Skip to content

Commit 3ca516d

Browse files
antgoncjantgoncj
authored
Merge pull request #127 from antgoncj/feature/docker-image-build-test-and-release
Implemented Docker Image Build, Test, and Release Workflow
2 parents 6942d88 + 9220568 commit 3ca516d

21 files changed

+1203
-1
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
docker_image_resources/

‎.github/workflows/build_and_test_docker_image.yml‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
name: Build and Test Credential Helper Docker Image
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
7+
env:
8+
STAGING_REGISTRY: 264252446756.dkr.ecr.us-east-1.amazonaws.com
9+
STAGING_REPOSITORY: credential-helper-staging
10+
AWS_REGION: us-east-1
11+
12+
permissions:
13+
contents: read
14+
packages: write
15+
id-token: write # This is required for requesting the JWT for AWS authentication
16+
17+
jobs:
18+
build-and-push:
19+
name: Build Docker Images and Push to Staging Repository
20+
strategy:
21+
matrix:
22+
include:
23+
- os: ubuntu-24.04
24+
platform: amd64
25+
- os: ubuntu-24.04-arm
26+
platform: arm64
27+
runs-on: ${{ matrix.os }}
28+
29+
steps:
30+
- name: Checkout repository
31+
uses: actions/checkout@v4
32+
33+
- name: Configure AWS credentials
34+
uses: aws-actions/configure-aws-credentials@master
35+
with:
36+
role-to-assume: arn:aws:iam::264252446756:role/GithubActionsAccessRole
37+
aws-region: ${{ env.AWS_REGION }}
38+
39+
- name: Login to Amazon ECR
40+
id: login-ecr
41+
uses: aws-actions/amazon-ecr-login@v2
42+
43+
- name: Extract Version from Makefile
44+
id: extract-version
45+
run: |
46+
VERSION=$(grep '^VERSION=' Makefile | cut -d'=' -f2)
47+
echo "version=$VERSION" >> $GITHUB_OUTPUT
48+
echo "Extracted version: $VERSION"
49+
50+
- name: Build and Push Docker image
51+
uses: docker/build-push-action@v5
52+
with:
53+
context: .
54+
file: ./docker_image_resources/Dockerfile
55+
platforms: linux/${{ matrix.platform }}
56+
push: true
57+
build-args: |
58+
VERSION=${{ steps.extract-version.outputs.version }}
59+
tags: |
60+
${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-${{ matrix.platform }}
61+
provenance: false # provenance must be disabled in order to prevent manifest creation failures
62+
63+
test-and-scan:
64+
name: Test and Scan Docker Images
65+
needs: build-and-push
66+
strategy:
67+
matrix:
68+
include:
69+
- os: ubuntu-24.04
70+
platform: amd64
71+
- os: ubuntu-24.04-arm
72+
platform: arm64
73+
runs-on: ${{ matrix.os }}
74+
75+
steps:
76+
- name: Checkout Repository
77+
uses: actions/checkout@v4
78+
79+
- name: Configure AWS Credentials
80+
uses: aws-actions/configure-aws-credentials@master
81+
with:
82+
role-to-assume: arn:aws:iam::264252446756:role/GithubActionsAccessRole
83+
aws-region: ${{ env.AWS_REGION }}
84+
85+
- name: Login to Amazon ECR
86+
id: login-ecr
87+
uses: aws-actions/amazon-ecr-login@v2
88+
89+
- name: Set up Test Environment
90+
env:
91+
PCA_ARN: arn:aws:acm-pca:us-east-1:264252446756:certificate-authority/807cc589-2b5a-4976-a0d8-eeca654e7916
92+
run: |
93+
MAX_PULL_ATTEMPTS=3
94+
PULL_ATTEMPT=0
95+
until docker pull ${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-${{matrix.platform}}; do
96+
PULL_ATTEMPT=$((PULL_ATTEMPT + 1))
97+
if [ $PULL_ATTEMPT -ge $MAX_PULL_ATTEMPTS ]; then
98+
echo "Failed to pull image after $MAX_PULL_ATTEMPTS attempts"
99+
exit 1
100+
fi
101+
echo "Pull attempt $PULL_ATTEMPT failed, waiting before retry..."
102+
sleep 10
103+
done
104+
105+
echo "REPOSITORY=${{ env.STAGING_REPOSITORY }}" >> $GITHUB_ENV
106+
107+
mkdir -p docker_image_resources/tests/certs
108+
109+
./docker_image_resources/tests/scripts/setup-key-and-cert-pca.sh "$PCA_ARN"
110+
111+
- name: Test the ${{matrix.platform}} Docker Image
112+
env:
113+
TRUST_ANCHOR_ARN: arn:aws:rolesanywhere:us-east-1:264252446756:trust-anchor/11436419-d765-4a1f-a65e-441a197ed5fc
114+
PROFILE_ARN: arn:aws:rolesanywhere:us-east-1:264252446756:profile/24a0d47d-9e88-4be8-97fc-a55422105b6c
115+
ROLE_ARN: arn:aws:iam::264252446756:role/CredentialHelperTestingRole
116+
VERSION: ${{ github.sha }}-${{matrix.platform}}
117+
REGISTRY: ${{ env.STAGING_REGISTRY }} # Needed due to test suite using this variable
118+
run: |
119+
# Run basic version test
120+
echo "Testing version command:"
121+
docker run --rm ${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-${{matrix.platform}} version
122+
123+
# Run Integration Tests
124+
cd docker_image_resources
125+
./tests/run-tests.sh
126+
127+
- name: Install Trivy Image Scanner
128+
uses: aquasecurity/setup-trivy@v0.2.0
129+
with:
130+
cache: true
131+
version: v0.63.0
132+
133+
- name: Scan Docker image with Trivy
134+
run: |
135+
IMAGE_REFERENCE="${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-${{matrix.platform}}"
136+
./docker_image_resources/tests/scripts/scan-image.sh "$IMAGE_REFERENCE"

