如何从 Gitlab CI 登录 AWS ECR 以下载 Docker 映像

Question

I am using Gitlab pipeline. The runner is hosted in Gitlab.

To decrease built time, I built a custom image which contains Maven dependencies. So, maven dependencies are not downloaded from internet during each build.

I pushed my custom image to AWS ECR. But Gitlab CI is unable to download this image.

Here is the error log:

Running with gitlab-runner 14.3.0-rc1 (ed15bfbf)
  on docker-auto-scale z3WU8uu-

Preparing the "docker+machine" executor
Using Docker executor with image ***.dkr.ecr.eu-west-1.amazonaws.com/***:latest ...
Pulling docker image 301768173512.dkr.ecr.eu-west-1.amazonaws.com/inuka-ci:latest ...
WARNING: Failed to pull image with policy "always": Error response from daemon: Get https://301768173512.dkr.ecr.eu-west-1.amazonaws.com/v2/inuka-ci/manifests/latest: no basic auth credentials (manager.go:214:0s)
ERROR: Job failed (system failure): failed to pull image "301768173512.dkr.ecr.eu-west-1.amazonaws.com/inuka-ci:latest" with specified policies [always]: Error response from daemon: Get https://301768173512.dkr.ecr.eu-west-1.amazonaws.com/v2/inuka-ci/manifests/latest: no basic auth credentials (manager.go:214:0s)

Since pipeline is triggered by Gitlab CI, I am unable to execute a docker login command before pipeline starts.

How can I make my gitlab pipeline login to AWS ECR before pipeline starts?

Answer 1

Edited answer, I've previously misread the question:

create an IAM user with at least read-only access to ECR and set these environment variables: AWS_ACCESS_KEY_ID , AWS_SECRET_ACCESS_KEY , AWS_DEFAULT_REGION .

Before being able to pull images from ECR you need to obtain a token using the AWS cli. One way to provide auth credentials to ECR is to define a variable called DOCKER_AUTH_CONFIG . Which has the following structure:

{
    "auths": {
        "myregistryurl.com": {
            "auth": "base64(username:password)"
        }
    }
}

You need to define a step like this in another pipeline as the main pipeline needs the token upon launch:

aws_token:
  image: 
    name: amazon/aws-cli
    entrypoint: [""]
  script:
    - USER=AWS
    - TOKEN=$(aws ecr get-login-password)
    - AUTH=$(echo "$USER:$TOKEN" | base64 | tr -d "\n")
    - echo $AUTH

Take the value displayed in the logs and put it in the main pipeline as the value of the variabile DOCKER_AUTH_CONFIG . In this way, the next run of the pipeline will pull correctly the image.

Notice that this token expires after 12 hours, when that times expires you will need to launch again this job.