Jenkins pipeline Docker agent from AWS ECR

Question

I need to execute Jenkins pipeline in Docker as an agent,

Docker image is located in AWS ECR,

How can I auth over AWS ECR to pull image for agent?

Sourabh · Answer 1 · 2020-04-29T04:22:42.777

agent {
  docker {
    alwaysPull true
    image '<aws-account-Id>.dkr.ecr.us-west-2.amazonaws.com/<ecr-repo>:<tag>'
    registryUrl 'https://<aws-account-Id>.dkr.ecr.us-west-2.amazonaws.com'
    registryCredentialsId 'ecr:us-west-2:<Jenkins Credential ID>'
  }
}

To use image from AWS ECR repo as agent in jenkins first you need to Add Credentials of Kind AWS Credentials. Now just use above code to in agent block in your pipeline code. Make sure to replace

<aws-account> with AWS Account Id.
<ecr-repo> with the ECR repo name
<tag> with ECR image tag you want to use.
<Jenkins Credential ID> with Jenkins credentials Id you got when you save the credentials in Jenkins.
us-west-2 replace with your ecr repo region

You can use https://<jenkins.url>/directive-generator/ to get this code generated for you.

score 2 · Answer 2 · answered Jan 31 '20 at 04:24

You can try this:

    agent { 
        docker { 
            label "buildDockerNode"
            image "nodejs10-test-v1"
            alwaysPull true
            registryUrl "*aws_account_id*.dkr.ecr.us-west-2.amazonaws.com/*project*"
            registryCredentialsId "ecr:us-west-2:*cred_id*"
        }
    }

score 1 · Accepted Answer · answered Jan 16 '20 at 19:03

1

According to this page https://aws.amazon.com/blogs/compute/authenticating-amazon-ecr-repositories-for-docker-cli-with-credential-helper/ something like the following should work:

sh """#!/bin/bash
      docker login -u=${USER} -p=${PASS} https://aws_account_id.dkr.ecr.us-east-1.amazonaws.com
"""

answered Jan 16 '20 at 19:03

Mzzl

3,926
28
39

1

I'm relatively new to Jenkins pipelines, but, if this is the chosen solution, I'm curious to know where this fits into a pipeline in order to then leverage a Docker-based `agent` as both minhluantran017 and Sourabh have described in their answers. – Brian T. Grant Sep 02 '20 at 21:39

score 1 · Answer 4 · answered Jan 21 '20 at 13:42

Means you need to Authorization token before pulling the image from ECR it's mean you also need to install AWS-CLI on Jenkins server. The best way is to assign role and run the below command in your pipeline to get authorization token, if it is complicated then use ECR plugin below.

Before it can push and pull images Docker client must authenticate to Amazon ECR registries as an AWS user. The AWS CLI get-login command provides you with authentication credentials to pass to Docker. For more information, see Registry Authentication. use JENKINS/Amazon+ECR

Note: For create token automatically based on AWS registery or you can run in jenkins file this command before pull

$(aws ecr get-login --no-include-email --region us-west-2)

And for go need to execute Jenkins pipeline in Docker as an agent Prefer this link.

Jenkins pipeline Docker agent from AWS ECR

4 Answers4