Skip to content

feat: Remove AWS key and use ECR passwords for docker login #171

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dhairya-hackerrank wants to merge 3 commits into
base: 2404
Choose a base branch
from
Open

feat: Remove AWS key and use ECR passwords for docker login #171

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b64386f
feat: Remove AWS key and use ECR passwords for docker login
DhairyaMajmudar Aug 27, 2026
a41b0d2
cut short comments
dhairya-hackerrank Aug 30, 2026
b26357b
remove no-op docker logout
dhairya-hackerrank Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions blackbox
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,9 @@ blackbox() {
# shellcheck disable=SC2155
export BLACKBOX_VERSION="2404"

export BLACKBOX_ECR_TOKEN_DIR="${BLACKBOX_ECR_TOKEN_DIR:-/run/hackerrank/devops-ecr}"
export BLACKBOX_ECR_TOKEN_WAIT_SECONDS="${BLACKBOX_ECR_TOKEN_WAIT_SECONDS:-30}"

export BLACKBOX_FLAG__DEBUG_MODE=${BLACKBOX_FLAG__DEBUG_MODE:-no}
# shellcheck disable=SC2155
export BLACKBOX_FLAG__STEP_PROVISION=$(awk -v master="yes" -v user="${BLACKBOX_FLAG__STEP_PROVISION:-yes}" 'END { print ($0 == "blackbox") ? user : master }' <(findmnt -n --mountpoint="/blackbox" --output="SOURCE"))
Expand Down
52 changes: 52 additions & 0 deletions docs/framework/inventory.framework.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ Inventory handler
* [blackbox.framework.inventory.snapshot.digest](#blackboxframeworkinventorysnapshotdigest)
* [blackbox.framework.inventory.snapshot.verify](#blackboxframeworkinventorysnapshotverify)
* [blackbox.framework.inventory.snapshot.__init](#blackboxframeworkinventorysnapshotinit)
* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread)
* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin)
* [blackbox.framework.inventory.ecr.login](#blackboxframeworkinventoryecrlogin)
* [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout)
* [blackbox.framework.inventory.provision](#blackboxframeworkinventoryprovision)
Expand Down Expand Up @@ -187,6 +189,51 @@ _Function has no arguments._

## blackbox.framework.inventory.ecr.*

### blackbox.framework.inventory.ecr.token.read

#### Example

```bash
# Read the private ECR password
blackbox.framework.inventory.ecr.token.read private-password
```

#### Arguments

* **$1** (type=enum<private-password|public-password>): Token file name

#### Exit codes

* **0**: If a non-empty token was read, which is printed to stdout
* **1**: If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS"

#### See also

* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin)

### blackbox.framework.inventory.ecr.token.login

#### Example

```bash
# Log in to the private registry
blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password
```

#### Arguments

* **$1** (type=string): Registry
* **$2** (type=enum<private-password|public-password>): Token file name

#### Exit codes

* **0**: If both the root and "$BLACKBOX_USER_NAME" logins succeeded
* **1**: If no token could be read, or either login failed

#### See also

* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread)

### blackbox.framework.inventory.ecr.login

#### Example
Expand All @@ -198,6 +245,11 @@ blackbox.framework.inventory.ecr.login

_Function has no arguments._

#### Exit codes

* **0**: If the private registry login succeeded
* **1**: If the private registry login failed

#### See also

* [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout)
Expand Down
83 changes: 67 additions & 16 deletions framework/inventory.framework
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,10 +249,72 @@ blackbox.framework.inventory() {
blackbox.framework.inventory.ecr() {
# @section blackbox.framework.inventory.ecr.*

# Reads an ECR docker-login password from the host credential handoff, with a bounded wait for the atomic publish under "$BLACKBOX_ECR_TOKEN_DIR"
#
# @arg $1 type=enum<private-password|public-password> Token file name
#
# @exitcode 0 If a non-empty token was read, which is printed to stdout
# @exitcode 1 If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS"
#
# @example
# # Read the private ECR password
# blackbox.framework.inventory.ecr.token.read private-password
#
# @see blackbox.framework.inventory.ecr.token.login
function blackbox.framework.inventory.ecr.token.read() {
typeset -r name=$1
typeset -ri wait_seconds="$BLACKBOX_ECR_TOKEN_WAIT_SECONDS"
typeset -ri interval_seconds=2
typeset -i waited=0
typeset token

while true; do
if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then
printf "%s" "$token"
return 0
fi

