Docker 推送到 AWS ECR 问题

Question

几天来，我面临将图像从 jenkins 推送到 ECR 并重新启动服务的问题。

我的 Jenkins 实例通过 ECS 托管在 EC2 实例上。 （它也是作为 docker 镜像构建的）。

我想要做的是构建镜像，登录 ECR，将镜像推送到那里并重启服务。 登录 ECR 有问题：

1. 当我执行“取消设置 AWS_CONTAINER_CREDENTIALS_RELATIVE_URI”时，“aws ecr get-login --region us-east-1”命令成功，但推送图像因“无基本身份验证凭证”而停止。
2. 当我不调用“unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI”时，我什至无法登录 ECR。

我做了很多谷歌搜索和分析，但我找不到任何答案。 任何可能导致问题的想法？ 是 IAM 设置还是 ecs-agent 的东西？

用于运行 jenkins 任务的策略：

{
"Version": "2012-10-17",
"Statement": [
    {
        "Action": [
            "ecr:GetAuthorizationToken"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Sid": "GetAuthorizationToken"
    },
    {
        "Action": [
            "ecr:GetDownloadUrlForLayer",
            "ecr:BatchGetImage",
            "ecr:BatchCheckLayerAvailability",
            "ecr:PutImage",
            "ecr:InitiateLayerUpload",
            "ecr:UploadLayerPart",
            "ecr:CompleteLayerUpload"
        ],
        "Resource": [
            "arn:aws:ecr:*:*:repository/salesiq*",
            "arn:aws:ecr:*:*:repository/comhub*",
            "arn:aws:ecr:*:*:repository/ssrt*",
            "arn:aws:ecr:*:*:repository/reveal*",
            "arn:aws:ecr:*:*:repository/se-*"
        ],
        "Effect": "Allow",
        "Sid": "EcrManagement"
    },
    {
        "Condition": {
            "ArnLike": {
                "ecs:cluster": [
                    "arn:aws:ecs:*:*:cluster/salesiq*",
                    "arn:aws:ecs:*:*:cluster/comhub*",
                    "arn:aws:ecs:*:*:cluster/ssrt*",
                    "arn:aws:ecs:*:*:cluster/reveal*",
                    "arn:aws:ecs:*:*:cluster/se-*"
                ]
            }
        },
        "Action": [
            "ecs:RunTask",
            "ecs:StartTask",
            "ecs:StopTask",
            "ecs:DescribeClusters",
            "ecs:DescribeServices",
            "ecs:ListClusters",
            "ecs:DescribeContainerInstances",
            "ecs:StopTask"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Sid": "EcsManagement"
    },
    {
        "Action": [
            "ecs:List*",
            "ecs:Describe*",
            "ecr:Describe*",
            "ecr:Get*",
            "ecr:Describe*",
            "ecr:List*",
            "cloudwatch:Get*",
            "cloudwatch:List*",
            "cloudwatch:Describe*",
            "ecs:UpdateService"
        ],
        "Resource": "*",
        "Effect": "Allow",
        "Sid": "EcsListing"
    }
]

}

Answer 1

我认为您可能缺少的是命令docker login命令本身。 你的问题中没有提到。 所以你需要以下内容；

    aws ecr get-login --region region --no-include-email

然后你想执行上面命令的输出；

    docker login -u AWS -p password https://aws_account_id.dkr.ecr.us-east-1.amazonaws.com

或者你可以运行;

    $(aws ecr get-login --no-include-email --region eu-west-1)

进而

    docker push $ecr_repo:latest

我在管道中运行的 bash 脚本示例；

    #!/bin/bash
    set -ex

    # $branch: current git branch
    # $commit: hash of the current git commit
    # $ecr_repo: Self explanatory

    $(aws ecr get-login --no-include-email --region eu-west-1)
    docker pull $ecr_repo:latest
    docker build --cache-from $ecr_repo:latest -t image_name .
    docker tag image_name:latest $ecr_repo:$commit
    if [ "$branch" = "master" ]; then
      docker tag image_name:latest $ecr_repo:latest
      docker push $ecr_repo:latest
    fi
    docker push $ecr_repo:$commit

Answer 2

您是否使用其他个人资料？