From b64386fb610cee26f3fbe8524a2471d9b7854284 Mon Sep 17 00:00:00 2001 From: DhairyaMajmudar Date: Thu, 27 Aug 2026 17:56:33 +0530 Subject: [PATCH 1/4] feat: Remove AWS key and use ECR passwords for docker login Signed-off-by: DhairyaMajmudar --- blackbox | 3 + docs/framework/inventory.framework.md | 52 +++++++++ framework/inventory.framework | 104 +++++++++++++++--- .../module/abstract/check/provision.step | 4 +- module/ansible-aws/check/provision.step | 4 +- module/aws/check/provision.step | 4 +- module/terraform-aws/check/provision.step | 4 +- 7 files changed, 151 insertions(+), 24 deletions(-) diff --git a/blackbox b/blackbox index 620c9a42..f2262a87 100644 --- a/blackbox +++ b/blackbox @@ -54,6 +54,9 @@ blackbox() { # shellcheck disable=SC2155 export BLACKBOX_VERSION="2404" + export BLACKBOX_ECR_TOKEN_DIR="${BLACKBOX_ECR_TOKEN_DIR:-/run/hackerrank/devops-ecr}" + export BLACKBOX_ECR_TOKEN_WAIT_SECONDS="${BLACKBOX_ECR_TOKEN_WAIT_SECONDS:-30}" + export BLACKBOX_FLAG__DEBUG_MODE=${BLACKBOX_FLAG__DEBUG_MODE:-no} # shellcheck disable=SC2155 export BLACKBOX_FLAG__STEP_PROVISION=$(awk -v master="yes" -v user="${BLACKBOX_FLAG__STEP_PROVISION:-yes}" 'END { print ($0 == "blackbox") ? user : master }' <(findmnt -n --mountpoint="/blackbox" --output="SOURCE")) diff --git a/docs/framework/inventory.framework.md b/docs/framework/inventory.framework.md index 4aed472f..84b4b420 100644 --- a/docs/framework/inventory.framework.md +++ b/docs/framework/inventory.framework.md @@ -18,6 +18,8 @@ Inventory handler * [blackbox.framework.inventory.snapshot.digest](#blackboxframeworkinventorysnapshotdigest) * [blackbox.framework.inventory.snapshot.verify](#blackboxframeworkinventorysnapshotverify) * [blackbox.framework.inventory.snapshot.__init](#blackboxframeworkinventorysnapshotinit) +* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread) +* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin) * [blackbox.framework.inventory.ecr.login](#blackboxframeworkinventoryecrlogin) * [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout) * [blackbox.framework.inventory.provision](#blackboxframeworkinventoryprovision) @@ -187,6 +189,51 @@ _Function has no arguments._ ## blackbox.framework.inventory.ecr.* +### blackbox.framework.inventory.ecr.token.read + +#### Example + +```bash +# Read the private ECR password +blackbox.framework.inventory.ecr.token.read private-password +``` + +#### Arguments + +* **$1** (type=enum): Token file name + +#### Exit codes + +* **0**: If a non-empty token was read, which is printed to stdout +* **1**: If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" + +#### See also + +* [blackbox.framework.inventory.ecr.token.login](#blackboxframeworkinventoryecrtokenlogin) + +### blackbox.framework.inventory.ecr.token.login + +#### Example + +```bash +# Log in to the private registry +blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password +``` + +#### Arguments + +* **$1** (type=string): Registry +* **$2** (type=enum): Token file name + +#### Exit codes + +* **0**: If both the root and "$BLACKBOX_USER_NAME" logins succeeded +* **1**: If no token could be read, or either login failed + +#### See also + +* [blackbox.framework.inventory.ecr.token.read](#blackboxframeworkinventoryecrtokenread) + ### blackbox.framework.inventory.ecr.login #### Example @@ -198,6 +245,11 @@ blackbox.framework.inventory.ecr.login _Function has no arguments._ +#### Exit codes + +* **0**: If the private registry login succeeded +* **1**: If the private registry login failed + #### See also * [blackbox.framework.inventory.ecr.logout](#blackboxframeworkinventoryecrlogout) diff --git a/framework/inventory.framework b/framework/inventory.framework index 12cb63a7..136f420d 100644 --- a/framework/inventory.framework +++ b/framework/inventory.framework @@ -249,10 +249,89 @@ blackbox.framework.inventory() { blackbox.framework.inventory.ecr() { # @section blackbox.framework.inventory.ecr.