(( waited < wait_seconds )) || break

sleep "$interval_seconds"
waited=$(( waited + interval_seconds ))
done
Comment on lines +271 to +281

@sangamcse sangamcse Aug 31, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Retry is also not required after our internal service change. We can keep a PR ready, and once the internal service is released, we can check it in sanity. then remove it


printf "error: *** ECR token '%s/%s' was not available within %ss\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" "$wait_seconds" >&2
return 1
}

# Logs in to a Docker registry, for both root and "$BLACKBOX_USER_NAME", with a password from the host credential handoff
#
# @arg $1 type=string Registry
# @arg $2 type=enum<private-password|public-password> Token file name
#
# @exitcode 0 If both the root and "$BLACKBOX_USER_NAME" logins succeeded
# @exitcode 1 If no token could be read, or either login failed
#
# @example
# # Log in to the private registry
# blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password
#
# @see blackbox.framework.inventory.ecr.token.read
function blackbox.framework.inventory.ecr.token.login() {
typeset -r registry=$1
typeset -r name=$2
typeset token

token=$(blackbox.framework.inventory.ecr.token.read "$name") || return 1

docker login --username AWS --password-stdin "$registry" <<<"$token" \
&& sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin "$registry" <<<"$token"
}

# Logs in to Amazon ECR
#
# @noargs
#
# @exitcode 0 If the private registry login succeeded
# @exitcode 1 If the private registry login failed
#
# @example
# # Logs in to Amazon ECR
# blackbox.framework.inventory.ecr.login
Expand All @@ -264,26 +326,15 @@ blackbox.framework.inventory() {
}

blackbox.framework.inventory.provision awscli
(
export AWS_DEFAULT_REGION="us-east-1"
# shellcheck disable=SC2155
export AWS_ACCESS_KEY_ID=$(base64 -d <(base64 -d <<<"UVV0SlFWSTJUemRIU2s1WVZGbEtOVFJNU1U4PQo="))
# shellcheck disable=SC2155
export AWS_SECRET_ACCESS_KEY=$(base64 -d <(base64 -d <<<"YVZWNlRtcExlWEpJWVhOeE5UUjVUR05QTlZSbFRraEhlVWxsYzJOMVkxRkJSazVqWTJJeFpRPT0K"))

# shellcheck disable=SC2155
local ECR_PASSWORD=$(/usr/local/aws-cli/v2/current/bin/aws ecr get-login-password --region "$AWS_DEFAULT_REGION")

docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD"
sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD"
(
blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password || exit 1

{
# TODO: for backwards compatibility with public ECR repositories, and should be removed when all questions are moved to private ECR repositories
# shellcheck disable=SC2155
local ECR_PASSWORD_PUBLIC=$(/usr/local/aws-cli/v2/current/bin/aws ecr-public get-login-password --region "$AWS_DEFAULT_REGION")

docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC"
sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC"
blackbox.framework.inventory.ecr.token.login public.ecr.aws/b0k9n8x8 public-password || {
printf "warn: *** public ECR login failed, questions hosted on public repositories will not pull\n" >&2
}
}
) 2>&1 # ¯\_(ツ)_/¯
}
Expand Down
4 changes: 2 additions & 2 deletions framework/module/abstract/check/provision.step
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,9 +43,9 @@ blackbox.framework.module.abstract.check.provision() {
fi

if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
else
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
fi

: <<< blackbox.module.*.check.provision
Expand Down
4 changes: 2 additions & 2 deletions module/ansible-aws/check/provision.step
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,9 @@ blackbox.module.ansible-aws.check.provision() {
}

if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
else
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
fi

if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then
Expand Down
4 changes: 2 additions & 2 deletions module/aws/check/provision.step
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ blackbox.module.aws.check.provision() {
fi

if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
else
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
fi

if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then
Expand Down
4 changes: 2 additions & 2 deletions module/terraform-aws/check/provision.step
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,9 +31,9 @@ blackbox.module.terraform-aws.check.provision() {
}

if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
else
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}"
fi

if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then
Expand Down