AWS ECR pull-through cache with Pulumi

This example lives in the pulumi/examples repository. Check out just this directory to use it:

$ git clone --filter=blob:none --sparse https://github.com/pulumi/examples pulumi-examples
$ git -C pulumi-examples sparse-checkout set aws-ts-ecr-cache
$ cd pulumi-examples/aws-ts-ecr-cache

This Pulumi project creates AWS Elastic Container Registry (ECR) repositories with pull-through cache rules for Docker Hub, GitHub Container Registry, and GitLab Container Registry. It also sets up AWS Secrets Manager secrets to store credentials for Docker Hub, GitHub, and GitLab.

Prerequisites#

1. Install Pulumi
2. Configure AWS credentials
3. Install Node.js

Deploying the example#

1. Create a new stack:

   pulumi stack init dev

2. Set the AWS region to deploy into:

   pulumi config set aws:region <your-aws-region>

3. Configure credentials for each registry you want to cache. Each registry is optional; a cache rule is created only for the registries whose username is set.

   Docker Hub — to get your access token, log in to Docker Hub, navigate to Account Settings, and create a new access token:

   pulumi config set dockerHubUsername <your-docker-hub-username>
   pulumi config set --secret dockerHubAccessToken <your-docker-hub-access-token>

   GitHub — to get your access token, log in to GitHub, navigate to Developer settings, and create a new personal access token with the read:packages scope:

   pulumi config set gitHubUsername <your-github-username>
   pulumi config set --secret gitHubAccessToken <your-github-access-token>

   GitLab — to get your access token, log in to GitLab, navigate to Access Tokens, and create a new personal access token with the read_registry scope:

   pulumi config set gitLabUsername <your-gitlab-username>
   pulumi config set --secret gitLabAccessToken <your-gitlab-access-token>

4. Install dependencies:

   npm install

5. Deploy the stack:

   pulumi up

Resources created#

• ECR Repositories:

  • pullThroughCacheECR: ECR repository for pull-through cache.

• Pull-Through Cache Rules:

  • dockerHubCacheRule: Pull-through cache rule for Docker Hub (if dockerHubUsername is set).
  • githubCacheRule: Pull-through cache rule for GitHub Container Registry (if gitHubUsername is set).
  • gitLabCacheRule: Pull-through cache rule for GitLab Container Registry (if gitLabUsername is set).

• Secrets Manager Secrets:

  • ecrPullThroughCacheDockerHubSecret: Secret for Docker Hub credentials (if dockerHubUsername is set).
  • ecrPullThroughCacheGitHubSecret: Secret for GitHub credentials (if gitHubUsername is set).
  • ecrPullThroughCacheGitLabSecret: Secret for GitLab credentials (if gitLabUsername is set).

Outputs#

• pullThroughCacheECRRepositoryUrl: URL of the ECR repository.
• ecrRepositoryPrefixes: Prefixes for the ECR repositories.

Cleaning up#

Once you’re finished experimenting, destroy your stack and remove it to avoid incurring further charges:

pulumi destroy
pulumi stack rm