* + # Reads an ECR docker-login password from the host credential handoff + # + # ECR credentials are refreshed out of band on the host and published atomically + # under "$BLACKBOX_ECR_TOKEN_DIR" (write to a temporary file, then rename), so a + # reader here never observes a partially written password. The publish can lag + # behind the start of a provision, hence the bounded wait. + # + # @arg $1 type=enum Token file name + # + # @exitcode 0 If a non-empty token was read, which is printed to stdout + # @exitcode 1 If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" + # + # @example + # # Read the private ECR password + # blackbox.framework.inventory.ecr.token.read private-password + # + # @see blackbox.framework.inventory.ecr.token.login + function blackbox.framework.inventory.ecr.token.read() { + typeset -r name=$1 + typeset -ri wait_seconds="$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" + typeset -ri interval_seconds=2 + typeset -i waited=0 + typeset token + + while true; do + if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then + printf "%s" "$token" + return 0 + fi + + (( waited < wait_seconds )) || break + + sleep "$interval_seconds" + waited=$(( waited + interval_seconds )) + done + + printf "error: *** ECR token '%s/%s' was not available within %ss\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" "$wait_seconds" >&2 + return 1 + } + + # Logs in to a Docker registry with a password from the host credential handoff + # + # The token is read before any existing credential is dropped. The machine image + # bakes a "docker login" at build time whose token is hours or days stale, so it + # cannot be trusted once the handoff is the credential source, but discarding it + # before a fresh token is in hand would turn a missing handoff into + # "Your authorization token has expired" on a later pull, hiding the real cause. + # On a successful read the baked credential is dropped for both users. + # + # @arg $1 type=string Registry + # @arg $2 type=enum Token file name + # + # @exitcode 0 If both the root and "$BLACKBOX_USER_NAME" logins succeeded + # @exitcode 1 If no token could be read, or either login failed + # + # @example + # # Log in to the private registry + # blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password + # + # @see blackbox.framework.inventory.ecr.token.read + function blackbox.framework.inventory.ecr.token.login() { + typeset -r registry=$1 + typeset -r name=$2 + typeset token + + token=$(blackbox.framework.inventory.ecr.token.read "$name") || return 1 + + { + docker logout "$registry" &>/dev/null + sudo -u "$BLACKBOX_USER_NAME" docker logout "$registry" &>/dev/null + } + + docker login --username AWS --password-stdin "$registry" <<<"$token" \ + && sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin "$registry" <<<"$token" + } + # Logs in to Amazon ECR # # @noargs # + # @exitcode 0 If the private registry login succeeded + # @exitcode 1 If the private registry login failed + # # @example # # Logs in to Amazon ECR # blackbox.framework.inventory.ecr.login @@ -263,27 +342,20 @@ blackbox.framework.inventory() { blackbox.framework.trace "${FUNCNAME[0]}" "$*" <<<"" } + # TODO: the ECR login itself no longer needs the AWS CLI, but this call is what + # installs the localstack endpoint shim and the placeholder AWS_* environment the + # "aws", "aws-stdl", "ansible-aws" and "terraform-aws" modules rely on, and none of + # them provisions "awscli" itself. Remove once they declare the dependency. blackbox.framework.inventory.provision awscli - ( - export AWS_DEFAULT_REGION="us-east-1" - # shellcheck disable=SC2155 - export AWS_ACCESS_KEY_ID=$(base64 -d <(base64 -d <<<"UVV0SlFWSTJUemRIU2s1WVZGbEtOVFJNU1U4PQo=")) - # shellcheck disable=SC2155 - export AWS_SECRET_ACCESS_KEY=$(base64 -d <(base64 -d <<<"YVZWNlRtcExlWEpJWVhOeE5UUjVUR05QTlZSbFRraEhlVWxsYzJOMVkxRkJSazVqWTJJeFpRPT0K")) - # shellcheck disable=SC2155 - local ECR_PASSWORD=$(/usr/local/aws-cli/v2/current/bin/aws ecr get-login-password --region "$AWS_DEFAULT_REGION") - - docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD" - sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin 134148934511.dkr.ecr.us-east-1.amazonaws.com <<<"$ECR_PASSWORD" + ( + blackbox.framework.inventory.ecr.token.login 134148934511.dkr.ecr.us-east-1.amazonaws.com private-password || exit 1 { # TODO: for backwards compatibility with public ECR repositories, and should be removed when all questions are moved to private ECR repositories - # shellcheck disable=SC2155 - local ECR_PASSWORD_PUBLIC=$(/usr/local/aws-cli/v2/current/bin/aws ecr-public get-login-password --region "$AWS_DEFAULT_REGION") - - docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC" - sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin public.ecr.aws/b0k9n8x8 <<<"$ECR_PASSWORD_PUBLIC" + blackbox.framework.inventory.ecr.token.login public.ecr.aws/b0k9n8x8 public-password || { + printf "warn: *** public ECR login failed, questions hosted on public repositories will not pull\n" >&2 + } } ) 2>&1 # ¯\_(ツ)_/¯ } diff --git a/framework/module/abstract/check/provision.step b/framework/module/abstract/check/provision.step index 60e75236..5a200a68 100644 --- a/framework/module/abstract/check/provision.step +++ b/framework/module/abstract/check/provision.step @@ -43,9 +43,9 @@ blackbox.framework.module.abstract.check.provision() { fi if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi : <<< blackbox.module.