Support FIPS endpoint #692
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
samuelkarp
reviewed
Jan 3, 2019
SoManyHs
force-pushed
the
hhh-fips
branch
3 times, most recently
from
cc94dc3 to
7f84ee5
Compare
|
allisaurus
requested changes
Jan 14, 2019
PettitWesley
suggested changes
Jan 14, 2019
There was a problem hiding this comment.
@SoManyHs Tried testing it- how come this happens?
With Fips:
amazon-ecs-cli ((HEAD detached at H3Fork/hhh-fips)) $ ecs-cli push cats/fluentd --use-fips --debug
DEBU[0000] Using FIPS endpoint: https://ecr-fips.us-west-2.amazonaws.com
INFO[0000] Getting AWS account ID...
FATA[0000] Error executing 'push': SerializationError: failed to decode query XML error response
status code: 403, request id: 54321916-1845-11e9-89d3-3f12900d556d
caused by: expected element type <ErrorResponse> but have <InvalidSignatureException>
Without Fips:
amazon-ecs-cli ((HEAD detached at H3Fork/hhh-fips)) $ ecs-cli push cats/fluentd --debug
INFO[0000] Getting AWS account ID...
DEBU[0000] Getting authorization token...
DEBU[0000] Checking file cache registry=144718711470
DEBU[0000] Using cached token registry=144718711470
INFO[0000] Tagging image image=cats/fluentd repository=144718711470.dkr.ecr.us-west-2.amazonaws.com/cats/fluentd tag=
INFO[0000] Image tagged
DEBU[0000] Check if repository exists repository=cats/fluentd
INFO[0000] Pushing image repository=144718711470.dkr.ecr.us-west-2.amazonaws.com/cats/fluentd tag=
INFO[0001] Image pushed
|
|
There was a problem hiding this comment.
@SoManyHs I think FIPs support should be advertised in our README
allisaurus
reviewed
Jan 15, 2019
| uri := "012345678912.dkr.ecr.us-east-1.amazonaws.com" | ||
| expectedImage := uri + "/" + repository | ||
| observedRegistryURI, observedRepo, observedTag, err := splitImageName(expectedImage, "[:|@]", "format") | ||
| tests := []struct { |
allisaurus
approved these changes
Jan 16, 2019
PettitWesley
approved these changes
Jan 16, 2019
README.md
Outdated
| @@ -984,6 +984,24 @@ INFO[0018] Started container... container=bf35a813-dd76-4fe0-b5a2-c1334c2331f4/l | |||
|
|
|||
| For more information about using private registries with ECS, see [Private Registry Authentication for Tasks](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/private-auth.html). | |||
|
|
|||
| ### Using FIPS Endpoints | |||
There was a problem hiding this comment.
Should this be added to the table of contents?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related to https://github.com/awslabs/amazon-ecr-credential-helper/pull/127/files
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.