Merge pull request #845 from snyk/feat/add-ecr-cred-helper

feat: add ecr-credential-helper to image

Author: chen-keinan

Dockerfile

@@ -1,5 +1,5 @@
 #---------------------------------------------------------------------
-# STAGE 1: Build skopeo inside a temporary container
+# STAGE 1: Build skopeo and ecr-credentials-helper inside a temporary container
 #---------------------------------------------------------------------
 FROM fedora:32 AS skopeo-build
 
@@ -10,6 +10,9 @@ RUN cd $GOPATH/src/github.com/containers/skopeo \
   && make bin/skopeo DISABLE_CGO=1 \
   && make install
 
+RUN go get -u github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login
+RUN cp $HOME/go/bin/docker-credential-ecr-login /usr/local/bin/docker-credential-ecr-login
+
 #---------------------------------------------------------------------
 # STAGE 2: Build the kubernetes-monitor
 #---------------------------------------------------------------------
@@ -43,6 +46,7 @@ RUN rm /install.sh
 WORKDIR /srv/app
 
 COPY --chown=snyk:snyk --from=skopeo-build /usr/local/bin/skopeo /usr/bin/skopeo
+COPY --chown=snyk:snyk --from=skopeo-build /usr/local/bin/docker-credential-ecr-login /usr/bin/docker-credential-ecr-login
 COPY --chown=snyk:snyk --from=skopeo-build /etc/containers/registries.d/default.yaml /etc/containers/registries.d/default.yaml
 COPY --chown=snyk:snyk --from=skopeo-build /etc/containers/policy.json /etc/containers/policy.json
 

snyk-monitor/README.md

@@ -54,6 +54,22 @@ Create a file named `dockercfg.json`. Store your `dockercfg` in there; it should
     "eu.gcr.io": "gcloud",
     "staging-k8s.gcr.io": "gcloud"
   }
+  
+  // If your cluster runs on EKS and you are using ECR, add the following:
+  {
+	"credsStore": "ecr-login"
+  }
+  
+  With Docker 1.13.0 or greater, you can configure Docker to use different credential helpers for different registries.
+  To use this credential helper for a specific ECR registry, create a credHelpers section with the URI of your ECR registry:
+  
+  {
+	"credHelpers": {
+		"public.ecr.aws": "ecr-login",
+		"<aws_account_id>.dkr.ecr.<region>.amazonaws.com": "ecr-login"
+	}
+  }
+
 }
 ```
 Finally, create the secret in Kubernetes by running the following command: