You signed in with another tab or window.Reload to refresh your session.You signed out in another tab or window.Reload to refresh your session.You switched accounts on another tab or window.Reload to refresh your session.Dismiss alert
1. In the Codefresh UI, on the toolbar, click the**Settings** icon, and then from the sidebar, select[**Pipeline Integrations**](https://g.codefresh.io/account-admin/account-conf/integration){:target="\_blank"}.
15
-
1. Select**Docker Registries** and then click**Configure**.
16
-
1. From the**Add Registry Provider** dropdown, select**Amazon ECR**.
17
-
1. Define the following:
18
-
***Registry name**: A unique name for this configuration.
19
-
***Region**: AWS region.
20
-
***Access Key ID**: Your AWS accessKeyId.
21
-
***Secret Access Key**: Your AWS accessKeyId.
14
+
ECR integrations can be set up for IAM (Identity and Access Management) users and for service accounts. Each type of integration has different prerequisities and requirements.
1. To verify the connection details, click**Test Connection**.
32
-
1. To apply the changes, click**Save**.
16
+
##IAM ECR integration for pipelines
33
17
34
-
Codefresh makes sure to automatically refresh the AWS token for you.
18
+
Amazon ECR integration with IAM roles for push/pull operations are supported with two types of permissions: identity-based and resource-based.
35
19
36
-
For more information on how to obtain the needed tokens, read the[AWS documentation](http://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys){:target="_blank"}.
37
20
38
-
>**NOTE**
39
-
>You must have an active registry set up in AWS.
40
-
>
41
-
>Amazon ECR push/pull operations are supported with two permission options: user-based and resource-based.
21
+
***Identity-based policies**
22
+
User account must apply`AmazonEC2ContainerRegistryPowerUser` policy, or a custom policy based on that policy.
23
+
For more information and examples, see[Amazon ECR identity-based policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-id-based-policies){:target="_blank"}.
42
24
43
-
* Identity-based policies
44
-
User account must apply`AmazonEC2ContainerRegistryPowerUser` policy (or custom based on that policy).
45
-
For more information and examples, click[here](http://docs.aws.amazon.com/AmazonECR/latest/userguide/ecr_managed_policies.html){:target="_blank"}.
46
-
* Resource-based policy
47
-
Users with resource-based policies must be allowed to call`ecr:GetAuthorizationToken` before they can authenticate to a registry, and push or pull any images from any Amazon ECR repository, than you need provide push/pull permissions to specific registry.
48
-
For more information and examples, click[here](http://docs.aws.amazon.com/AmazonECR/latest/userguide/RepositoryPolicies.html){:target="_blank"}.
25
+
***Resource-based policy**
26
+
Users with resource-based policies must be allowed to call`ecr:GetAuthorizationToken` before they can authenticate to a registry.
27
+
To push or pull any images from any Amazon ECR repository, you must provide push/pull permissions to the specific registry.
28
+
For more information and examples, click[Amazon ECR resource-based policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/security_iam_service-with-iam.html#security_iam_service-with-iam-resource-based-policies){:target="_blank"}.
49
29
50
-
##Set up ECR integration for service account
51
30
52
-
Setting up ECR integration for a service account applies to accounts with the Codefresh Runner installation.
31
+
##Service account for authentication
32
+
Setting up ECR integration using service account credentials instead of access keys applies to accounts with the Codefresh Runner installed.
53
33
54
-
###Kubernetes service account setup
34
+
#####Kubernetes service account setup
55
35
56
36
To use an IAM role, you must set up a Kubernetes service account, as described in the[AWS Documentation](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html){:target="\_blank"}.
57
-
You can define the service account at four different levels, based on the required priority. The levels are listed below in ascending order of priority:
37
+
You can define the service account at four different levels, based on the required priority.
38
+
The levels are listed below in ascending order of priority:
58
39
59
-
* Runtime
40
+
***Runtime**
60
41
The runtime level has the lowest priority. Define it in the Runtime Specification under`runtimeScheduler > Cluster` (same level as`namespace`), and specify the service account. The key is`serviceAccount`. Use the default, and make sure you have the correct annotation added to the service account. Another option is to create a new service account with the proper permissions and annotations.
61
42
62
43
```yaml
@@ -70,86 +51,114 @@ runtimeScheduler:
70
51
71
52
```
72
53
73
-
* Account
74
-
The Account-level service account has higher priority than the runtime-level service account. To define the service account at the account level, turn on the setting as part of the integration as described below.
54
+
***Account**
55
+
The account-level service account has higher priority than the runtime-level service account.
56
+
To define the service account at the account level, turn on the setting as part of the integration.
75
57
76
-
* Pipeline
77
-
The Pipeline-level service account has higher priority than the account-level service account. Define the service account as part of the pipeline's runtime settings (Pipeline > Settings > Runtime).
58
+
***Pipeline** (need to verify with Vadim)
59
+
The pipeline-level service account has higher priority than the account-level service account.
60
+
Define the service account as part of the pipeline's runtime settings (Pipeline > Settings > Runtime).
78
61
79
-
* Trigger
62
+
***Trigger** ((need to verify with Vadim))
80
63
The Trigger-level service account has the highest priority. Define the service account as part of the trigger settings for the specific pipeline (Workflow > Triggers (modify or add) > Advanced Options).
81
64
82
-
###How to
83
65
84
-
####Before you begin
66
+
##Set up ECR integration for IAM user/service account
67
+
Set up ECR integration using access key or service account credentials to authenticate to the registry. This is an integration to a private ECR registry.
68
+
If needed, define a[fallback registry]({{site.baseurl}}/docs/integrations/docker-registries/#define-fallback-registry), and a[global prefix]({{site.baseurl}}/docs/integrations/docker-registries/#using-an-optional-repository-prefix) for all Docker images, instead of defining it per pipeline.
85
69
86
-
* Define a Kubernetes service account for the runtime, account, pipeline, or pipeline-trigger
70
+
#####Before you begin
71
+
* Make sure you have an active registry set up in AWS
87
72
88
-
####Steps
73
+
74
+
#####How to
89
75
90
76
1. In the Codefresh UI, on the toolbar, click the**Settings** icon, and then from the sidebar, select[**Pipeline Integrations**](https://g.codefresh.io/account-admin/account-conf/integration){:target="\_blank"}.
91
77
1. Select**Docker Registries** and then click**Configure**.
92
78
1. From the**Add Registry Provider** dropdown, select**Amazon ECR**.
93
-
1. Do the following:
94
-
***Registry name**: Enter a unique name for this configuration.
95
-
***Region**: Select the AWS region.
96
-
* Select**Resolve credentials from servce account**.
97
-
* The Access Key ID and Secret Access Key fields are disabled.
***Registry name**: A unique name for this integration.
81
+
***Region**: AWS region.
82
+
***Access Key ID** and**Secret Access Key**:
83
+
Disabled when service account credentials are used.
84
+
The public identifier (Access Key ID), and the private, secret component (Secret Access Key), for access to the registry. The Access Key ID is paired with the Secret Access Key to ensure the authenticity of the access request to the registry.
85
+
***Resolve credentials from service account**:
86
+
Disabled when access keys are used.
87
+
Authenticate to the registry using the service account[configured for the pipeline]({{site.baseurl}}/docs/pipelines/configuration/pipeline-settings/#advanced-options-for-pipelines) in account-level settings.
***Repository prefix**: The prefix, such as the name of the organization or repository, to use globally for your Docker images.
101
+
***Fallback registry**: The alternate registry to use if the pull operation from the default registry fails.
107
102
1. To verify the connection details, click**Test Connection**.
108
103
1. To apply the changes, click**Save**.
109
104
105
+
Codefresh makes sure to automatically refresh the AWS token for you.
106
+
For more information on how to obtain the needed tokens, read the[AWS documentation](http://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys){:target="_blank"}.
107
+
108
+
109
+
110
110
##Public ECR registry integration
111
111
112
-
You can use**Other Registries** option in the Docker integration page to add a Public ECR integration.
112
+
Add a Public ECR integration through the**Other Registries** option for Docker registry providers.
113
+
114
+
###Step 1: Get username & password from AWS
115
+
Before creating a public ECR integration in Codefresh, get the AWS username and password from the AWS console.
1. In the Codefresh[integration page](https://g.codefresh.io/account-admin/account-conf/integration/registryNew) select 'Add Registry Provider > Other Registries'
127
-
1. Enter any Registry name
128
-
1. Put "AWS" in the Username field
129
-
1. Run the following command from the AWS Console:
### Step 2: Set up public ECR integration in Codefresh
140
+
1. In the Codefresh UI, on the toolbar, click the**Settings** icon, andthen from the sidebar,select[**Pipeline Integrations**](https://g.codefresh.io/account-admin/account-conf/integration){:target="\_blank"}.
1. Test the connectionif needed and save the changes.
146
155
147
156
## Pushing Docker images to Amazon ECR
148
157
149
158
There are two ways to push images:
150
159
151
-
1. (Recommended)Using the YAML [push step]({{site.baseurl}}/docs/pipelines/steps/push/).
152
-
1. Manually promotingmanually an image (described below)
160
+
1. (Recommended)Automatically through the YAML [push step]({{site.baseurl}}/docs/pipelines/steps/push/).
161
+
1. Manuallybypromotingthe image (described below)
153
162
154
163
For more details on how to push a Docker imagein a pipeline see the [build and push example]({{site.baseurl}}/docs/example-catalog/ci-examples/build-and-push-an-image/).
155
164
@@ -202,12 +211,12 @@ max-width="40%"
202
211
203
212
1. Click**Promote**.
204
213
205
-
>**NOTE**
214
+
>**NOTE**
206
215
You can change the image nameif you want, but make sure that the new name exists as a repositoryin ECR.