amazon-web-services - 使用Gradle插件将Docker镜像推送到ECR

Question

我正在使用gradle-docker-plugin来构建docker镜像并将其推送到Amazon的ECR。为此，我还使用了在EC2实例上运行的远程docker守护程序。我已经配置了一个自定义任务EcrLoginTask来使用aws-java-sdk-ecr库获取ECR授权 token 。相关代码如下:-

class EcrLoginTask extends DefaultTask {
    String accessKey
    String secretCode
    String region
    String registryId

    @TaskAction
    String getPassword() {
        AmazonECR ecrClient = AmazonECRClient.builder()
                .withRegion(Regions.fromName(region))
                .withCredentials(new AWSStaticCredentialsProvider(new BasicAWSCredentials(accessKey, secretCode))).build()
        GetAuthorizationTokenResult authorizationToken = ecrClient.getAuthorizationToken(
                new GetAuthorizationTokenRequest().withRegistryIds(registryId))
        String token = authorizationToken.getAuthorizationData().get(0).getAuthorizationToken()
        System.setProperty("DOCKER_PASS", token) // Will this work ?
        return token
    }

}

buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'com.amazonaws:aws-java-sdk-ecr:1.11.244'
        classpath 'com.bmuschko:gradle-docker-plugin:3.2.1'
    }
}



docker {
    url = "tcp://remote-docker-host:2375"
    registryCredentials {
        username = 'AWS'
        password = System.getProperty("DOCKER_PASS")    // Need to provide at runtime !!!
        url = 'https://123456789123.dkr.ecr.eu-west-1.amazonaws.com'
    }
}

task getECRPassword(type: EcrLoginTask) {
    accessKey AWS_KEY
    secretCode AWS_SECRET
    region AWS_REGION
    registryId '139539380579'
}

task dbuild(type: DockerBuildImage) {
    dependsOn build
    inputDir = file(".")
    tag "139539380579.dkr.ecr.eu-west-1.amazonaws.com/n6duplicator"
}

task dpush(type: DockerPushImage) {
    dependsOn dbuild, getECRPassword
    imageName "123456789123.dkr.ecr.eu-west-1.amazonaws.com/n6duplicator"
}

远程docker连接工作正常，ECR token 也已成功获取，并且 dbuild任务也已成功执行。

问题
dpush任务失败-“无法推送图像:没有基本身份验证凭据”

我相信这是因为使用 EcrLoginTask收到的授权 token 没有传递到 docker配置闭包 password属性中。

我如何解决它 ？每次执行构建时，我都需要即时提供凭据。

Answer 1

看看'gradle-aws-ecr-plugin'。在每次AWS / Docker命令调用期间，它都能获取一个新的(最新)Amazon ECR docker注册表 token :

All Docker tasks such as DockerPullImage, DockerPushImage, etc. that are configured with the ECR registry URL will get a temporary ECR token. No further configuration is necessary. It is possible to set the registry URL for individual tasks.

这应该与 gradle-docker-plugin或Netflix的 nebula-docker-plugin一起很好地工作，后者也基于并扩展了“bmuschko” docker 插件。

“ gradle-aws-ecr-plugin” BitBucket主页简要说明了如何配置AWS和ECR [URL]凭据。