How to configure the hostRules for AWS ECR on the renovate-on-prem

[tata9001]

How can I configure the hostRule for the ECR when the renovate service is running on the AWS ECS Fargate with the ECR related permission?

    "hostRules": [
    {
      "hostType": "docker",
      "matchHost": "https://xxx.dkr.ecr.ap-southeast-2.amazonaws.com",
    },
    {
      "hostType": "docker",
      "matchHost": "https://index.docker.io",
      "username": "xxx",
      "password": process.env.DOCKER_HUB_PWD,
    },
  ],

I have tried this way, but it doesn't work.

From #9766

[rarkins]

Your first rule doesn't do anything. What were you trying to do?

[fgreinacher]

I’m not exactly sure that the AWS SDK automatically connects to the metadata service. The documentation at https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/modules/_aws_sdk_credential_provider_imds.html indicates that this needs to be configured explicitly.

[tata9001]

@fgreinacher Based on this document, I think it will.

Due to your ECR fix is still not baked into renovate-on-prem, I use some tricky to fix it by dockerfile:

FROM whitesource/renovate:1.3.1

USER root

COPY config.js /usr/src/app/config.js

RUN yarn add renovate@25.4.7

USER 1000

And with this config,

  hostRules: [
    {
      hostType: "docker",
      matchHost: "https://xxx.dkr.ecr.ap-southeast-2.amazonaws.com",
      username: "xxx",
      password: "xxx",
    },
    {
      hostType: "docker",
      matchHost: "https://index.docker.io",
      username: "aaa",
      password: "xxxx"
    },
  ],

But it still cannot work, can you provide your ECR related config about this?

(I have read few times about the code that @rarkins pointed, still cannot figure out why it cannot work.)

[fasterthanlime]

Did you mean to tag @fgreinacher ?

[fgreinacher]

Your document refers to the v2 AWS SDK, but Renovate is using v3.

I don’t have our config at hand (vacation) but I think we’re passing the credentials of a standard IAM user via username/password.

[tata9001]

  hostRules: [
    {
      hostType: "docker",
      matchHost: "https://xxx.dkr.ecr.ap-southeast-2.amazonaws.com",
      username: "xxx",
      password: "xxx",
    },
    {
      hostType: "docker",
      matchHost: "https://index.docker.io",
      username: "aaa",
      password: "xxxx"
    },
  ],

In the latest renovate-on-prem, this config worked.

[BastianVoigt]

This doesn't seem to work with temporary credentials, where the AWS_SESSION_TOKEN would be needed as a third parameter, right? I tried to get it to work with the EC2 instance role. Is it possible to combine it somehow with the CLI command aws ecr get-login-password ?

I have tried it like this, but no success. I passed this environment variable to the renovate process:

DOCKER_PASSWORD=$(aws ecr get-login-password --region eu-central-1)

And then referred to it in the config:

 {
  hostType: "docker",
  matchHost: "https://12345678910.dkr.ecr.eu-central-1.amazonaws.com",
  username: "AWS",
  password: process.env.DOCKER_PASSWORD
}

What am I doing wrong?

[BastianVoigt]

DEBUG: GET https://12345678910.dkr.ecr.eu-central-1.amazonaws.com/v2/my-image/tags/list?n=1000 = (code=ERR_NON_2XX_3XX_RESPONSE, statusCode=403 retryCount=0, duration=51) (repository=GLOBIT/my-image)

[sgorshkov85]

@BastianVoigt @viceice @rarkins Hello. Have you found a way to use a temp AWS ECR token? I tried several ways to set hostrules.
Such as:

       {
        hostType: 'docker',
        matchHost: '11111111.dkr.ecr.eu-central-1.amazonaws.com',
        username: 'AWS',
        token: process.env.ECR_AUTH_TOKEN
      },

[viceice]

that's currently not supported, PR welcome.

[viceice]

renovate/lib/modules/datasource/docker/common.ts

Line 99 in 58cc2c0

const [, region] = coerceArray(ecrRegex.exec(registryHost));

[sgorshkov85]

Thanks for the feedback. I was able to figure out how to use the temporary credentials. It might be useful for others.
In your CI you could get temp secrets with the next command(IAM role attached to the runner, slave must have enough permission to assume the role):

  $(printf "export AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s" $(aws sts assume-role --role-arn arn:aws:iam::111111111:role/my-iam-role --role-session-name MySessionName --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" --output text))

Configuration in config.js:

     {
        hostType: 'docker',
        matchHost: '11111111.dkr.ecr.eu-central-1.amazonaws.com',
        usernname: process.env.AWS_ACCESS_KEY_ID,
        password:  process.env.AWS_SECRET_ACCESS_KEY,
        token:     process.env.AWS_SESSION_TOKEN
      },

@viceice Sure I'll try to create PR when I have enough time.

[SS-SamiAhonen]

Can some one share AWS configs relating this? I do not find detailed documentation and with IAM user defined into configs (renovate.json) user pwd decryption works, but still getting this:

DEBUG: ECR getAuthorizationToken error (repository=org/repo)
WARN: No docker auth found - returning (repository=org/repo)

[jjlakis]

Following works for me. In config.json:

  "packageRules": [
    {
      "datasources": ["docker"],
      "registryUrls": ["https://registry.dkr.ecr.eu-west-3.amazonaws.com"]
    }
  ]

and Gitlab CI job:

renovate:
  stage: update
  image: renovate/renovate
  variables:
    RENOVATE_REPOSITORIES: my-gitlab-group/my-gitlab-repo
    RENOVATE_PLATFORM: gitlab
    RENOVATE_PR_HOURLY_LIMIT: 0
    LOG_LEVEL: debug
    AWS_ROLE_SESSION_NAME: $CI_PIPELINE_IID
    AWS_ROLE_ARN: role-arn
    AWS_WEB_IDENTITY_TOKEN_FILE: /home/ubuntu/token
  id_tokens:
    TOKEN:
      aud: https://audience.com
  before_script:
    - echo $TOKEN > $AWS_WEB_IDENTITY_TOKEN_FILE
  script:
    - renovate

(role is configured to be assumed with WebIdentity from GL)

[ronberna]

Does renovate work with IRSA (IAM Roles for Service Accounts)? I'm having issues trying to connect to ECR. I have my hostRules set to:

"hostRules": [
    {
        "hostType": "docker",
        "matchHost": "accountid.dkr.ecr.us-east-1.amazonaws.com"
    }
 ] 

but I don't see any entries in the logs that is trying to authenticate to ECR or get a token. I validated that the regex in the code

export const ecrRegex = /\d+\.dkr\.ecr\.([-a-z0-9]+)\.amazonaws\.com/;

matches my ecr repository url, but the code to get the ECR auth token is not getting executed. Can anyone point to what could be causing this?