Skip to content

Commit 9e8010d

Browse files
sangamcsesangamcse
authored
Revert "Revert "feat: Remove AWS key and use ECR passwords for docker login [Ubuntu 24]"" (#174)
This reverts commit d6221bf.
1 parent d6221bf commit 9e8010d

7 files changed

Lines changed: 119 additions & 24 deletions

File tree

‎blackbox‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@ blackbox() {
5454
# shellcheck disable=SC2155
5555
export BLACKBOX_VERSION="2404"
5656

57+
export BLACKBOX_ECR_TOKEN_DIR="${BLACKBOX_ECR_TOKEN_DIR:-/run/hackerrank/devops-ecr}"
58+
5759
export BLACKBOX_FLAG__DEBUG_MODE=${BLACKBOX_FLAG__DEBUG_MODE:-no}
5860
# shellcheck disable=SC2155
5961
export BLACKBOX_FLAG__STEP_PROVISION=$(awk -v master="yes" -v user="${BLACKBOX_FLAG__STEP_PROVISION:-yes}" 'END { print ($0 == "blackbox") ? user : master }' <(findmnt -n --mountpoint="/blackbox" --output="SOURCE"))

‎docs/framework/inventory.framework.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ Inventory handler
1818
* [blackbox.framework.inventory.snapshot.digest](#blackboxframeworkinventorysnapshotdigest)
1919
* [blackbox.framework.inventory.snapshot.verify](#blackboxframeworkinventorysnapshotverify)
2020
* [blackbox.framework.inventory.snapshot.__init](#blackboxframeworkinventorysnapshotinit)
21+
* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread)
22+
* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin)
2123
* [blackbox.framework.inventory.ecr.login](#blackboxframeworkinventoryecrlogin)
2224
* [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout)
2325
* [blackbox.framework.inventory.provision](#blackboxframeworkinventoryprovision)
@@ -187,6 +189,51 @@ _Function has no arguments._
187189

188190
## blackbox.framework.inventory.ecr.*
189191

192+
### blackbox.framework.inventory.ecr.token.read
193+
194+
#### Example
195+
196+
```bash
197+
# Read the private ECR password
198+
blackbox.framework.inventory.ecr.token.read private-password
199+
```
200+
201+
#### Arguments
202+
203+
* **$1** (type=enum<private-password|public-password>): Token file name
204+
205+
#### Exit codes
206+
207+
* **0**: If a non-empty token was read, which is printed to stdout
208+
* **1**: If the token was missing or empty
209+
210+
#### See also
211+
212+
* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin)
213+
214+
### blackbox.framework.inventory.ecr.token.login
215+
216+
#### Example
217+
218+
```bash
219+
# Log in to the private registry
220+
blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password
221+
```
222+
223+
#### Arguments
224+
225+
* **$1** (type=string): Registry
226+
* **$2** (type=enum<private-password|public-password>): Token file name
227+
228+
#### Exit codes
229+
230+
* **0**: If both the root and "$BLACKBOX_USER_NAME" logins succeeded
231+
* **1**: If no token could be read, or either login failed
232+
233+
#### See also
234+
235+
* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread)
236+
190237
### blackbox.framework.inventory.ecr.login
191238

192239
#### Example
@@ -198,6 +245,11 @@ blackbox.framework.inventory.ecr.login
198245

199246
_Function has no arguments._
200247

248+
#### Exit codes
249+
250+
* **0**: If the private registry login succeeded
251+
* **1**: If the private registry login failed
252+
201253
#### See also
202254

203255
* [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout)

‎framework/inventory.framework‎

Lines changed: 57 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -249,10 +249,62 @@ blackbox.framework.inventory() {
249249
blackbox.framework.inventory.ecr() {
250250
# @section blackbox.framework.inventory.ecr.*
251251

