使用Gradle插件将Docker映像推送到ECR

Question

I am using gradle-docker-plugin to build and push docker images to Amazon's ECR. To do this I am also using a remote docker daemon running on an EC2 instance. I have configured a custom task EcrLoginTask to fetch the ECR authorization token using aws-java-sdk-ecr library. Relevant code looks like : -

class EcrLoginTask extends DefaultTask {
    String accessKey
    String secretCode
    String region
    String registryId

    @TaskAction
    String getPassword() {
        AmazonECR ecrClient = AmazonECRClient.builder()
                .withRegion(Regions.fromName(region))
                .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretCode))).build()
        GetAuthorizationTokenResult authorizationToken = ecrClient.getAuthorizationToken(
                new GetAuthorizationTokenRequest().withRegistryIds(registryId))
        String token = authorizationToken.getAuthorizationData().get(0).getAuthorizationToken()
        System.setProperty("DOCKER_PASS", token) // Will this work ?
        return token
    }

}

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'com.amazonaws:aws-java-sdk-ecr:1.11.244'
        classpath 'com.bmuschko:gradle-docker-plugin:3.2.1'
    }
}



docker {
    url = "tcp://remote-docker-host:2375"
    registryCredentials {
        username = 'AWS'
        password = System.getProperty("DOCKER_PASS")    // Need to provide at runtime !!!
        url = 'https://123456789123.dkr.ecr.eu-west-1.amazonaws.com'
    }
}

task getECRPassword(type: EcrLoginTask) {
    accessKey AWS_KEY
    secretCode AWS_SECRET
    region AWS_REGION
    registryId '139539380579'
}

task dbuild(type: DockerBuildImage) {
    dependsOn build
    inputDir = file(".")
    tag "139539380579.dkr.ecr.eu-west-1.amazonaws.com/n6duplicator"
}

task dpush(type: DockerPushImage) {
    dependsOn dbuild, getECRPassword
    imageName "123456789123.dkr.ecr.eu-west-1.amazonaws.com/n6duplicator"
}

The remote docker connection works fine, ECR token is also fetched successfully and the dbuild task also gets executed successfully.

PROBLEM

The dpush task fails - "Could not push image: no basic auth credentials"

I believe this is because the authorization token received using the EcrLoginTask was not passed on to in the docker configuration closure password property.

How do I fix it ? I need to provide the credentials on the fly each time the build is executed.

Answer 1

Have a look at the ' gradle-aws-ecr-plugin '. It's able to get a fresh (latest) Amazon ECR docker registry token, during every AWS/Docker command call:

All Docker tasks such as DockerPullImage, DockerPushImage, etc. that are configured with the ECR registry URL will get a temporary ECR token. No further configuration is necessary. It is possible to set the registry URL for individual tasks.

This should work well alongside either the gradle-docker-plugin or Netflix's nebula-docker-plugin , which is also based on, and extends, the 'bmuschko' docker plugin.

The ' gradle-aws-ecr-plugin ' BitBucket homepage explains concisely how to configure both the AWS and ECR [URL] credentials.