Skip to content

Commit 0364b5a

Browse files
rshadershade
authored
Add initial Pulumi project for AWS ECR pull-through cache (#2100)
This pull request introduces a new Pulumi project that creates AWS Elastic Container Registry (ECR) repositories with pull-through cache rules for Docker Hub, GitHub Container Registry, and GitLab Container Registry. It also includes setup instructions and configurations for the project. ### Project Initialization and Configuration: * [`aws-ts-ecr-cache/Pulumi.yaml`](diffhunk://#diff-a745557901fbab53ab572ce1c8386eac78f2938a02d0edcf2dde50eb59a047d7R1-R10): Added Pulumi project configuration including project name, runtime, description, and configuration tags. * [`aws-ts-ecr-cache/package.json`](diffhunk://#diff-caefc680d6da27775466f9812511a3a3cda771c2d94a509a1049009680f0deb4R1-R13): Added Node.js project configuration with dependencies on Pulumi and AWS packages. * [`aws-ts-ecr-cache/tsconfig.json`](diffhunk://#diff-fe22e116c5c26f701888e5495232fb20be1af50e9dd2fd76ec530aa0c53c94caR1-R18): Added TypeScript configuration for strict type checking and output directory. ### Project Implementation: * [`aws-ts-ecr-cache/index.ts`](diffhunk://#diff-5a20ff1fa1d5b36b41a2698f8b3f6a31ac6c0547ebe9cb17740501030c5a860eR1-R96): Implemented the main Pulumi program to create ECR repositories and configure pull-through cache rules for Docker Hub, GitHub, and GitLab, as well as setting up AWS Secrets Manager secrets for storing credentials. ### Documentation: * [`aws-ts-ecr-cache/README.md`](diffhunk://#diff-ea52abe70da1aec9706c4e9952032ed8d74ae178f8f7e16a16a1061f7c5fea44R1-R100): Added comprehensive documentation for the project, including prerequisites, setup instructions, resources created, outputs, and cleanup steps. ### Miscellaneous: * [`aws-ts-ecr-cache/.gitignore`](diffhunk://#diff-42d0ee148e97aff005a18e68ce5404e6a41e350cf084e0976e0870536c5198bbR1-R3): Added `.gitignore` file to exclude `bin` and `node_modules` directories from version control.
1 parent 9dcd9b0 commit 0364b5a

File tree

6 files changed

+233
-0
lines changed

6 files changed

+233
-0
lines changed

‎aws-ts-ecr-cache/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
2+
/bin/
3+
/node_modules/

‎aws-ts-ecr-cache/Pulumi.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
name: aws-ts-ecr-cache
2+
runtime:
3+
name: nodejs
4+
options:
5+
packagemanager: yarn
6+
description: a Pulumi program that creates ECR repositories with pull-through cache rules for Docker Hub and Google Container Registry.

‎aws-ts-ecr-cache/README.md

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# AWS ECR Pull-Through Cache with Pulumi
2+
3+
[![Deploy this example with Pulumi](https://www.pulumi.com/images/deploy-with-pulumi/dark.svg)](https://app.pulumi.com/new?template=https://github.com/pulumi/examples/blob/master/aws-ts-ecr-cache/README.md#gh-light-mode-only)
4+
[![Deploy this example with Pulumi](https://get.pulumi.com/new/button-light.svg)](https://app.pulumi.com/new?template=https://github.com/pulumi/examples/blob/master/aws-ts-ecr-cache/README.md#gh-dark-mode-only)
5+
6+
This Pulumi project creates AWS Elastic Container Registry (ECR) repositories with pull-through cache rules for Docker Hub, GitHub Container Registry, and GitLab Container Registry. It also sets up AWS Secrets Manager secrets to store credentials for Docker Hub, GitHub, and GitLab.
7+
8+
## Prerequisites
9+
10+
- [Pulumi CLI](https://www.pulumi.com/docs/get-started/install/)
11+
- [Node.js](https://nodejs.org/)
12+
- [Yarn](https://yarnpkg.com/)
13+
- AWS account and credentials configured
14+
15+
## Project Structure
16+
17+
- `index.ts`: The main Pulumi program that defines the infrastructure.
18+
- `Pulumi.yaml`: The Pulumi project configuration file.
19+
- `tsconfig.json`: TypeScript configuration file.
20+
- `package.json`: Node.js project configuration file.
21+
- `.gitignore`: Git ignore file.
22+
23+
## Setup
24+
25+
1. Install dependencies:
26+
27+
```sh
28+
yarn install
29+
```
30+
31+
2. Configure Pulumi stack:
32+
33+
```sh
34+
pulumi config set aws:region <your-aws-region>
35+
```
36+
37+
### Docker Hub
38+
39+
> **Note**: To get your Docker Hub access token, log in to Docker Hub, navigate to [Account Settings](https://hub.docker.com/settings/security), and create a new access token.
40+
41+
```sh
42+
pulumi config set dockerHubUsername <your-docker-hub-username>
43+
pulumi config set --secret dockerHubAccessToken <your-docker-hub-access-token>
44+
```
45+
46+
### GitHub
47+
48+
> **Note**: To get your GitHub access token, log in to GitHub, navigate to [Developer settings](https://github.com/settings/tokens), and create a new personal access token with the `read:packages` scope.
49+
50+
```sh
51+
pulumi config set gitHubUsername <your-github-username>
52+
pulumi config set --secret gitHubAccessToken <your-github-access-token>
53+
```
54+
55+
### GitLab
56+
57+
> **Note**: To get your GitLab access token, log in to GitLab, navigate to [Access Tokens](https://gitlab.com/-/profile/personal_access_tokens), and create a new personal access token with the `read_registry` scope.
58+
59+
```sh
60+
pulumi config set gitLabUsername <your-gitlab-username>
61+
pulumi config set --secret gitLabAccessToken <your-gitlab-access-token>
62+
```
63+
64+
3. Deploy the stack:
65+
66+
```sh
67+
pulumi up
68+
```
69+
70+
## Resources Created
71+
72+
- **ECR Repositories**:
73+
- `pullThroughCacheECR`: ECR repository for pull-through cache.
74+
75+
- **Pull-Through Cache Rules**:
76+
- `dockerHubCacheRule`: Pull-through cache rule for Docker Hub (if `dockerHubUsername` is set).
77+
- `githubCacheRule`: Pull-through cache rule for GitHub Container Registry (if `gitHubUsername` is set).
78+
- `gitLabCacheRule`: Pull-through cache rule for GitLab Container Registry (if `gitLabUsername` is set).
79+
80+
- **Secrets Manager Secrets**:
81+
- `ecrPullThroughCacheDockerHubSecret`: Secret for Docker Hub credentials (if `dockerHubUsername` is set).
82+
- `ecrPullThroughCacheGitHubSecret`: Secret for GitHub credentials (if `gitHubUsername` is set).
83+
- `ecrPullThroughCacheGitLabSecret`: Secret for GitLab credentials (if `gitLabUsername` is set).
84+
85+
## Outputs
86+
87+
- `pullThroughCacheECRRepositoryUrl`: URL of the ECR repository.
88+
- `ecrRepositoryPrefixes`: Prefixes for the ECR repositories.
89+
90+
## Cleanup
91+
92+
To remove all resources created by this project:
93+
94+
```sh
95+
pulumi destroy
96+
```

