From e0e4d2f377373fdb0bf31d213f3f92083ce5de98 Mon Sep 17 00:00:00 2001 From: Sangam Kumar Date: Mon, 31 Aug 2026 18:20:28 +0530 Subject: [PATCH] =?UTF-8?q?Revert=20"feat:=20Remove=20AWS=20key=20and=20us?= =?UTF-8?q?e=20ECR=20passwords=20for=20docker=20login=20[Ubuntu=202?= =?UTF-8?q?=E2=80=A6"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 97f4ead3d000aa3ceccc6620aecb20e4d035d651. --- blackbox | 2 - docs/framework/inventory.framework.md | 52 ------------- framework/inventory.framework | 73 ++++--------------- .../module/abstract/check/provision.step | 4 +- module/ansible-aws/check/provision.step | 4 +- module/aws/check/provision.step | 4 +- module/terraform-aws/check/provision.step | 4 +- 7 files changed, 24 insertions(+), 119 deletions(-) diff --git a/blackbox b/blackbox index f7383c53..620c9a42 100644 --- a/blackbox +++ b/blackbox @@ -54,8 +54,6 @@ blackbox() { # shellcheck disable=SC2155 export BLACKBOX_VERSION="2404" - export BLACKBOX_ECR_TOKEN_DIR="${BLACKBOX_ECR_TOKEN_DIR:-/run/hackerrank/devops-ecr}" - export BLACKBOX_FLAG__DEBUG_MODE=${BLACKBOX_FLAG__DEBUG_MODE:-no} # shellcheck disable=SC2155 export BLACKBOX_FLAG__STEP_PROVISION=$(awk -v master="yes" -v user="${BLACKBOX_FLAG__STEP_PROVISION:-yes}" 'END { print ($0 == "blackbox") ? user : master }' <(findmnt -n --mountpoint="/blackbox" --output="SOURCE")) diff --git a/docs/framework/inventory.framework.md b/docs/framework/inventory.framework.md index ee9d2718..4aed472f 100644 --- a/docs/framework/inventory.framework.md +++ b/docs/framework/inventory.framework.md @@ -18,8 +18,6 @@ Inventory handler * [blackbox.framework.inventory.snapshot.digest](#blackboxframeworkinventorysnapshotdigest) * [blackbox.framework.inventory.snapshot.verify](#blackboxframeworkinventorysnapshotverify) * [blackbox.framework.inventory.snapshot.__init](#blackboxframeworkinventorysnapshotinit) -* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread) -* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin) * [blackbox.framework.inventory.ecr.login](#blackboxframeworkinventoryecrlogin) * [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout) * [blackbox.framework.inventory.provision](#blackboxframeworkinventoryprovision) @@ -189,51 +187,6 @@ _Function has no arguments._ ## blackbox.framework.inventory.ecr.* -### blackbox.framework.inventory.ecr.token.read - -#### Example - -```bash -# Read the private ECR password -blackbox.framework.inventory.ecr.token.read private-password -``` - -#### Arguments - -* **$1** (type=enum): Token file name - -#### Exit codes - -* **0**: If a non-empty token was read, which is printed to stdout -* **1**: If the token was missing or empty - -#### See also - -* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin) - -### blackbox.framework.inventory.ecr.token.login - -#### Example - -```bash -# Log in to the private registry -blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password -``` - -#### Arguments - -* **$1** (type=string): Registry -* **$2** (type=enum): Token file name - -#### Exit codes - -* **0**: If both the root and "$BLACKBOX_USER_NAME" logins succeeded -* **1**: If no token could be read, or either login failed - -#### See also - -* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread) - ### blackbox.framework.inventory.ecr.login #### Example @@ -245,11 +198,6 @@ blackbox.framework.inventory.ecr.login _Function has no arguments._ -#### Exit codes - -* **0**: If the private registry login succeeded -* **1**: If the private registry login failed - #### See also * [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout) diff --git a/framework/inventory.framework b/framework/inventory.framework index cae09bed..12cb63a7 100644 --- a/framework/inventory.framework +++ b/framework/inventory.framework @@ -249,62 +249,10 @@ blackbox.framework.inventory() { blackbox.framework.inventory.ecr() { # @section blackbox.framework.inventory.ecr.