{"id":21303062,"url":"https://github.com/bzon/ecr-k8s-secret-creator","last_synced_at":"2025-07-11T20:31:55.021Z","repository":{"id":57508603,"uuid":"146751432","full_name":"bzon/ecr-k8s-secret-creator","owner":"bzon","description":"A Kubernetes client that creates a Secret for docker clients authenticating to ECR. ","archived":false,"fork":false,"pushed_at":"2022-08-22T22:21:08.000Z","size":74,"stargazers_count":42,"open_issues_count":2,"forks_count":15,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-06-09T02:40:54.156Z","etag":null,"topics":["aws-ecr","docker","ecr","go","golang","kubernetes","weave-flux"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bzon.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2018-08-30T13:09:39.000Z","updated_at":"2022-10-23T14:22:31.000Z","dependencies_parsed_at":"2022-09-13T08:20:22.123Z","dependency_job_id":null,"html_url":"https://github.com/bzon/ecr-k8s-secret-creator","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/bzon/ecr-k8s-secret-creator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bzon%2Fecr-k8s-secret-creator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bzon%2Fecr-k8s-secret-creator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bzon%2Fecr-k8s-secret-creator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bzon%2Fecr-k8s-secret-creator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bzon","download_url":"https://codeload.github.com/bzon/ecr-k8s-secret-creator/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bzon%2Fecr-k8s-secret-creator/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264892369,"owners_count":23679279,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-ecr","docker","ecr","go","golang","kubernetes","weave-flux"],"created_at":"2024-11-21T15:58:45.766Z","updated_at":"2025-07-11T20:31:54.996Z","avatar_url":"https://github.com/bzon.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Docker Pulls](https://img.shields.io/docker/pulls/bzon/ecr-k8s-secret-creator.svg)[![Go Report Card](https://goreportcard.com/badge/github.com/bzon/ecr-k8s-secret-creator)](https://goreportcard.com/report/github.com/bzon/ecr-k8s-secret-creator)\n[![codecov](https://codecov.io/gh/bzon/ecr-k8s-secret-creator/branch/master/graph/badge.svg)](https://codecov.io/gh/bzon/ecr-k8s-secret-creator)\n[![Build Status](https://travis-ci.org/bzon/ecr-k8s-secret-creator.svg?branch=master)](https://travis-ci.org/bzon/ecr-k8s-secret-creator)\n\n# NO MAINTENANCE NOTICE \n\nI don't maintain this repository anymore. Feel free to fork if needed.\n\n# ECR K8S Secret Creator\n\nThis application creates a docker config.json (as a Kubernetes secret) that can authenticate docker clients to Amazon ECR. It is using the [ECR GetAuthorizationToken API](https://docs.aws.amazon.com/AmazonECR/latest/APIReference/API_GetAuthorizationToken.html) to fetch the token from an Amazon Region.\n\nA docker config.json file looks like this, which may be found in `$HOME/.docker/config.json` after using `docker login`.\n\n```json\n{\n  \"auths\": {\n\t \"https://${AWS_PROFILE}.dkr.ecr.us-east-1.amazonaws.com\": {\n\t   \"auth\": \".....\"\n\t }\n  }\n}\n```\n\nThis application is like a running cron job that does `aws ecr get-login`, creates a docker config.json file, then create Kubernetes secret out of it.\n\n**WARNING!!** If you need to run this in production environments, please build your own Docker image by following the [How To Build this Project](#how-to-build-this-project) step.\n\n## How does it work?\n\n* Deploy this application as a Pod in the namespace to create the Secret.\n\n* This Pod authenticates to AWS to get a new ECR docker login token according to the `-region` flag.