‎.github/workflows/publish_docker_image.yml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Publish Credential Helper Docker Image
2+
3+
on:
4+
push:
5+
tags: ['v*.*.*']
6+
workflow_dispatch: # Temporarily introduced for initial push to repo. Will be removed in a subsequent commit
7+
8+
jobs:
9+
publish-images-to-ecr:
10+
name: Publish Built Images to ECR
11+
runs-on: ubuntu-24.04
12+
permissions:
13+
contents: read
14+
id-token: write # This is required for requesting the JWT for AWS authentication
15+
env:
16+
PUBLIC_REGISTRY: public.ecr.aws/rolesanywhere
17+
PUBLIC_REPOSITORY: credential-helper
18+
STAGING_REGISTRY: 264252446756.dkr.ecr.us-east-1.amazonaws.com
19+
STAGING_REPOSITORY: credential-helper-staging
20+
AWS_REGION: us-east-1
21+
AWS_SIGNER_PLUGIN_LINK: https://d2hvyiie56hcat.cloudfront.net/linux/amd64/plugin/latest/notation-aws-signer-plugin.zip
22+
AWS_SIGNER_PLUGIN_FILENAME: notation-aws-signer-plugin.zip
23+
steps:
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v3
26+
27+
- name: Configure AWS credentials
28+
uses: aws-actions/configure-aws-credentials@master
29+
with:
30+
role-to-assume: arn:aws:iam::264252446756:role/GithubActionsAccessRole
31+
aws-region: ${{ env.AWS_REGION }}
32+
33+
- name: Login to Amazon ECR
34+
id: login-ecr
35+
uses: aws-actions/amazon-ecr-login@v2
36+
37+
- name: Tag Images and Push to ECR
38+
id: tag_and_push
39+
run: |
40+
AMD64_DOCKER_IMAGE="${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-amd64"
41+
ARM64_DOCKER_IMAGE="${{ env.STAGING_REGISTRY }}/${{ env.STAGING_REPOSITORY }}:${{ github.sha }}-arm64"
42+
docker pull $AMD64_DOCKER_IMAGE
43+
docker pull $ARM64_DOCKER_IMAGE
44+
# extract version from executable
45+
VERSION=$(docker run --rm $AMD64_DOCKER_IMAGE version)
46+
TIMESTAMP=$(date +%Y.%m.%d.%H.%M)
47+
docker tag $AMD64_DOCKER_IMAGE ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:$VERSION-amd64-$TIMESTAMP
48+
docker tag $AMD64_DOCKER_IMAGE ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest-amd64
49+
docker push ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:$VERSION-amd64-$TIMESTAMP
50+
AMD64_IMAGE_SHA=$(docker push ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest-amd64 | grep digest | cut -d' ' -f3 )
51+
echo "amd64_image_sha=$AMD64_IMAGE_SHA" >> "$GITHUB_OUTPUT"
52+
docker tag $ARM64_DOCKER_IMAGE ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:$VERSION-arm64-$TIMESTAMP
53+
docker tag $ARM64_DOCKER_IMAGE ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest-arm64
54+
docker push ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:$VERSION-arm64-$TIMESTAMP
55+
ARM64_IMAGE_SHA=$(docker push ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest-arm64 | grep digest | cut -d' ' -f3 )
56+
echo "arm64_image_sha=$ARM64_IMAGE_SHA" >> "$GITHUB_OUTPUT"
57+
docker manifest create ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest \
58+
${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}@$AMD64_IMAGE_SHA \
59+
${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}@$ARM64_IMAGE_SHA
60+
echo "manifest_sha=$(docker manifest push ${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}:latest)" >> "$GITHUB_OUTPUT"
61+
62+
- name: Setup Notation CLI
63+
uses: notaryproject/notation-action/setup@v1
64+
65+
- name: Retrieve AWS Signer Checksum Value
66+
id: checksum
67+
run: |
68+
curl -LO ${{ env.AWS_SIGNER_PLUGIN_LINK}}
69+
echo "signer_sha=$(sha256sum ${{env.AWS_SIGNER_PLUGIN_FILENAME}} | cut -f1 -d' ')" >> "$GITHUB_OUTPUT"
70+
71+
- name: Sign the Images and Manifest with Notation
72+
uses: notaryproject/notation-action/sign@v1
73+
with:
74+
plugin_name: com.amazonaws.signer.notation.plugin
75+
plugin_url: https://d2hvyiie56hcat.cloudfront.net/linux/amd64/plugin/latest/notation-aws-signer-plugin.zip
76+
plugin_checksum: ${{steps.checksum.outputs.signer_sha}} # Required in order to use the AWS signer plugin
77+
key_id: arn:aws:signer:us-east-1:264252446756:/signing-profiles/IAM_ROLES_ANYWHERE_SIGNING_PROFILE_V1_0
78+
target_artifact_reference: |-
79+
${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}@${{steps.tag_and_push.outputs.manifest_sha}}
80+
${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}@${{steps.tag_and_push.outputs.amd64_image_sha}}
81+
${{ env.PUBLIC_REGISTRY }}/${{ env.PUBLIC_REPOSITORY }}@${{steps.tag_and_push.outputs.arm64_image_sha}}

