{"id":20221136,"url":"https://github.com/kevchu3/ocp4-ecr-integration","last_synced_at":"2026-01-07T12:30:53.251Z","repository":{"id":140537969,"uuid":"479130444","full_name":"kevchu3/ocp4-ecr-integration","owner":"kevchu3","description":"OpenShift 4 integration with Amazon Elastic Container Registry","archived":false,"fork":false,"pushed_at":"2022-04-09T01:53:35.000Z","size":21,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-03T04:11:25.876Z","etag":null,"topics":["aws","aws-ecr","openshift","openshift-v4"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kevchu3.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-04-07T19:58:28.000Z","updated_at":"2022-10-05T16:09:03.000Z","dependencies_parsed_at":null,"dependency_job_id":"ae32bb29-36c8-4c6b-ab64-26e5cfaed9df","html_url":"https://github.com/kevchu3/ocp4-ecr-integration","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevchu3%2Focp4-ecr-integration","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevchu3%2Focp4-ecr-integration/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevchu3%2Focp4-ecr-integration/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevchu3%2Focp4-ecr-integration/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kevchu3","download_url":"https://codeload.github.com/kevchu3/ocp4-ecr-integration/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246093111,"owners_count":20722395,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-ecr","openshift","openshift-v4"],"created_at":"2024-11-14T06:51:39.742Z","updated_at":"2026-01-07T12:30:53.196Z","avatar_url":"https://github.com/kevchu3.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# OpenShift and Amazon Elastic Container Registry Integration\n\n## Background\n\n*** **NOTE TO READER: THIS IS NOT A RED HAT OR AMAZON SUPPORTED SOLUTION** ***\n\nFrom the [Amazon docs], an authentication token is used to access any Amazon ECR registry and is valid for 12 hours.  At the time of this writing, if the token is configured as a secret in OpenShift, there is no native way to refresh the secret.  In this integration, we will create a cronjob that periodically pulls the latest token used by ECR and refreshes the secret within a given OpenShift project.\n\n## Infrastructure\n\n* Tested with Red Hat OpenShift on AWS (ROSA), but solution applies generically to OpenShift 4\n* Tested with OpenShift 4.9 and 4.10\n* Amazon Elastic Container Registry (ECR)\n\n## Initial Setup\n\n1. Create an AWS user\n\nIn Amazon ECR, create an AWS user for API access to ECR, and assign it the `AmazonEC2ContainerRegistryPowerUser` policy.  Save the user's credentials for use at a later time, in step 3.\n\n2. Build an image with oc and aws cli\n\nWe will build an image that has both the oc and aws command line interface (cli).  We will start by creating a project for this one time build and import an image which contains the oc cli.  We'll also set this project to be visible for other projects to pull this image.  In my example, I'll use the `aws-oc-build` project, but you can use anything you'd like.\n\n```\n$ oc new-project aws-oc-build\n$ oc import-image ose-cli-artifacts-alt-rhel8:latest --from=registry.redhat.io/openshift4/ose-cli-artifacts-alt-rhel8:latest --confirm\n$ oc adm policy add-role-to-group view system:authenticated\n$ oc adm policy add-role-to-group system:image-puller system:authenticated\n```\n\nWe will install the aws cli on this image with these build artifacts: [aws-oc-cli.artifacts.yaml]\n```\noc apply -f aws-oc-cli.artifacts.yaml\n```\n\n3. Apply the secret rotation artifacts\n\nIn a new namespace from which you'd like to build and push application images to ECR, download the following ECR artifacts: [ecr.artifacts.yaml]\n\nUpdate the `AWS_ACCOUNT`, `AWS_ACCESS_KEY_ID`, and `AWS_SECRET_ACCESS_KEY` values in the ecr-creds-rotator-secret Secret, and update the `AWS_REGION` value in the ecr-creds-rotator-cm ConfigMap.\n\nThen create the artifacts:\n```\noc apply -f ecr.artifacts.yaml\n```\n\n4. Configure a project template\n\nAs an alternative to step 3, you can configure a [project template] to automatically create these artifacts for new projects.  Here is a sample template: [ecr.template.yaml]\n```\n$ oc create -f ecr.template.yaml -n openshift-config\n$ oc edit project.config.openshift.io/cluster\n\napiVersion: config.openshift.io/v1\nkind: Project\nmetadata:\n  ...\nspec:\n  projectRequestTemplate:\n    name: project-request\n```\n\n5. Now let's test a build\n\nIn ECR, create a new repository named `\u003cAWS_ACCOUNT\u003e.dkr.ecr.\u003cAWS_REGION\u003e.amazonaws.com/sample-ecr:latest`\nIn OpenShift, create a new namespace and create this sample BuildConfig: [sample.buildconfig.yaml].  Replace the values of `\u003cAWS_ACCOUNT\u003e.dkr.ecr.\u003cAWS_REGION\u003e.amazonaws.com/sample-ecr:latest` with your AWS account and region.\n\n```\noc create -f sample.buildconfig.yaml\n```\n\n6. Optional cleanup for testing purposes\n\nIf you'd like to delete the artifacts created in step 3 or 4 in a new project, you can run the following:\n```\noc delete secret ecr-creds-rotator-secret\noc delete cm ecr-creds-rotator-cm\noc delete cronjob ecr-creds-rotator\noc delete role role-update-secrets\noc delete rolebinding ecr-creds-rotator-rolebinding\noc delete sa ecr-creds-rotator-sa\noc delete secret ecr-secret\n```\n\n## License\nGPLv3\n\n## Author\nKevin Chung\n\n[Amazon docs]: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html\n[aws-oc-cli.artifacts.yaml]: aws-oc-cli.artifacts.yaml\n[ecr.artifacts.yaml]: ecr.artifacts.yaml\n[project template]: https://docs.openshift.com/container-platform/latest/applications/projects/configuring-project-creation.html\n[ecr.template.yaml]: ecr.template.yaml\n[sample.buildconfig.yaml]: sample.buildconfig.yaml\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkevchu3%2Focp4-ecr-integration","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkevchu3%2Focp4-ecr-integration","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkevchu3%2Focp4-ecr-integration/lists"}