AWS ECR login to push docker image built using declarative syntax

Author: mramanathan

declarative-examples/simple-examples/dockerAWSECRLogin.groovy

@@ -0,0 +1,86 @@
+pipeline {
+    agent {
+        label 'docker-node-name'
+    }
+
+    options {
+        timestamps()
+    }
+
+    environment {
+        PROD_IMAGE = "myapp-prod"
+        STAGE_IMAGE = "myapp-stage"
+        // common section in the URL to the ECR that's part of AWS' ECS
+        ECR_URI = 'dkr.ecr.us-west-2.amazonaws.com'
+    }
+
+    parameters {
+        choice(
+            name: 'environ',
+            choices: "STAGE\nPROD",
+            description: 'Environment for which the Docker image should be built.'
+            )
+        string(
+            name: 'VERSION',
+            defaultValue: 'v3.1',
+            description: 'Supply the version that will be used to tag the image.'
+            )
+    }
+
+    stages {
+        stage('Git-Prep') {
+            steps {
+                script {
+                    // Extract first 9 digits of Git commit's SHA-1 id
+                    env.GIT_HASH = sh(returnStdout: true,
+                                        script: "git rev-parse --verify HEAD --short=9"
+                                    ).trim()
+                }
+            }
+        }
+        stage('Build-Tag-Push') {
+            steps {
+                script {
+                    docker_image = docker.build("${PROD_IMAGE}")
+                    println "newly built image, " + docker_image.id
+                    // Use boto3 Python module to extract service account's id which
+                    // is represented as numerical digits.
+                    sh "python <custom-python-script-to-extract-service-account-id> "
+                    // Assuption: Python script that's executed using the 'sh' step in
+                    // line 48, creates a file, 'service_account.txt' that contains the
+                    // id of the service account in AWS.
+                    env.AWS_ACCOUNT = readFile("service_account.txt").trim()
+                    /*
+                        with docker v17 and above, email option should be off for docker login
+                        https://github.com/aws/aws-cli/blob/9417311ddf284eaa02155aff850dd90b3e5d2c43/awscli/customizations/ecr.py#L53
+                        https://docs.aws.amazon.com/cli/latest/reference/ecr/get-login.html
+                    */
+                    // Assumptions & Requirements:
+                    // 1. Build node should have AWS CLI installed.
+                    // 2. AWS' service account has sufficient permissions to upload images to ECR
+                    // 3. Image registry should have been setup using the service account as per line 48.
+                    // For cross account policies, see AWS documentation on IAM, ECS.
+                    // Below threads have useful info on why 'eval' should be used,
+                    // https://stackoverflow.com/questions/43733396/jenkins-amazon-ecr-no-basic-auth-credentials
+                    // http://www.tikalk.com/devops/ecr-in-pipeline/
+                    sh "eval \$(aws ecr get-login --region us-west-2 --no-include-email --registry-ids ${env.AWS_ACCOUNT} | sed 's|https://||')"
+                    env.REGISTRY = "https://" + "${env.AWS_ACCOUNT}" + "." + "${env.ECR_URI}"
+                    docker.withRegistry("${env.REGISTRY}") { // without withRegistry usage, push refers to docker.io
+                        docker_image.push("${GIT_HASH}")
+                        docker_image.push("${params.VERSION}")
+                        docker_image.push("latest")
+                    }
+                    // If the same pipeline is used to build images for both PROD and STAGE
+                    // then, this can be handy to visually represent which build job was
+                    // executed to build image for which environment i.e. STAGE or PROD.
+                    currentBuild.displayName = "${env.BUILD_NUMBER}" + "-" + params.environ + "-" + params.VERSION + "-" + "${env.GIT_HASH}"
+                }
+            }
+        }
+    }
+    post {
+        always {
+            cleanWs()
+        }
+    }
+}