{"action":"created","issue":{"url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/423","repository_url":"https://api.github.com/repos/aws/amazon-ecs-agent","labels_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/423/labels{/name}","comments_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/423/comments","events_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/423/events","html_url":"https://github.com/aws/amazon-ecs-agent/issues/423","id":159565840,"number":423,"title":"Expiring Private Registry Credentials","user":{"login":"yeungda-rea","id":13476365,"avatar_url":"https://avatars.githubusercontent.com/u/13476365?v=3","gravatar_id":"","url":"https://api.github.com/users/yeungda-rea","html_url":"https://github.com/yeungda-rea","followers_url":"https://api.github.com/users/yeungda-rea/followers","following_url":"https://api.github.com/users/yeungda-rea/following{/other_user}","gists_url":"https://api.github.com/users/yeungda-rea/gists{/gist_id}","starred_url":"https://api.github.com/users/yeungda-rea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yeungda-rea/subscriptions","organizations_url":"https://api.github.com/users/yeungda-rea/orgs","repos_url":"https://api.github.com/users/yeungda-rea/repos","events_url":"https://api.github.com/users/yeungda-rea/events{/privacy}","received_events_url":"https://api.github.com/users/yeungda-rea/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-06-10T06:15:02Z","updated_at":"2016-06-17T21:46:22Z","closed_at":null,"body":"We have a private registry. It is authenticated using time limited credentials. How can we use the ECS agent with our private registry?\r\n\r\nWhen reading the docs about [private registries](http://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html), I see that:\r\n\r\n> The Amazon ECS-optimized AMI scans the /etc/ecs/ecs.config file for these variables when the container instance launches, and each time the service is started (with the sudo start ecs command). AMIs that are not Amazon ECS-optimized should store these environment variables in a file and pass them with the --env-file path_to_env_file option to the docker run command that starts the container agent.\r\n\r\n[dockerauth.go](https://github.com/aws/amazon-ecs-agent/blob/master/agent/engine/dockerauth/dockerauth.go#L93) confirms what the docs say.\r\n\r\nIt sounds like the life cycle of credentials is coupled to the life cycle of the ecs agent. Does this design mean that when our credentials expire, we must restart the ecs agent, with fresh credentials? When we talk about doing this, collegues get nervous. We would prefer not to restart the agent for this reason (unless someone can assure us that is it fine to do so).\r\n\r\nWould you be open to supporting another way to source credentials, other than environment variables? What about a file path, or potentially even an s3 object?\r\n\r\nIn principal, if the ecs agent could read credentials from a file or from an S3 object whenever it performed an operation on the docker engine API, it would be possible for _something else_ to ensure the tokens were fresh.\r\n\r\nWe have solved a similar problem for containers running the official docker client that require access to our private registry. In this case we run a sidecar container that periodically fetches a fresh token and generates `~/.docker/.config.json`, and writes it to a volume. This volume is shared with another container that runs a docker client.\r\n\r\nWe could do something similar to this for the ecs agent too, if it were able to read the docker client's config format. I have noticed that `go-dockerclient` is able to read authentication data from `~/.docker` in [go-dockerclient/auth.go](https://github.com/fsouza/go-dockerclient/blob/master/auth.go)."},"comment":{"url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/comments/226889241","html_url":"https://github.com/aws/amazon-ecs-agent/issues/423#issuecomment-226889241","issue_url":"https://api.github.com/repos/aws/amazon-ecs-agent/issues/423","id":226889241,"user":{"login":"kiranmeduri","id":4035,"avatar_url":"https://avatars.githubusercontent.com/u/4035?v=3","gravatar_id":"","url":"https://api.github.com/users/kiranmeduri","html_url":"https://github.com/kiranmeduri","followers_url":"https://api.github.com/users/kiranmeduri/followers","following_url":"https://api.github.com/users/kiranmeduri/following{/other_user}","gists_url":"https://api.github.com/users/kiranmeduri/gists{/gist_id}","starred_url":"https://api.github.com/users/kiranmeduri/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kiranmeduri/subscriptions","organizations_url":"https://api.github.com/users/kiranmeduri/orgs","repos_url":"https://api.github.com/users/kiranmeduri/repos","events_url":"https://api.github.com/users/kiranmeduri/events{/privacy}","received_events_url":"https://api.github.com/users/kiranmeduri/received_events","type":"User","site_admin":false},"created_at":"2016-06-17T21:46:22Z","updated_at":"2016-06-17T21:46:22Z","body":"Hi @yeungda-rea,\r\n\r\nWe understand your use-case and it makes complete sense. However to be robust, we need to make sure all the components which take part in container launch flow be available and reliable. As per your proposal we need to build a mechanism whereby agent can make sure that a new component which refreshes the credentials is working as expected. Today there is no clean way for ecs-agent to do this. Only solution we have is to mimic the way ecs-agent integrates with EC2 Container Registry (essentially fork ecs-agent). \r\n\r\nOut of curiosity, all the requirements you mentioned are currently supported by EC2 Container Registry (as @samuelkarp pointed out). Any reason ECR is not a solution for you? \r\n\r\nThanks,\r\nKiran\r\n"}}
{"actor":{"display_login":"kiranmeduri"}}