Push to ECR from Jenkins pipeline

Question

I have Jenkins server on-preminse. I have Jenkins file which create Docker image now i want to push that image to AWS ECR.Do i have to create a special IAM user and provide its access and secret access keys ? Or what will be the best way to do this.

I found below on internet

  withAWS(role:'Jenkins', roleAccount:'XXXX216610',duration: 900, roleSessionName: 'jenkinssession')
  sh ' eval \$(aws ecr get-login --no-include-email --region us-east-2) '

But as my jenkins server is onprem how role will work ?

Answer 1

Instead of eval, you now can use the Jenkins ‘amazon-ecr’ plugin from https://plugins.jenkins.io/amazon-ecr/ for ECR deployments.

pipeline {
  environment {
    registry = '1111111111111.dkr.ecr.eu-central-1.amazonaws.com/myRepo'
    registryCredential = 'ID_OF_MY_AWS_JENKINS_CREDENTIAL'
    dockerImage = ''
  }
  agent any
  stages {
    stage('Building image') {
      steps{
        script {
          dockerImage = docker.build registry + ":$BUILD_NUMBER"
        }
      }
    }
    stage('Deploy image') {
        steps{
            script{
                docker.withRegistry("https://" + registry, "ecr:eu-central-1:" + registryCredential) {
                    dockerImage.push()
                }
            }
        }
    }
  }
}

Answer 2

Do i have to create a special IAM user and provide its access and secret access keys ? Or what will be the best way to do this.

If you are running Jenkins inside your AWS and you using the secret key and access key you are violating best practice. You should never use the access key and secret key inside AWS VPC. These are designed to interact with AWS from outside of AWS account.

You should create an IAM role which has specific role and that role allow Jenkins only to push the image to ECR.

As far your current command, eval \$(aws ecr get-login --no-include-email --region us-east-2) you will always need this token to push/pull the image to ECR, this token has some expiry, you should read about this approach below. But it seems okay with IAM role.

ECR_AWSCLI-get-login-token

Also you can explore Amazon+ECR-plugin

About

Amazon ECR plugin implements a Docker Token producer to convert Amazon credentials to Jenkins’ API used by (mostly) all Docker-related plugins. Thank's to this producer, you can select your existing registered Amazon credentials for various Docker operations in Jenkins, for sample using CloudBees Docker Build and Publish plugin:

Answer 3

It's possible, but very subtle to debug, so make sure you follow the steps below.

1. Use dockerfile agent in jenkins pipeline (You can name it Dockerfile.jenkins or something else you prefer) and install amazon ecr credential helper in it to get a clean and stable building environment.

FROM ubuntu:rolling

RUN apt-get update && apt-get install -y amazon-ecr-credential-helper

2. Create a config.json file in your git repo, like .docker/config.json.

{
    "credHelpers": {
        "[YOUR_ACCOUNT_ID].dkr.ecr.[YOUR_REGION].amazonaws.com": "ecr-login"
    }
}

3. Test docker pull in your Jenkinsfile, make sure your access key's user is enabled with the right policy (probably AmazonEC2ContainerRegistryFullAccess).

pipeline {
    agent {
        dockerfile {
            filename 'Dockerfile.jenkins'
        }
    }
    stages {
        stage('TEST ECR') {
            steps {
                script { 
                    sh "DOCKER_CONFIG=.docker AWS_ACCESS_KEY_ID=[YOUR_ACCESS_KEY_ID] AWS_SECRET_ACCESS_KEY=[YOUR_SECRET_KEY] docker pull [YOUR PRIVATE IMAGE]"

                    // docker.build("${tag}", "${DOCKER_BUILD_ARGS} -f Dockerfile .")
                    // sh "docker push ${tag}"
                }
            }
        }
    }
}

If it's okay to pull, then you can just change DOCKER_CONFIG=.docker AWS_ACCESS_KEY_ID=[YOUR_ACCESS_KEY_ID] AWS_SECRET_ACCESS_KEY=[YOUR_SECRET_KEY] docker pull [YOUR PRIVATE IMAGE] to docker push [YOUR IMAGE] under correct environment variable settings.

Your repo would seem:

.
├── .docker
│   └── config.json
├── Dockerfile
└── Dockerfile.jenkins

Answer 4

I don't think that there is an easy way to assume a role from on-premise servers. As you mentioned, you will need to setup an IAM user and use the credentials on your on-prem application.