feat: add support for aws ecr tokens (#2650) #58
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What type of PR is this?
feature
Which issue does this PR fix:
project-zot/zot#2650
What does this PR do / Why do we need it:
This PR adds support for temporary credentials for upstream registries, specifically focusing on AWS ECR. Since ECR credentials are not permanent and need to be rotated periodically, this enhancement enables Zot to dynamically obtain and refresh valid usernames and passwords when the CredentialHelper is configured for the registry
If an issue # is not available please add repro steps and logs showing the issue:
N/A
Testing done on this change:
During initialization, the logs confirm that ECR credentials have been updated:
During credential expiry, the following log entries are generated:
These logs verify that the credentials are nearing the expiry window of one hour and have been successfully refreshed.
Automation added to e2e:
Added TestECRCredentialsHelper in sync_internal_test
Will this break upgrades or downgrades?
No
Does this PR introduce any user-facing change?:
No
release-note
With this PR, users can configure AWS ECR as an upstream registry for on-demand or periodic sync by setting
CredentialHelper: ecr
in the extension sync configuration. This change eliminates the need for users to manually add usernames and passwords in thecredentialsFile
; instead, credentials will be stored in memory and automatically rotated as they approach expiry. An example configuration is available inexamples/config-sync-ecr-credential-helper.json
.By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.