From 8d3731a9840dfea3b8aef195483b781fb92cd4e5 Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Wed, 2 May 2018 16:56:14 -0400 Subject: [PATCH 1/2] Add credential helper and docs for pushing to Amazon ECR --- README.md | 52 ++++++++++++++++++++++++++++++++++++++++++++++- deploy/Dockerfile | 5 +++++ 2 files changed, 56 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index a2c5b24f1b..a3e72db2c2 100644 --- a/README.md +++ b/README.md @@ -142,8 +142,58 @@ To run kaniko in Docker, run the following command: kaniko uses Docker credential helpers to push images to a registry. -kaniko comes with support for GCR, but configuring another credential helper should allow pushing to a different registry. +kaniko comes with support for GCR and Amazon ECR, but configuring another credential helper should allow pushing to a different registry. + +#### Pushing to Amazon ECR +The Amazon ECR [credential helper](https://github.com/awslabs/amazon-ecr-credential-helper) is built in to the kaniko executor image. +To configure credentials, you will need to do the following: +1. Update the `credHelpers` section of [config.json](https://github.com/GoogleContainerTools/kaniko/blob/master/files/config.json) with the specific URI of your ECR registry: +```json +{ + "credHelpers": { + "aws_account_id.dkr.ecr.region.amazonaws.com": "ecr-login" + } +} +``` +You can mount in the new config as a configMap: +```shell +kubectl create configmap docker-config --from-file= +``` +2. Create a Kubernetes secret for your `~/.aws/credentials` file so that credentials can be accessed within the cluster. +To create the secret, run: + +```shell +kubectl create secret generic aws-secret --from-file= +``` + +The Kubernetes Pod spec should look similar to this, with the args parameters filled in: +```yaml +apiVersion: v1 +kind: Pod +metadata: + name: kaniko +spec: + containers: + - name: kaniko + image: gcr.io/kaniko-project/executor:latest + args: ["--dockerfile=", + "--context=", + "--destination="] + volumeMounts: + - name: aws-secret + mountPath: /root/.aws/ + - name: docker-config + mountPath: /root/.docker/ + restartPolicy: Never + volumes: + - name: aws-secret + secret: + secretName: aws-secret + - name: docker-config + configMap: + name: docker-config +``` ### Debug Image We provide `gcr.io/kaniko-project/executor:debug` as a a version of the executor image based off a Debian image. diff --git a/deploy/Dockerfile b/deploy/Dockerfile index 1b93031bd4..c5863c3402 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -21,10 +21,15 @@ RUN make WORKDIR /usr/local/bin ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz . RUN tar -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz +# Get Amazon ECR credential helper +RUN go get -u github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login +WORKDIR /go/src/github.com/awslabs/amazon-ecr-credential-helper +RUN make linux-amd64 FROM scratch COPY --from=0 /go/src/github.com/GoogleContainerTools/kaniko/out/executor /kaniko/executor COPY --from=0 /usr/local/bin/docker-credential-gcr /usr/local/bin/docker-credential-gcr +COPY --from=0 /go/src/github.com/awslabs/amazon-ecr-credential-helper/bin/linux-amd64/ /usr/local/bin/ COPY files/ca-certificates.crt /kaniko/ssl/certs/ COPY files/config.json /root/.docker/ RUN ["docker-credential-gcr", "config", "--token-source=env"] From 26b8e01697ab926c2cdb6739b56f8e6eb20ef97e Mon Sep 17 00:00:00 2001 From: Priya Wadhwa Date: Thu, 3 May 2018 11:19:02 -0400 Subject: [PATCH 2/2] Remove workdir --- deploy/Dockerfile | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/deploy/Dockerfile b/deploy/Dockerfile index c5863c3402..823b3a9414 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -18,13 +18,12 @@ FROM golang:1.10 WORKDIR /go/src/github.com/GoogleContainerTools/kaniko COPY . . RUN make -WORKDIR /usr/local/bin -ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz . -RUN tar -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz +# Get GCR credential helper +ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz /usr/local/bin/ +RUN tar -C /usr/local/bin/ -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz # Get Amazon ECR credential helper RUN go get -u github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login -WORKDIR /go/src/github.com/awslabs/amazon-ecr-credential-helper -RUN make linux-amd64 +RUN make -C /go/src/github.com/awslabs/amazon-ecr-credential-helper linux-amd64 FROM scratch COPY --from=0 /go/src/github.com/GoogleContainerTools/kaniko/out/executor /kaniko/executor