252+
# Reads an ECR docker-login password from the host credential handoff published under "$BLACKBOX_ECR_TOKEN_DIR"
253+
#
254+
# @arg $1 type=enum<private-password|public-password> Token file name
255+
#
256+
# @exitcode 0 If a non-empty token was read, which is printed to stdout
257+
# @exitcode 1 If the token was missing or empty
258+
#
259+
# @example
260+
# # Read the private ECR password
261+
# blackbox.framework.inventory.ecr.token.read private-password
262+
#
263+
# @see blackbox.framework.inventory.ecr.token.login
264+
function blackbox.framework.inventory.ecr.token.read() {
265+
typeset -r name=$1
266+
typeset token
267+
268+
if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then
269+
printf "%s" "$token"
270+
return 0
271+
fi
272+
273+
printf "error: *** ECR token '%s/%s' is not available\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" >&2
274+
return 1
275+
}
276+
277+
# Logs in to a Docker registry, for both root and "$BLACKBOX_USER_NAME", with a password from the host credential handoff
278+
#
279+
# @arg $1 type=string Registry
280+
# @arg $2 type=enum<private-password|public-password> Token file name
281+
#
282+
# @exitcode 0 If both the root and "$BLACKBOX_USER_NAME" logins succeeded
283+
# @exitcode 1 If no token could be read, or either login failed
284+
#
285+
# @example
286+
# # Log in to the private registry
287+
# blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password
288+
#
289+
# @see blackbox.framework.inventory.ecr.token.read
290+
function blackbox.framework.inventory.ecr.token.login() {
291+
typeset -r registry=$1
292+
typeset -r name=$2
293+
typeset token
294+
295+
token=$(blackbox.framework.inventory.ecr.token.read "$name") || return 1
296+
297+
docker login --username AWS --password-stdin "$registry" <<<"$token" \
298+
&& sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin "$registry" <<<"$token"
299+
}
300+
252301
# Logs in to Amazon ECR
253302
#
254303
# @noargs
255304
#
305+
# @exitcode 0 If the private registry login succeeded
306+
# @exitcode 1 If the private registry login failed
307+
#
256308
# @example
257309
# # Logs in to Amazon ECR
258310
# blackbox.framework.inventory.ecr.login
@@ -264,26 +316,15 @@ blackbox.framework.inventory() {
264316
}
265317

266318
blackbox.framework.inventory.provision awscli
267-
(
268-
export AWS_DEFAULT_REGION="us-east-1"
269-
# shellcheck disable=SC2155
270-
export AWS_ACCESS_KEY_ID=$(base64 -d <(base64 -d <<<"UVV0SlFWSTJUemRIU2s1WVZGbEtOVFJNU1U4PQo="))
271-
# shellcheck disable=SC2155
272-
export AWS_SECRET_ACCESS_KEY=$(base64 -d <(base64 -d <<<"YVZWNlRtcExlWEpJWVhOeE5UUjVUR05QTlZSbFRraEhlVWxsYzJOMVkxRkJSazVqWTJJeFpRPT0K"))
273-
274-
# shellcheck disable=SC2155
275-
local ECR_PASSWORD=$(/usr/local/aws-cli/v2/current/bin/aws ecr get-login-password --region "$AWS_DEFAULT_REGION")
276319

277-
docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD"
278-
sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD"
320+
(
321+
blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password || exit 1
279322

280323
{
281324
# TODO: for backwards compatibility with public ECR repositories, and should be removed when all questions are moved to private ECR repositories
282-
# shellcheck disable=SC2155
283-
local ECR_PASSWORD_PUBLIC=$(/usr/local/aws-cli/v2/current/bin/aws ecr-public get-login-password --region "$AWS_DEFAULT_REGION")
284-
285-
docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC"
286-
sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC"
325+
blackbox.framework.inventory.ecr.token.login public.ecr.aws/b0k9n8x8 public-password || {
326+
printf "warn: *** public ECR login failed, questions hosted on public repositories will not pull\n" >&2
327+
}
287328
}
288329
) 2>&1 # ¯\_(ツ)_/¯
289330
}

‎framework/module/abstract/check/provision.step‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,9 +43,9 @@ blackbox.framework.module.abstract.check.provision() {
4343
fi
4444

4545
if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
46-
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
46+
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
4747
else
48-
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
48+
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
4949
fi
5050

5151
: <<< blackbox.module.*.check.provision

‎module/ansible-aws/check/provision.step‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ blackbox.module.ansible-aws.check.provision() {
3131
}
3232

3333
if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
34-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
34+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
3535
else
36-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
36+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
3737
fi
3838

3939
if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then

‎module/aws/check/provision.step‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ blackbox.module.aws.check.provision() {
2424
fi
2525

2626
if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
27-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
27+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
2828
else
29-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
29+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
3030
fi
3131

3232
if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then

‎module/terraform-aws/check/provision.step‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ blackbox.module.terraform-aws.check.provision() {
3131
}
3232

3333
if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
34-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
34+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
3535
else
36-
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
36+
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
3737
fi
3838

3939
if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then

0 commit comments

Comments
 (0)