Auth into ECR in a Jenkinsfile so I can pull an image to run the build in?

Question

The situation here is that we have an app that's currently being built on a Jenkins slave with a certain version of node installed on it. We want to standardize the build environment, and so to do that want to build inside a docker container.

Through my research it definitely seems possible. However, the challenge for us is we want to use custom images we manage ourselves and store in ECR. We don't want to use the ones on docker hub. With that constraint in mind, I'm struggling to authenticate into our ECR within my Jenkinsfile. Ideally I could do something like this:

pipeline {
    agent {
        docker {
            image 'node:7'
            registryUrl 'ecr_url.amazonaws.com'
            registryCredentialsId 'ecr:us-east-1:iam_role'
        }
    }
    stages {
        stage('Build') {
            steps {
                sh 'command goes here'
            }
        }
    }
}

But the issue here is that our ECR login relies on running a shell command on the Jenkins worker (which has aws cli installed) to log in and access the image. So far I've had no luck authenticating within the Jenkinsfile so I can pull an image to run the build in. Does anyone know if this is possible and if so, how to edit the Jenkinsfile to do it?

Answer 1

You need Authorization token before pulling the image from ECR it's mean you also need to install AWS-CLI on Jenkins server. The best approach is to assign role and run the below command somewhere in your pipeline to get authorization token, if that seems complicated to you you can use ECR plugin below.

Your Docker client must authenticate to Amazon ECR registries as an AWS user before it can push and pull images. The AWS CLI get-login command provides you with authentication credentials to pass to Docker. For more information, see Registry Authentication.

AmazonECR-registry_auth

So you can use JENKINS/Amazon+ECR

Amazon ECR plugin implements a Docker Token producer to convert Amazon credentials to Jenkins’ API used by (mostly) all Docker-related plugins. Thank's to this producer, you can select your existing registered Amazon credentials for various Docker operations in Jenkins, for sample using CloudBees Docker Build and Publish plugin:

Normally we use this command to obtain token.

$(aws ecr get-login --no-include-email --region us-west-2)

with in pipline you can try

pipeline
{
    options
    {
        buildDiscarder(logRotator(numToKeepStr: '3'))
    }

    agent any
    environment 
    {
        PROJECT = 'tap_sample'
        ECRURL = 'http://999999999999.dkr.ecr.eu-central-1.amazonaws.com'
        ECRCRED = 'ecr:eu-central-1:tap_ecr'
    }
    stages
    {
        stage('Docker image pull')
        {
            steps
            {
                script
                {
                    sh("eval \$(aws ecr get-login --no-include-email | sed 's|https://||')")
                    docker.withRegistry(ECRURL, ECRCRED)
                    {
                        docker.image(PROJECT).pull()
                    }
                }
            }
        }
    }
}

Answer 2

You almost had it working. The trick to using it as an agent on the declarative pipeline is to create an AWS credential with empty Access_key and Secret but setting an IAM role on it.

pipeline {
    agent {
        docker { 
          image '<account-id>.dkr.ecr.eu-west-1.amazonaws.com/image/my-image:v1'
          args '--entrypoint= '
          registryCredentialsId "ecr:eu-west-1:aws-instance-role"
          registryUrl "https://<account-id>.dkr.ecr.eu-west-1.amazonaws.com"
        }
    }
    stages {
        stage('Test') {
            steps {
                sh "I'm on an ECR agent"
            }
        }
    }
}

Make sure that you can assume this role, you can an instance role that allows assuming itself. I've created a medium post describing this process on a cross-account ECR How to run Jenkins agents with cross-account ECR images using instance roles on EKS.

Answer 3

use aws pipeline steps. It allows for a ecrLogin() where you can specify registry ids if needed. https://plugins.jenkins.io/pipeline-aws/#plugin-content-ecrlogin