-
Notifications
You must be signed in to change notification settings - Fork 4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(cli): garbage collect ecr assets (under --unstable flag) #31841
Conversation
packages/aws-cdk/lib/api/garbage-collection/garbage-collector.ts
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.
A comment requesting an exemption should contain the text Exemption Request
. Additionally, if clarification is needed add Clarification Request
to a comment.
|
||
// We delete images that are not referenced in ActiveAssets and have the Isolated Tag with a date | ||
// earlier than the current time - grace period. | ||
deletables = isolated.filter(img => img.isolatedTagBefore(new Date(currentTime - (graceDays * DAY)))); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do tags even work this way in an ECR repository?
Doesn't a tag only ever refer to exactly 1 image?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also, I think repos are by default created with tag immutability, because that's what security wants.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the difference here is:
- In S3, tags are nonfunctional metadata
- In ECR (Docker), tags are a functional part of how you address the image
(They're not the same type of tag)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can AWS-tag the repository itself... but it has limits key <128 chars, value <256 chars.
Don't know about the max amount of tags.
You could put the following tags on the repo:
aws-cdk:isolated:dde07f18495b1339c13905d5442a78c5 = 1729615771053
aws-cdk:isolated:3bbc165593b6e2a4dcd6e7d72ac51fac = 1729615783885
And never do more than X tags like this. We'll eventually clean out the repo, it just might take a while
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't a tag only ever refer to exactly 1 image?
you can have multiple tags per image.
the id of an image is its digest, which is different than its tag apparently.
Also, I think repos are by default created with tag immutability, because that's what security wants.
tag immutability shouldn't apply here - we are not overwriting any existing tags.
you could argue that it looks weird to tag our isolated images this way (because you can in theory pull from the isolated tag if you really wanted to) -- but i think this is at least doable. unless we really can't do this, i prefer tagging images this way as opposed to using the repo-level tags
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't a tag only ever refer to exactly 1 image?
you can have multiple tags per image.
That's not what I said though. Can you have 2 images with the same tag?
If not, how are you going to tag multiple images for garbage collection? Are you guaranteeing that the timestamps are all unique?
I guess conceivably it might be doable if you use JavaScript timestamps with millisecond resolution and increment them for each; we'd need to tag more than 1000 images/second for that to become inaccurate enough to care about it (and even then... meh).
Even given this... I'm not sure I'm comfortable putting this metadata in a load-bearing location. I guess we can try it and see if it breaks things, or puts undue load on ECR.
(A bit of a design overview in a doc comment of the class would have been extremely helpful reasoning through these concerns)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We've decided offline to go with the Docker tags method as repository tags are limited in number (~50 metadata tags per resource). The issue with Docker tags is ensuring that each tag is unique, and we will do that via timestamps + increments.
@@ -1,7 +1,7 @@ | |||
import { Tag } from '../../cdk-toolkit'; | |||
|
|||
export const BUCKET_NAME_OUTPUT = 'BucketName'; | |||
export const REPOSITORY_NAME_OUTPUT = 'RepositoryName'; | |||
export const REPOSITORY_NAME_OUTPUT = 'ImageRepositoryName'; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this was wrong and was not used anywhere
✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.
export const S3_ISOLATED_TAG = 'aws-cdk:isolated'; | ||
export const ECR_ISOLATED_TAG = 'aws-cdk.isolated'; // ':' is not valid in ECR tags |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Conditionally approved, modulo some tag handling.
const date = Date.now(); | ||
let imageTag; | ||
try { | ||
imageTag = `${ECR_ISOLATED_TAG}-${i}-${String(date)}`; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please turn these fields around, so that they more or less lexicographically sort correctly.
Also -- you have logic around building and splitting this string. Would be nice if that logic lived together. So the building logic should live next to the splitting logic, most likely on ImageAsset
then.
➡️ PR build request submitted to A maintainer must now check the pipeline and add the |
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Comments on closed issues and PRs are hard for our team to see. |
Follow up to #31611 which introduced S3 Asset Garbage Collection
ECR Asset Garbage Collection
cdk gc
now collects ECR assets.or
all other options are duplicated from s3.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license