Skip to content

Latest commit

 

History

History
77 lines (61 loc) · 4.78 KB

README.md

File metadata and controls

77 lines (61 loc) · 4.78 KB
Raw

aws-ecr-http-proxy

A very simple nginx push/pull proxy that forwards requests to AWS ECR and caches the responses locally.

Configuration:

The proxy is packaged in a docker container and can be configured with following environment variables:

Environment Variable Description Status Default
AWS_REGION AWS Region for AWS ECR Required
AWS_ACCESS_KEY_ID AWS Account Access Key ID Optional
AWS_SECRET_ACCESS_KEY AWS Account Secret Access Key Optional
AWS_USE_EC2_ROLE_FOR_AUTH Set this to true if we do want to use aws roles for authentication instead of providing the secret and access keys explicitly Optional
UPSTREAM URL for AWS ECR Required
RESOLVER DNS server to be used by proxy Required
PORT Port on which proxy listens Required
CACHE_MAX_SIZE Maximum size for cache volume Optional 75g
CACHE_KEY Cache key used for the content by nginx Optional $uri
ENABLE_SSL Used to enable SSL/TLS for proxy Optional false
REGISTRY_HTTP_TLS_KEY Path to TLS key in the container Required with TLS
REGISTRY_HTTP_TLS_CERTIFICATE Path to TLS cert in the container Required with TLS

Example:

docker run -d --name docker-registry-proxy --net=host \
  -v /registry/local-storage/cache:/cache \
  -v /registry/certificate.pem:/opt/ssl/certificate.pem \
  -v /registry/key.pem:/opt/ssl/key.pem \
  -e PORT=5000 \
  -e RESOLVER=8.8.8.8 \
  -e UPSTREAM=https://XXXXXXXXXX.dkr.ecr.eu-central-1.amazonaws.com \
  -e AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID} \
  -e AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY} \
  -e AWS_REGION=${AWS_DEFAULT_REGION} \
  -e CACHE_MAX_SIZE=100g \
  -e ENABLE_SSL=true \
  -e REGISTRY_HTTP_TLS_KEY=/opt/ssl/key.pem \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/opt/ssl/certificate.pem \
  esailors/aws-ecr-http-proxy:latest

If you ran this command on "registry-proxy.example.com" you can now get your images using docker pull registry-proxy.example.com:5000/repo/image.

Deploying the proxy

Deploying with ansible

Modify the ansible role variables according to your need and run the playbook as follow:

ansible-playbook -i hosts playbook-docker-registry-proxy.yaml

In case you want to enable SSL/TLS please replace the SSL certificates with the valid ones in roles/docker-registry-proxy/files/*.pem

Deploying on Kubernetes with Helm

You can install on Kubernetes using the community-maintained chart like this:

helm repo add evryfs-oss https://evryfs.github.io/helm-charts/
helm install evryfs-oss/ecr-proxy --name ecr-proxy --namespace ecr-proxy

See the values-file for configuration parameters.

Note on SSL/TLS

The proxy is using HTTP (plain text) as default protocol for now. So in order to avoid docker client complaining either:

  • (Recommended) Enable SSL/TLS using ENABLE_SSL configuration. For that you will have to mount your valid certificate/key in the container and pass the paths using REGISTRY_HTTP_TLS_* variables.
  • Mark the registry host as insecure in your client deamon config.