‎.semgrepignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
# Invalid RSA key for testing
22
tst/certs/invalid-rsa-key.pem
3+
# Do not factor in testing image templates since they are not meant for a privileged environment
4+
docker_image_resources/tests/pod_configurations

‎Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
VERSION=1.7.0
2-
2+
# IMPORTANT: This VERSION variable is parsed by the GitHub Actions image build workflow.
3+
# Please maintain the X.Y.Z format to ensure compatibility with the automated build process.
34
.PHONY: release
45
release: build/bin/aws_signing_helper
56

‎docker_image_resources/.env.template‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# This file provides a template for defining environment variables to
2+
# customize the build and test process of the credential helper docker image
3+
4+
# Image Property Components
5+
# These are NOT required and DO have defaults
6+
VERSION= # Docker image version tag
7+
REGISTRY= # Docker registry
8+
REPOSITORY= # Docker image repository
9+
10+
# Test Resource ARNs
11+
# These ARE required and do NOT have defaults
12+
TRUST_ANCHOR_ARN= # Format: arn:<partition>:rolesanywhere:<region>:<accountId>:trust-anchor/id
13+
PROFILE_ARN= # Format: arn:<partition>:rolesanywhere:<region>:<accountId>:profile/id
14+
ROLE_ARN= # Format: arn:<partition>:iam::<accountId>:role/role-name
15+
16+
# PKI Resource Paths
17+
# These ARE required and DO have defaults
18+
# Ideally these files can be placed in the tests/certs directory
19+
CERTIFICATE_PATH= # Format: path/to/certificate.pem
20+
PRIVATE_KEY_PATH= # Format: path/to/private_key.pem

‎docker_image_resources/Dockerfile‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
# Stage 1: Build the IAM Roles Anywhere Credential Helper from source
2+
# Version pinned to most recent stable release
3+
FROM --platform=$TARGETPLATFORM public.ecr.aws/amazonlinux/amazonlinux:2023.7.20250527.1 AS builder
4+
5+
# Add build arguments
6+
ARG TARGETARCH
7+
ARG VERSION
8+
9+
# Install build dependencies
10+
RUN dnf install -y \
11+
golang-1.24.3-1.amzn2023.0.1 \
12+
make \
13+
&& dnf clean all
14+
15+
# Set up working directory
16+
WORKDIR /build/rolesanywhere-credential-helper
17+
18+
# Set GOARCH for cross-compilation
19+
ENV CGO_ENABLED=1
20+
ENV GOOS=linux
21+
ENV GOARCH=${TARGETARCH}
22+
23+
COPY .. .
24+
25+
# Build with architecture-specific settings
26+
RUN make release
27+
28+
# Stage 2: Create a minimal runtime image
29+
# Version pinned to most recent stable release
30+
FROM --platform=$TARGETPLATFORM public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-glibc:2025-06-11-1749625329.2023
31+
32+
# Add build argument for version in final stage
33+
ARG VERSION
34+
35+
# Copy the credential helper from the builder stage
36+
COPY --from=builder /build/rolesanywhere-credential-helper/build/bin/aws_signing_helper /usr/local/bin/
37+
38+
USER 65532:65532
39+
40+
# Set the entrypoint
41+
ENTRYPOINT ["/usr/local/bin/aws_signing_helper"]
42+
43+
# Add labels
44+
LABEL maintainer="AWS IAM Roles Anywhere" \
45+
version="${VERSION}" \
46+
description="AWS IAM Roles Anywhere Credential Helper Docker Image"

0 commit comments

Comments
 (0)