‎aws-ts-ecr-cache/index.ts

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
// Copyright 2016-2025, Pulumi Corporation. All rights reserved.
2+
import * as aws from "@pulumi/aws";
3+
import * as pulumi from "@pulumi/pulumi";
4+
5+
const pulumiConfig = new pulumi.Config();
6+
const dockerHubUsername = pulumiConfig.get("dockerHubUsername");
7+
const gitHubUsername = pulumiConfig.get("gitHubUsername");
8+
const gitLabUsername = pulumiConfig.get("gitLabUsername");
9+
10+
// Create an ECR repository for Docker Hub
11+
const pullThroughCacheEcr = new aws.ecr.Repository("pullThroughCacheECR", {
12+
name: "pull-through-cache-ecr",
13+
});
14+
15+
if (dockerHubUsername) {
16+
// Create an AWS Secrets Manager secret for Docker Hub
17+
const ecrPullThroughCacheDockerHubSecret = new aws.secretsmanager.Secret("ecrPullThroughCacheDockerHubSecret", {
18+
name: "ecr-pullthroughcache/dockerHubSecret",
19+
recoveryWindowInDays: 0,
20+
});
21+
22+
const dockerHubSecretVersion = new aws.secretsmanager.SecretVersion("dockerHubSecretValue", {
23+
secretId: ecrPullThroughCacheDockerHubSecret.id,
24+
secretString: JSON.stringify({
25+
username: pulumiConfig.require("dockerHubUsername"),
26+
accessToken: pulumiConfig.requireSecret("dockerHubAccessToken"),
27+
}),
28+
});
29+
30+
// Create a pull-through cache rule for Docker Hub
31+
const dockerHubCacheRule = new aws.ecr.PullThroughCacheRule("dockerHubCacheRule", {
32+
ecrRepositoryPrefix: "docker-hub",
33+
upstreamRegistryUrl: "registry-1.docker.io",
34+
credentialArn: ecrPullThroughCacheDockerHubSecret.arn,
35+
}, { dependsOn: [pullThroughCacheEcr] });
36+
}
37+
38+
// Create a pull-through cache rule for Kubernetes registry
39+
const k8sCacheRule = new aws.ecr.PullThroughCacheRule("k8sCacheRule", {
40+
ecrRepositoryPrefix: "k8si0",
41+
upstreamRegistryUrl: "registry.k8s.io",
42+
}, { dependsOn: [pullThroughCacheEcr] });
43+
44+
if (gitHubUsername) {
45+
// Create an AWS Secrets Manager secret for GitHub
46+
const ecrPullThroughCacheGitHubSecret = new aws.secretsmanager.Secret("ecrPullThroughCacheGitHubSecret", {
47+
name: "ecr-pullthroughcache/githubSecret",
48+
recoveryWindowInDays: 0,
49+
});
50+
51+
const gitHubSecretVersion = new aws.secretsmanager.SecretVersion("gitHubSecretValue", {
52+
secretId: ecrPullThroughCacheGitHubSecret.id,
53+
secretString: JSON.stringify({
54+
username: pulumiConfig.require("gitHubUsername"),
55+
accessToken: pulumiConfig.requireSecret("gitHubAccessToken"),
56+
}),
57+
});
58+
59+
// Create a pull-through cache rule for GitHub Container Registry
60+
const githubCacheRule = new aws.ecr.PullThroughCacheRule("githubCacheRule", {
61+
ecrRepositoryPrefix: "github",
62+
upstreamRegistryUrl: "ghcr.io",
63+
credentialArn: ecrPullThroughCacheGitHubSecret.arn,
64+
}, { dependsOn: [pullThroughCacheEcr] });
65+
}
66+
67+
if (gitLabUsername) {
68+
// Create an AWS Secrets Manager secret for GitLab
69+
const ecrPullThroughCacheGitLabSecret = new aws.secretsmanager.Secret("ecrPullThroughCacheGitLabSecret", {
70+
name: "ecr-pullthroughcache/gitLabSecret",
71+
recoveryWindowInDays: 0,
72+
});
73+
74+
const gitLabSecretVersion = new aws.secretsmanager.SecretVersion("gitLabSecretValue", {
75+
secretId: ecrPullThroughCacheGitLabSecret.id,
76+
secretString: JSON.stringify({
77+
username: pulumiConfig.require("gitLabUsername"),
78+
accessToken: pulumiConfig.requireSecret("gitLabAccessToken"),
79+
}),
80+
});
81+
82+
// Create a pull-through cache rule for GitLab Container Registry
83+
const gitLabCacheRule = new aws.ecr.PullThroughCacheRule("gitLabCacheRule", {
84+
ecrRepositoryPrefix: "gitlab",
85+
upstreamRegistryUrl: "registry.gitlab.com",
86+
credentialArn: ecrPullThroughCacheGitLabSecret.arn,
87+
}, { dependsOn: [pullThroughCacheEcr] });
88+
}
89+
90+
// Export repository URLs
91+
export const pullThroughCacheECRRepositoryUrl = pullThroughCacheEcr.repositoryUrl;
92+
export const ecrRepositoryPrefixes = {
93+
dockerHub: dockerHubUsername ? "docker-hub" : undefined,
94+
k8s: k8sCacheRule.ecrRepositoryPrefix,
95+
github: gitHubUsername ? "github" : undefined,
96+
gitlab: gitLabUsername ? "gitlab" : undefined,
97+
};

‎aws-ts-ecr-cache/package.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"name": "aws-ts-ecr-cache",
3+
"description": "a Pulumi program that creates ECR repositories with pull-through cache rules for Docker Hub and Google Container Registry.",
4+
"main": "index.ts",
5+
"scripts": {
6+
"test": "echo \"Error: no test specified\" && exit 1"
7+
},
8+
"author": "",
9+
"dependencies": {
10+
"@pulumi/pulumi": "^3.157.0",
11+
"@pulumi/aws": "^6.73.0"
12+
}
13+
}

‎aws-ts-ecr-cache/tsconfig.json

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{
2+
"compilerOptions": {
3+
"strict": true,
4+
"outDir": "bin",
5+
"target": "es2016",
6+
"module": "commonjs",
7+
"moduleResolution": "node",
8+
"sourceMap": true,
9+
"experimentalDecorators": true,
10+
"pretty": true,
11+
"noFallthroughCasesInSwitch": true,
12+
"noImplicitReturns": true,
13+
"forceConsistentCasingInFileNames": true
14+
},
15+
"files": [
16+
"index.ts"
17+
]
18+
}

0 commit comments

Comments
 (0)