Skip to content

Commit a0b0eac

Browse files
cbgbtcbgbt
authored
Merge pull request #454 from cbgbt/rbuild
schnauzer/host-ctr: add support for more aws regions
2 parents a4dca72 + 56dffac commit a0b0eac

File tree

3 files changed

+140
-10
lines changed

3 files changed

+140
-10
lines changed

‎sources/api/schnauzer/src/helpers/mod.rs‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ lazy_static! {
3636
let mut m = HashMap::new();
3737
m.insert("af-south-1", "917644944286");
3838
m.insert("ap-east-1", "375569722642");
39+
m.insert("ap-east-2", "905418444513");
3940
m.insert("ap-northeast-1", "328549459982");
4041
m.insert("ap-northeast-2", "328549459982");
4142
m.insert("ap-northeast-3", "328549459982");
@@ -69,6 +70,11 @@ lazy_static! {
6970
m.insert("us-east-2", "328549459982");
7071
m.insert("us-gov-east-1", "388230364387");
7172
m.insert("us-gov-west-1", "347163068887");
73+
m.insert("us-iso-east-1", "999945528765");
74+
m.insert("us-iso-west-1", "928668704122");
75+
m.insert("us-isob-east-1", "782457047625");
76+
m.insert("us-isof-east-1", "891631471851");
77+
m.insert("us-isof-south-1", "482061074055");
7278
m.insert("us-west-1", "328549459982");
7379
m.insert("us-west-2", "328549459982");
7480
m
@@ -104,6 +110,11 @@ lazy_static! {
104110
m.insert("cn-north-1", "bottlerocket-updates-cn-north-1.s3.dualstack");
105111
m.insert("cn-northwest-1", "bottlerocket-updates-cn-northwest-1.s3.dualstack");
106112
m.insert("eu-isoe-west-1", "bottlerocket-updates-eu-isoe-west-1.s3");
113+
m.insert("us-iso-east-1", "bottlerocket-updates-us-iso-east-1.s3");
114+
m.insert("us-iso-west-1", "bottlerocket-updates-us-iso-west-1.s3");
115+
m.insert("us-isob-east-1", "bottlerocket-updates-us-isob-east-1.s3");
116+
m.insert("us-isof-east-1", "bottlerocket-updates-us-isof-east-1.s3");
117+
m.insert("us-isof-south-1", "bottlerocket-updates-us-isof-south-1.s3");
107118
m
108119
};
109120
}
@@ -119,6 +130,11 @@ lazy_static! {
119130
m.insert("eu-isoe-west-1", "aws-iso-e");
120131
m.insert("us-gov-east-1", "aws-us-gov");
121132
m.insert("us-gov-west-1", "aws-us-gov");
133+
m.insert("us-iso-west-1", "aws-iso");
134+
m.insert("us-iso-east-1", "aws-iso");
135+
m.insert("us-isob-east-1", "aws-iso-b");
136+
m.insert("us-isof-east-1", "aws-iso-f");
137+
m.insert("us-isof-south-1", "aws-iso-f");
122138
m
123139
};
124140
}
@@ -1526,7 +1542,10 @@ fn ecr_registry<S: AsRef<str>>(region: S) -> String {
15261542
};
15271543
match partition {
15281544
"aws-cn" => format!("{}.dkr.ecr.{}.amazonaws.com.cn", registry_id, region),
1545+
"aws-iso" => format!("{}.dkr.ecr.{}.c2s.ic.gov", registry_id, region),
1546+
"aws-iso-b" => format!("{}.dkr.ecr.{}.sc2s.sgov.gov", registry_id, region),
15291547
"aws-iso-e" => format!("{}.dkr.ecr.{}.cloud.adc-e.uk", registry_id, region),
1548+
"aws-iso-f" => format!("{}.dkr.ecr.{}.csp.hci.ic.gov", registry_id, region),
15301549
_ => {
15311550
// Only inject the FIPS service endpoint if the variant is in FIPS mode and the
15321551
// region supports FIPS.
@@ -1554,7 +1573,10 @@ fn tuf_repository<S: AsRef<str>>(region: S) -> String {
15541573
};
15551574
match partition {
15561575
"aws-cn" => format!("https://{}.{}.amazonaws.com.cn/latest", endpoint, region),
1576+
"aws-iso" => format!("https://{}.{}.c2s.ic.gov/latest", endpoint, region),
1577+
"aws-iso-b" => format!("https://{}.{}.sc2s.sgov.gov/latest", endpoint, region),
15571578
"aws-iso-e" => format!("https://{}.{}.cloud.adc-e.uk/latest", endpoint, region),
1579+
"aws-iso-f" => format!("https://{}.{}.csp.hci.ic.gov/latest", endpoint, region),
15581580
_ => format!("https://{}.{}.amazonaws.com/latest", endpoint, region),
15591581
}
15601582
}
@@ -1728,6 +1750,26 @@ mod test_ecr_registry {
17281750
"eu-isoe-west-1",
17291751
"589460436674.dkr.ecr.eu-isoe-west-1.cloud.adc-e.uk/bottlerocket-admin:v0.5.1",
17301752
),
1753+
(
1754+
"us-iso-east-1",
1755+
"999945528765.dkr.ecr.us-iso-east-1.c2s.ic.gov/bottlerocket-admin:v0.5.1",
1756+
),
1757+
(
1758+
"us-iso-west-1",
1759+
"928668704122.dkr.ecr.us-iso-west-1.c2s.ic.gov/bottlerocket-admin:v0.5.1",
1760+
),
1761+
(
1762+
"us-isob-east-1",
1763+
"782457047625.dkr.ecr.us-isob-east-1.sc2s.sgov.gov/bottlerocket-admin:v0.5.1",
1764+
),
1765+
(
1766+
"us-isof-south-1",
1767+
"482061074055.dkr.ecr.us-isof-south-1.csp.hci.ic.gov/bottlerocket-admin:v0.5.1",
1768+
),
1769+
(
1770+
"us-isof-east-1",
1771+
"891631471851.dkr.ecr.us-isof-east-1.csp.hci.ic.gov/bottlerocket-admin:v0.5.1",
1772+
),
17311773
];
17321774

