption_type>>
242248
repo_encryption_kms_key: <<parameters.repo_encryption_kms_key>>
249+
use_credentials_helper: <<parameters.use_credentials_helper>>
243250
aws_domain: <<parameters.aws_domain>>

‎src/scripts/ecr_login.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ AWS_ECR_EVAL_PROFILE_NAME="$(eval echo "${AWS_ECR_STR_PROFILE_NAME}")"
44
AWS_ECR_EVAL_ACCOUNT_ID="$(eval echo "${AWS_ECR_STR_ACCOUNT_ID}")"
55
AWS_ECR_VAL_ACCOUNT_URL="${AWS_ECR_EVAL_ACCOUNT_ID}.dkr.ecr.${AWS_ECR_EVAL_REGION}.${AWS_ECR_STR_AWS_DOMAIN}"
66
AWS_ECR_EVAL_PUBLIC_REGISTRY_ALIAS="$(eval echo "${AWS_ECR_STR_PUBLIC_REGISTRY_ALIAS}")"
7+
AWS_ECR_BOOL_HELPER="$(eval echo "${AWS_ECR_BOOL_HELPER}")"
78
ECR_COMMAND="ecr"
89

910
eval "$SCRIPT_UTILS"
@@ -46,14 +47,14 @@ configure_config_json(){
4647

4748
install_aws_ecr_credential_helper(){
4849
echo "Installing AWS ECR Credential Helper..."
49-
if [[ "$SYS_ENV_PLATFORM" = "linux" ]]; then
50+
if [[ "$SYS_ENV_PLATFORM" = "linux" && "$AWS_ECR_BOOL_HELPER" = "1" ]]; then
5051
HELPER_INSTALLED=$(dpkg --get-selections | (grep amazon-ecr-credential-helper || test $?) | awk '{print $2}')
5152
if [[ "$HELPER_INSTALLED" != "install" ]]; then
5253
$SUDO apt update
5354
$SUDO apt install amazon-ecr-credential-helper
5455
fi
5556
configure_config_json
56-
elif [[ "$SYS_ENV_PLATFORM" = "macos" ]]; then
57+
elif [[ "$SYS_ENV_PLATFORM" = "macos" && "$AWS_ECR_BOOL_HELPER" = "1" ]]; then
5758
HELPER_INSTALLED=$(brew list -q | grep -q docker-credential-helper-ecr || test $?)
5859
if [[ "$HELPER_INSTALLED" -ne 0 ]]; then
5960
brew install docker-credential-helper-ecr

0 commit comments

Comments
 (0)