* - # Reads an ECR docker-login password from the host credential handoff published under "$BLACKBOX_ECR_TOKEN_DIR" - # - # @arg $1 type=enum Token file name - # - # @exitcode 0 If a non-empty token was read, which is printed to stdout - # @exitcode 1 If the token was missing or empty - # - # @example - # # Read the private ECR password - # blackbox.framework.inventory.ecr.token.read private-password - # - # @see blackbox.framework.inventory.ecr.token.login - function blackbox.framework.inventory.ecr.token.read() { - typeset -r name=$1 - typeset token - - if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then - printf "%s" "$token" - return 0 - fi - - printf "error: *** ECR token '%s/%s' is not available\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" >&2 - return 1 - } - - # Logs in to a Docker registry, for both root and "$BLACKBOX_USER_NAME", with a password from the host credential handoff - # - # @arg $1 type=string Registry - # @arg $2 type=enum Token file name - # - # @exitcode 0 If both the root and "$BLACKBOX_USER_NAME" logins succeeded - # @exitcode 1 If no token could be read, or either login failed - # - # @example - # # Log in to the private registry - # blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password - # - # @see blackbox.framework.inventory.ecr.token.read - function blackbox.framework.inventory.ecr.token.login() { - typeset -r registry=$1 - typeset -r name=$2 - typeset token - - token=$(blackbox.framework.inventory.ecr.token.read "$name") || return 1 - - docker login --username AWS --password-stdin "$registry" <<<"$token" \ - && sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin "$registry" <<<"$token" - } - # Logs in to Amazon ECR # # @noargs # - # @exitcode 0 If the private registry login succeeded - # @exitcode 1 If the private registry login failed - # # @example # # Logs in to Amazon ECR # blackbox.framework.inventory.ecr.login @@ -316,15 +264,26 @@ blackbox.framework.inventory() { } blackbox.framework.inventory.provision awscli - ( - blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password || exit 1 + export AWS_DEFAULT_REGION="us-east-1" + # shellcheck disable=SC2155 + export AWS_ACCESS_KEY_ID=$(base64 -d <(base64 -d <<<"UVV0SlFWSTJUemRIU2s1WVZGbEtOVFJNU1U4PQo=")) + # shellcheck disable=SC2155 + export AWS_SECRET_ACCESS_KEY=$(base64 -d <(base64 -d <<<"YVZWNlRtcExlWEpJWVhOeE5UUjVUR05QTlZSbFRraEhlVWxsYzJOMVkxRkJSazVqWTJJeFpRPT0K")) + + # shellcheck disable=SC2155 + local ECR_PASSWORD=$(/usr/local/aws-cli/v2/current/bin/aws ecr get-login-password --region "$AWS_DEFAULT_REGION") + + docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD" + sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD" { # TODO: for backwards compatibility with public ECR repositories, and should be removed when all questions are moved to private ECR repositories - blackbox.framework.inventory.ecr.token.login public.ecr.aws/b0k9n8x8 public-password || { - printf "warn: *** public ECR login failed, questions hosted on public repositories will not pull\n" >&2 - } + # shellcheck disable=SC2155 + local ECR_PASSWORD_PUBLIC=$(/usr/local/aws-cli/v2/current/bin/aws ecr-public get-login-password --region "$AWS_DEFAULT_REGION") + + docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC" + sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC" } ) 2>&1 # ¯\_(ツ)_/¯ } diff --git a/framework/module/abstract/check/provision.step b/framework/module/abstract/check/provision.step index 5a200a68..60e75236 100644 --- a/framework/module/abstract/check/provision.step +++ b/framework/module/abstract/check/provision.step @@ -43,9 +43,9 @@ blackbox.framework.module.abstract.check.provision() { fi if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi : <<< blackbox.module.*.check.provision diff --git a/module/ansible-aws/check/provision.step b/module/ansible-aws/check/provision.step index f784d919..762ce5e4 100644 --- a/module/ansible-aws/check/provision.step +++ b/module/ansible-aws/check/provision.step @@ -31,9 +31,9 @@ blackbox.module.ansible-aws.check.provision() { } if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then diff --git a/module/aws/check/provision.step b/module/aws/check/provision.step index 644d8bb5..1b1b3a10 100644 --- a/module/aws/check/provision.step +++ b/module/aws/check/provision.step @@ -24,9 +24,9 @@ blackbox.module.aws.check.provision() { fi if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then diff --git a/module/terraform-aws/check/provision.step b/module/terraform-aws/check/provision.step index f538bdda..0690f4dc 100644 --- a/module/terraform-aws/check/provision.step +++ b/module/terraform-aws/check/provision.step @@ -31,9 +31,9 @@ blackbox.module.terraform-aws.check.provision() { } if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then