<p>This is our environment:</p>

<ol>
<li>I have a Kubernetes cluster running on Amazon.</li>
<li>Jenkins CI/CD running on Amazon that connects to a private GitLab and builds our services as Docker images.</li>
<li>Amazon ECR that stores our Docker images.</li>
</ol>

<p>My questions:</p>

<ol>
<li>How can I auto deploy images from ECR to Kubernetes (as pods) once the Jenkins pipeline pushes newly built images to ECR?</li>
<li>Can I do that within Jenkins pipeline? I've read lots of material but I couldn't find how should it be done.</li>
</ol>

<p>There is also a 3rd party tool like <a href="https://github.com/keel-hq/keel" rel="noreferrer">Keel</a> but it doesn't support Amazon ECR (Webhook problem with ECR).</p>

<p>Any help would be appreciated. </p>

<p>I have a similar workflow and I hope this helps you get some direction. I am using bitbucket pipeline for CI, but I am sure Jenkins will work fine as well.</p>

<p>This is what I do in my CI flow :</p>

<ul>
<li>Build my code and install dependencies</li>
<li>Create a container with a unique tag ( commit-id ) > <code>my-cntnr:12</code></li>
<li>Push to ECR</li>
<li>Curl Rancher API for my-pod  > set(image:<code>my-cntnr:12</code>)</li>
<li>Kubernates updates the pod and pulls the container with tag 12 from ECR</li>
</ul>

<p>Here is the script for reference : </p>

<pre><code>      - composer install --no-interaction
      - docker build -t cms .
      - docker tag myrepo:latest 123456789.dkr.ecr.my-region.amazonaws.com/myrepo:$BITBUCKET_BUILD_NUMBER
      - aws ecr get-login --no-include-email --region my-region &gt;&gt; login.sh
      - sh login.sh
      - docker push 123456799.dkr.ecr.my-region.amazonaws.com/myrepo:$BITBUCKET_BUILD_NUMBER
      - sh .docker/workload-update.sh // my curl script calling rancher API
</code></pre>

<p>note: Since I am using Rancher, I can use Rancher API to update pods and
   their configuration.</p>

<hr>

<p>Now for the ECR credentials part for Kubernetes, you have to create a secret ( a Kubernetes only entity), this secret is created using your AWS ECR details. Then you can use this secret in your pod.yml as image-pull-secret. This will tell k8 to use the secret and pull the image from ECR</p>

<p>I have a simple script to quickly do that.</p>

<pre><code>#
# RUN me where kubectl is available,&amp; make sure to replace account,region etc
#
ACCOUNT=123456789
REGION=my-region
SECRET_NAME=${REGION}-ecr-registry
EMAIL=email@email.com ( can be anything)

#
# Fetch token (which will expire in 12 hours)
#

TOKEN=`aws ecr --region=$REGION get-authorization-token --output text --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2`

#
# Create or replace registry secret
#

kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
 --docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
 --docker-username=AWS \
 --docker-password="${TOKEN}" \
 --docker-email="${EMAIL}"
</code></pre>

<p>And this is how you can use it in your pod.yml</p>

<pre><code>apiVersion: v1
kind: Pod                                            
metadata:
  name: my-app   
  labels:
    app: my-app                              
spec:                                                
  containers:
    - image: 123456789.dkr.ecr.my-region.amazonaws.com/my-repo
      name: -cntnr                            
      ports:
        - containerPort: 8080    
  imagePullSecrets:
  - name: my-secret-name ( this will be same as name of secret we created earlier)
</code></pre>

<hr>

<p>I've written a detailed article about the process as well. Please find it <a href="https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c" rel="noreferrer">here</a>.</p>