17331775
const ADMIN_CONTAINER_TEMPLATE: &str =
@@ -1777,6 +1819,7 @@ mod test_tuf_repository {
17771819
"https://bottlerocket-updates-cn-north-1.s3.dualstack.cn-north-1.amazonaws.com.cn/latest/metadata/2020-07-07/";
17781820

17791821
const EXPECTED_URL_EU_ISOE_WEST_1: &str = "https://bottlerocket-updates-eu-isoe-west-1.s3.eu-isoe-west-1.cloud.adc-e.uk/latest/metadata/2020-07-07/";
1822+
const EXPECTED_URL_US_ISOF_EAST_1: &str = "https://bottlerocket-updates-us-isof-east-1.s3.us-isof-east-1.csp.hci.ic.gov/latest/metadata/2020-07-07/";
17801823

17811824
#[test]
17821825
fn url_af_south_1() {
@@ -1817,6 +1860,16 @@ mod test_tuf_repository {
18171860
.unwrap();
18181861
assert_eq!(result, EXPECTED_URL_EU_ISOE_WEST_1);
18191862
}
1863+
1864+
#[test]
1865+
fn url_us_isof_east_1() {
1866+
let result = setup_and_render_template(
1867+
METADATA_TEMPLATE,
1868+
&json!({"settings": {"aws": {"region": "us-isof-east-1"}}}),
1869+
)
1870+
.unwrap();
1871+
assert_eq!(result, EXPECTED_URL_US_ISOF_EAST_1);
1872+
}
18201873
}
18211874

18221875
#[cfg(test)]