\n\n* It then creates a config.json according to the values retrieved from AWS.\n\n    ```go\n    # config.json template\n    const cfgTemplate = `{\n      \"auths\": {\n       \"{{ .registry }}\": {\n         \"auth\": \"{{ .token }}\"\n       }\n      }\n    }`\n    ```\n\n* It then creates or updates the Secret according to the `-secretName` flag in the current namespace.\n\n    ```yaml\n    apiVersion: v1\n    type: Secret\n    metadata:\n      name: xxxx # -secretName\n      namespace: xxxx # current pod namespace\n    data:\n      config.json: xxxxx # base64 encoded\n    ```\n\n* You can specify secret type by using `-secretType` flag. This can be useful, when running kubernetes nodes outside of AWS, as in this scenario kubelet does not have pull access to ECR. Specifying  `-secretType=kubernetes.io/dockerconfigjson` will automate creation of a secret, that can be used in manifests requiring `imagePullSecrets`\n    ```yaml\n    apiVersion: v1\n    data:\n      .dockerconfigjson: xxxxx\n    kind: Secret\n    type: kubernetes.io/dockerconfigjson\n    metadata:\n      name: xxxx\n      namespace: xxxx\n    ```\n\n* It repeats the process according to the specified `-interval` flag. Refreshing the config.json file content in the Secret over the time specified.\n\n* You can now use this kubernetes secret and __mount__ it to any pod that has a docker client that authenticates to ECR.\n\n\n## Why did I create this?\n\nWe are using [Weave Flux](https://github.com/weaveworks/flux) to operate our __GitOps__ deployment process. The Weave Flux operator currently does not support authentication to ECR ([issue #539](https://github.com/weaveworks/flux/issues/539)). As a workaround, we can use the `--docker-config` flag and mount a custom `config.json` in the flux Pod ([issue #1065](https://github.com/weaveworks/flux/pull/1065)).\n\nThe problem is ECR token expires every 12 hours, and we need to find a way to ensure that the config.json authentication token is rotated in an automated and secure way.\n\n## How to use with Weave Flux Pod?\n\nComplete the [Deployment Guide](#deployment), noting the secret name and then follow [Flux Guide](https://github.com/bzon/ecr-k8s-secret-creator/blob/master/FLUX_GUIDE.md).\n\n## How to Deploy\n\n\u003c!-- vim-markdown-toc GFM --\u003e\n\n  * [IAM Role Requirement](#iam-role-requirement)\n  * [Deployment](#deployment)\n  * [Check the ECR Secret Creator Pod's logs](#check-the-ecr-secret-creator-pods-logs)\n  * [Check the Created Secret](#check-the-created-secret)\n* [How to Build this Project](#how-to-build-this-project)\n\n\u003c!-- vim-markdown-toc --\u003e\n\n### IAM Role Requirement\n\nIf you are __NOT__ using [kube2iam](https://github.com/jtblin/kube2iam), skip to the [Deployment Step](#deployment) and ensure that your Pod's EC2 instance can authenticate to your AWS Account via AWS API Keys, or AWS EC2 IAM Role.\n\n__Create IAM Policy__\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": \"ecr:GetAuthorizationToken\",\n            \"Resource\": \"*\"\n        }\n    ]\n}\n```\n\n```bash\naws iam create-policy --policy-name ${GET_ECR_AUTH_IAM_POLICY} --policy-document file://iam-policy.json --description \"A policy that can get ECR authorization token\"\n```\n\n__Create IAM Role__\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Service\": \"ec2.amazonaws.com\"\n      },\n      \"Action\": \"sts:AssumeRole\"\n    },\n    {\n      \"Sid\": \"\",\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"AWS\": \"arn:aws:iam::${AWS_PROFILE}:role/${IAM_K8S_NODE_ROLE}\"\n      },\n      \"Action\": \"sts:AssumeRole\"\n    }\n  ]\n}\n```\n\n```bash\naws iam create-role --role-name ${GET_ECR_AUTH_IAM_ROLE} \\\n  --assume-role-policy-document file://ec2-iam-trust.json\n```\n\n__Attach the IAM Policy__\n\n```bash\naws iam attach-role-policy --role-name ${GET_ECR_AUTH_IAM_ROLE} \\\n  --policy-arn arn:aws:iam::${AWS_PROFILE}:policy/${GET_ECR_AUTH_IAM_POLICY}\n```\n\n### Deployment\n\nCreate the following RBAC and deploy resources yaml files and run `kubectl apply -f`.