Push to ECR from Jenkins pipeline
Solution 1
Instead of eval, you now can use the Jenkins ‘amazon-ecr’ plugin from https://plugins.jenkins.io/amazon-ecr/ for ECR deployments.
pipeline {
environment {
registry = '1111111111111.dkr.ecr.eu-central-1.amazonaws.com/myRepo'
registryCredential = 'ID_OF_MY_AWS_JENKINS_CREDENTIAL'
dockerImage = ''
}
agent any
stages {
stage('Building image') {
steps{
script {
dockerImage = docker.build registry + ":$BUILD_NUMBER"
}
}
}
stage('Deploy image') {
steps{
script{
docker.withRegistry("https://" + registry, "ecr:eu-central-1:" + registryCredential) {
dockerImage.push()
}
}
}
}
}
}
Solution 2
Do i have to create a special IAM user and provide its access and secret access keys ? Or what will be the best way to do this.
If you are running Jenkins inside your AWS and you using the secret key and access key you are violating best practice. You should never use the access key and secret key inside AWS VPC. These are designed to interact with AWS from outside of AWS account.
You should create an IAM role which has specific role and that role allow Jenkins only to push the image to ECR.
As far your current command, eval \$(aws ecr get-login --no-include-email --region us-east-2)
you will always need this token to push/pull the image to ECR, this token has some expiry, you should read about this approach below. But it seems okay with IAM role.
Also you can explore Amazon+ECR-plugin
About
Amazon ECR plugin implements a Docker Token producer to convert Amazon credentials to Jenkins’ API used by (mostly) all Docker-related plugins. Thank's to this producer, you can select your existing registered Amazon credentials for various Docker operations in Jenkins, for sample using CloudBees Docker Build and Publish plugin:
Solution 3
It's possible, but very subtle to debug, so make sure you follow the steps below.
- Use
dockerfile
agent in jenkins pipeline (You can name itDockerfile.jenkins
or something else you prefer) and install amazon ecr credential helper in it to get a clean and stable building environment.
FROM ubuntu:rolling
RUN apt-get update && apt-get install -y amazon-ecr-credential-helper
- Create a
config.json
file in your git repo, like.docker/config.json
.
{
"credHelpers": {
"[YOUR_ACCOUNT_ID].dkr.ecr.[YOUR_REGION].amazonaws.com": "ecr-login"
}
}
- Test
docker pull
in yourJenkinsfile
, make sure your access key's user is enabled with the right policy (probablyAmazonEC2ContainerRegistryFullAccess
).
pipeline {
agent {
dockerfile {
filename 'Dockerfile.jenkins'
}
}
stages {
stage('TEST ECR') {
steps {
script {
sh "DOCKER_CONFIG=.docker AWS_ACCESS_KEY_ID=[YOUR_ACCESS_KEY_ID] AWS_SECRET_ACCESS_KEY=[YOUR_SECRET_KEY] docker pull [YOUR PRIVATE IMAGE]"
// docker.build("${tag}", "${DOCKER_BUILD_ARGS} -f Dockerfile .")
// sh "docker push ${tag}"
}
}
}
}
}
If it's okay to pull, then you can just change DOCKER_CONFIG=.docker AWS_ACCESS_KEY_ID=[YOUR_ACCESS_KEY_ID] AWS_SECRET_ACCESS_KEY=[YOUR_SECRET_KEY] docker pull [YOUR PRIVATE IMAGE]
to docker push [YOUR IMAGE]
under correct environment variable settings.
Your repo would seem:
.
├── .docker
│ └── config.json
├── Dockerfile
└── Dockerfile.jenkins
![AWS_Lernar](https://lh5.googleusercontent.com/-o2qq3GnQKCA/AAAAAAAAAAI/AAAAAAAAAAA/ACHi3reMS3_IaMuOtmiQyyVBh9Uda60m4Q/photo.jpg?sz=256)
AWS_Lernar
Updated on July 16, 2022Comments
-
AWS_Lernar almost 2 years
I have Jenkins server on-preminse. I have Jenkins file which create Docker image now i want to push that image to AWS ECR.Do i have to create a special IAM user and provide its access and secret access keys ? Or what will be the best way to do this.
I found below on internet
withAWS(role:'Jenkins', roleAccount:'XXXX216610',duration: 900, roleSessionName: 'jenkinssession') sh ' eval \$(aws ecr get-login --no-include-email --region us-east-2) '
But as my jenkins server is onprem how role will work ?