‎sources/host-ctr/cmd/host-ctr/main.go‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ import (
1818
"github.com/aws/aws-sdk-go/service/ecrpublic"
1919
"github.com/awslabs/amazon-ecr-containerd-resolver/ecr"
2020
"github.com/containerd/containerd"
21+
"github.com/containerd/containerd/api/types/runc/options"
2122
"github.com/containerd/containerd/cio"
2223
"github.com/containerd/containerd/containers"
2324
"github.com/containerd/containerd/contrib/seccomp"
2425
"github.com/containerd/containerd/namespaces"
2526
"github.com/containerd/containerd/oci"
2627
"github.com/containerd/containerd/remotes/docker"
27-
"github.com/containerd/containerd/runtime/v2/runc/options"
2828
"github.com/containerd/errdefs"
2929
"github.com/containerd/log"
3030
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
@@ -39,13 +39,22 @@ import (
3939
// Example 2: 777777777777.dkr.ecr.cn-north-1.amazonaws.com.cn/my_image:latest
4040
// Example 3: 777777777777.dkr.ecr.eu-isoe-west-1.cloud.adc-e.uk/my_image:latest
4141
// Example 4: 777777777777.dkr.ecr-fips.us-west-2.amazonaws.com/my_image:latest
42-
var ecrRegex = regexp.MustCompile(`(^[a-zA-Z0-9][a-zA-Z0-9-_]*)\.dkr\.ecr(-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.com(\.cn)?|cloud\.adc-e\.uk).*`)
42+
43+
// ECR hostname pattern also used in the ecr-credential-provider:
44+
// https://github.com/kubernetes/cloud-provider-aws/blob/212135d0d7b448cd34e2e11e5e81f59e3e6c2d7a/cmd/ecr-credential-provider/main.go#L45
45+
var ecrRegex = regexp.MustCompile(`^(\d{12})\.dkr[\.\-]ecr(-fips)?\.([a-zA-Z0-9][a-zA-Z0-9-_]*)\.(amazonaws\.com(?:\.cn)?|on\.(?:aws|amazonwebservices\.com\.cn)|sc2s\.sgov\.gov|c2s\.ic\.gov|cloud\.adc-e\.uk|csp\.hci\.ic\.gov).*$`)
4346

4447
// A set of currently supported ECR regions which are not yet present in the golang SDK
4548
var ecrRefPrefixMapping = map[string]string{
46-
"ap-southeast-7": "ecr.aws/arn:aws:ecr:ap-southeast-7:",
47-
"eu-isoe-west-1": "ecr.aws/arn:aws-iso-e:ecr:eu-isoe-west-1:",
48-
"mx-central-1": "ecr.aws/arn:aws:ecr:mx-central-1:",
49+
"ap-southeast-7": "ecr.aws/arn:aws:ecr:ap-southeast-7:",
50+
"mx-central-1": "ecr.aws/arn:aws:ecr:mx-central-1:",
51+
"ap-east-2": "ecr.aws/arn:aws:ecr:ap-east-2:",
52+
"eu-isoe-west-1": "ecr.aws/arn:aws-iso-e:ecr:eu-isoe-west-1:",
53+
"us-iso-east-1": "ecr.aws/arn:aws-iso:ecr:us-iso-east-1:",
54+
"us-iso-west-1": "ecr.aws/arn:aws-iso:ecr:us-iso-west-1:",
55+
"us-isob-east-1": "ecr.aws/arn:aws-iso-b:ecr:us-isob-east-1:",
56+
"us-isof-south-1": "ecr.aws/arn:aws-iso-f:ecr:us-isof-south-1:",
57+
"us-isof-east-1": "ecr.aws/arn:aws-iso-f:ecr:us-isof-east-1:",
4958
}
5059

5160
// A set of the currently supported FIPS regions for ECR: https://docs.aws.amazon.com/general/latest/gr/ecr.html