\n\n```yaml\n---\nkind: ServiceAccount\napiVersion: v1\nmetadata:\n  name: ecr-k8s-secret-creator\n  namespace: ${SECRET_NAMESPACE}\n---\nkind: ClusterRole\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  name: ecr-k8s-secret-creator\nrules:\n- apiGroups: [\"\"]\n  resources: [\"secrets\"]\n  verbs: [\"get\", \"list\", \"watch\", \"create\", \"update\", \"patch\", \"delete\"]\n---\nkind: ClusterRoleBinding\napiVersion: rbac.authorization.k8s.io/v1\nmetadata:\n  name: ecr-k8s-secret-creator\nroleRef:\n  kind: ClusterRole\n  name: ecr-k8s-secret-creator\n  apiGroup: rbac.authorization.k8s.io\nsubjects:\n- kind: ServiceAccount\n  name: ecr-k8s-secret-creator\n  namespace: ${SECRET_NAMESPACE}\n```\n\n```yaml\napiVersion: extensions/v1beta1\nkind: Deployment\nmetadata:\n  name: ecr-k8s-secret-creator\n  namespace: ${SECRET_NAMESPACE}\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: ecr-k8s-secret-creator\n  template:\n    metadata:\n      labels:\n        app: ecr-k8s-secret-creator\n        # if using kube2iam\n        # annotations:\n        # iam.amazonaws.com/role: arn:aws:iam::${AWS_PROFILE}:role/${GET_ECR_AUTH_IAM_ROLE}\n    spec:\n      serviceAccount: ecr-k8s-secret-creator\n      containers:\n        - image: bzon/ecr-k8s-secret-creator:latest\n          name: ecr-k8s-secret-creator\n          args:\n            - \"-secretName=ecr-docker-secret\"\n            - \"-region=us-east-1\"\n            # the default profile is the AWS account where the kubernetes cluster is running\n            # - \"-profile=${AWS_ACCOUNT_ID}\"\n            # the default interval for fetching new ecr token is 200 seconds\n            # - \"-interval=300\"\n          resources:\n            requests:\n              cpu: 5m\n              memory: 16Mi\n            limits:\n              cpu: 20m\n              memory: 32Mi\n```\n\n### Check the ECR Secret Creator Pod's logs\n\n```json\n{\"level\":\"info\",\"msg\":\"appVersion: 0.1.0\",\"time\":\"2018-09-29T16:48:17Z\"}\n{\"level\":\"info\",\"msg\":\"Flags: region=us-east-1, interval=1200, profile=, secretName=ecr-docker-secret\",\"time\":\"2018-09-29T16:48:17Z\"}\n{\"level\":\"info\",\"msg\":\"creating kubernetes secret\",\"time\":\"2018-09-29T16:48:19Z\"}\n{\"level\":\"info\",\"msg\":\"updated kubernetes secret: ecr-docker-secret\",\"time\":\"2018-09-29T16:48:19Z\"}\n```\n\n### Check the Created Secret\n\n```bash\nkubectl get secrets ecr-docker-secret -n ${SECRET_NAMESPACE} -o json | jq '.data[\"config.json\"]' | tr -d '\"' |  base64 --decode\n\n\n{\n  \"auths\": {\n\t \"https://${AWS_PROFILE}.dkr.ecr.us-east-1.amazonaws.com\": {\n\t   \"auth\": \".....\"\n\t }\n  }\n}\n```\n\n## How to Build this Project\n\n* Install [Go](https://golang.github.io/dep/docs/installation.html)\n* Download the project `go get github.com/bzon/ecr-k8s-secret-creator`\n* Go to `$GOPATH/github.com/bzon/ecr-k8s-secret-creator`\n* Change the docker repository in the `Makefile` to your own docker repository\n* Run `make docker-build`\n* Run `make push`\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbzon%2Fecr-k8s-secret-creator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbzon%2Fecr-k8s-secret-creator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbzon%2Fecr-k8s-secret-creator/lists"}