‎sources/host-ctr/cmd/host-ctr/main_test.go‎

Lines changed: 73 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,39 @@ func TestParseImageURIAsECR(t *testing.T) {
202202
Fips: false,
203203
},
204204
},
205+
{
206+
"Parse special region",
207+
"777777777777.dkr.ecr.us-iso-east-1.c2s.ic.gov/my_image:latest",
208+
false,
209+
&parsedECR{
210+
Account: "777777777777",
211+
Region: "us-iso-east-1",
212+
RepoPath: "my_image:latest",
213+
Fips: false,
214+
},
215+
},
216+
{
217+
"Parse special region",
218+
"777777777777.dkr.ecr.us-isob-east-1.sc2s.sgov.gov/my_image:latest",
219+
false,
220+
&parsedECR{
221+
Account: "777777777777",
222+
Region: "us-isob-east-1",
223+
RepoPath: "my_image:latest",
224+
Fips: false,
225+
},
226+
},
227+
{
228+
"Parse special region",
229+
"777777777777.dkr.ecr.us-isof-east-1.csp.hci.ic.gov/my_image:latest",
230+
false,
231+
&parsedECR{
232+
Account: "777777777777",
233+
Region: "us-isof-east-1",
234+
RepoPath: "my_image:latest",
235+
Fips: false,
236+
},
237+
},
205238
{
206239
"Parse FIPS region for normal use-cases",
207240
"777777777777.dkr.ecr-fips.us-west-2.amazonaws.com/my_image:latest",
@@ -254,9 +287,14 @@ func TestFetchECRRef(t *testing.T) {
254287
"us-gov-west-1": true,
255288
},
256289
EcrRefPrefixMappings: map[string]string{
257-
"ap-southeast-7": "ecr.aws/arn:aws:ecr:ap-southeast-7:",
258-
"eu-isoe-west-1": "ecr.aws/arn:aws-iso-e:ecr:eu-isoe-west-1:",
259-
"mx-central-1": "ecr.aws/arn:aws:ecr:mx-central-1:",
290+
"ap-southeast-7": "ecr.aws/arn:aws:ecr:ap-southeast-7:",
291+
"eu-isoe-west-1": "ecr.aws/arn:aws-iso-e:ecr:eu-isoe-west-1:",
292+
"mx-central-1": "ecr.aws/arn:aws:ecr:mx-central-1:",
293+
"us-iso-east-1": "ecr.aws/arn:aws-iso:ecr:us-iso-east-1:",
294+
"us-iso-west-1": "ecr.aws/arn:aws-iso:ecr:us-iso-west-1:",
295+
"us-isob-east-1": "ecr.aws/arn:aws-iso-b:ecr:us-isob-east-1:",
296+
"us-isof-south-1": "ecr.aws/arn:aws-iso-f:ecr:us-isof-south-1:",
297+
"us-isof-east-1": "ecr.aws/arn:aws-iso-f:ecr:us-isof-east-1:",
260298
},
261299
}
262300
tests := []struct {
@@ -279,9 +317,39 @@ func TestFetchECRRef(t *testing.T) {
279317
},
280318
{
281319
"Parse special region",
282-
"111111111111.dkr.ecr.mx-central-1.amazonaws.com/bottlerocket-control:v0.7.17",
320+
"111111111111.dkr.ecr.us-iso-east-1.c2s.ic.gov/bottlerocket/container:1.2.3",
321+
false,
322+
"ecr.aws/arn:aws-iso:ecr:us-iso-east-1:111111111111:repository/bottlerocket/container:1.2.3",
323+
},
324+
{
325+
"Parse special region",
326+
"111111111111.dkr.ecr.us-isob-east-1.sc2s.sgov.gov/bottlerocket-control:v0.7.17",
327+
false,
328+
"ecr.aws/arn:aws-iso-b:ecr:us-isob-east-1:111111111111:repository/bottlerocket-control:v0.7.17",
329+
},
330+
{
331+
"Parse special region",
332+
"111111111111.dkr.ecr.us-iso-west-1.c2s.ic.gov/bottlerocket/container:1.2.3",
333+
false,
334+
"ecr.aws/arn:aws-iso:ecr:us-iso-west-1:111111111111:repository/bottlerocket/container:1.2.3",
335+
},
336+
{
337+
"Parse special region",
338+
"111111111111.dkr.ecr.us-isof-south-1.csp.hci.ic.gov/bottlerocket-control:v0.7.17",
339+
false,
340+
"ecr.aws/arn:aws-iso-f:ecr:us-isof-south-1:111111111111:repository/bottlerocket-control:v0.7.17",
341+
},
342+
{
343+
"Parse special region",
344+
"111111111111.dkr.ecr.us-isof-east-1.csp.hci.ic.gov/bottlerocket-control:v0.7.17",
283345
false,
284-
"ecr.aws/arn:aws:ecr:mx-central-1:111111111111:repository/bottlerocket-control:v0.7.17",
346+
"ecr.aws/arn:aws-iso-f:ecr:us-isof-east-1:111111111111:repository/bottlerocket-control:v0.7.17",
347+
},
348+
{
349+
"Parse special region",
350+
"111111111111.dkr.ecr.eu-isoe-west-1.amazonaws.com/bottlerocket/container:1.2.3",
351+
false,
352+
"ecr.aws/arn:aws-iso-e:ecr:eu-isoe-west-1:111111111111:repository/bottlerocket/container:1.2.3",
285353
},
286354
{
287355
"Parse China regions",

0 commit comments

Comments
 (0)