*.check.provision diff --git a/module/ansible-aws/check/provision.step b/module/ansible-aws/check/provision.step index 762ce5e4..f784d919 100644 --- a/module/ansible-aws/check/provision.step +++ b/module/ansible-aws/check/provision.step @@ -31,9 +31,9 @@ blackbox.module.ansible-aws.check.provision() { } if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then diff --git a/module/aws/check/provision.step b/module/aws/check/provision.step index 1b1b3a10..644d8bb5 100644 --- a/module/aws/check/provision.step +++ b/module/aws/check/provision.step @@ -24,9 +24,9 @@ blackbox.module.aws.check.provision() { fi if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --volume="/tmp:/tmp:rw" --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then diff --git a/module/terraform-aws/check/provision.step b/module/terraform-aws/check/provision.step index 0690f4dc..f538bdda 100644 --- a/module/terraform-aws/check/provision.step +++ b/module/terraform-aws/check/provision.step @@ -31,9 +31,9 @@ blackbox.module.terraform-aws.check.provision() { } if ( grep -q '^init$' <(ps -p 1 -o comm=) ); then - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" else - docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" + docker run -di --hostname="$BLACKBOX_SPAWN" --network="host" --name="$BLACKBOX_SPAWN" --privileged --cgroupns=host --volume="${BLACKBOX_DIR}:${BLACKBOX_DIR}:ro" --volume="${BLACKBOX_USER_QUESTION_DIR}:${BLACKBOX_USER_QUESTION_DIR}:rw" --volume="${BLACKBOX_STORAGE_DIR}:${BLACKBOX_STORAGE_DIR}:ro" --env="BLACKBOX_ECR_TOKEN_DIR=${BLACKBOX_ECR_TOKEN_DIR}" --volume="${BLACKBOX_ECR_TOKEN_DIR}:${BLACKBOX_ECR_TOKEN_DIR}:ro" "134148934511.dkr.ecr.us-east-1.amazonaws.com/hr/blackbox_2404:${BLACKBOX_MODULE_NAME}" fi if [ -n "$BLACKBOX_PROVISION_WITH_OPTS" ]; then From a41b0d2cf268696efa2d2299608eb9aa01d749d4 Mon Sep 17 00:00:00 2001 From: dhairya-majmudar Date: Mon, 31 Aug 2026 00:11:52 +0530 Subject: [PATCH 2/4] cut short comments Signed-off-by: dhairya-majmudar --- framework/inventory.framework | 20 ++------------------ 1 file changed, 2 insertions(+), 18 deletions(-) diff --git a/framework/inventory.framework b/framework/inventory.framework index 136f420d..791cfb8f 100644 --- a/framework/inventory.framework +++ b/framework/inventory.framework @@ -249,12 +249,7 @@ blackbox.framework.inventory() { blackbox.framework.inventory.ecr() { # @section blackbox.framework.inventory.ecr.* - # Reads an ECR docker-login password from the host credential handoff - # - # ECR credentials are refreshed out of band on the host and published atomically - # under "$BLACKBOX_ECR_TOKEN_DIR" (write to a temporary file, then rename), so a - # reader here never observes a partially written password. The publish can lag - # behind the start of a provision, hence the bounded wait. + # Reads an ECR docker-login password from the host credential handoff, with a bounded wait for the atomic publish under "$BLACKBOX_ECR_TOKEN_DIR" # # @arg $1 type=enum Token file name # @@ -289,14 +284,7 @@ blackbox.framework.inventory() { return 1 } - # Logs in to a Docker registry with a password from the host credential handoff - # - # The token is read before any existing credential is dropped. The machine image - # bakes a "docker login" at build time whose token is hours or days stale, so it - # cannot be trusted once the handoff is the credential source, but discarding it - # before a fresh token is in hand would turn a missing handoff into - # "Your authorization token has expired" on a later pull, hiding the real cause. - # On a successful read the baked credential is dropped for both users. + # Logs in to a Docker registry with a password from the host credential handoff, dropping the stale baked-in credential only after a fresh token is read # # @arg $1 type=string Registry # @arg $2 type=enum Token file name @@ -342,10 +330,6 @@ blackbox.framework.inventory() { blackbox.framework.trace "${FUNCNAME[0]}" "$*" <<<"" } - # TODO: the ECR login itself no longer needs the AWS CLI, but this call is what - # installs the localstack endpoint shim and the placeholder AWS_* environment the - # "aws", "aws-stdl", "ansible-aws" and "terraform-aws" modules rely on, and none of - # them provisions "awscli" itself. Remove once they declare the dependency. blackbox.framework.inventory.provision awscli ( From b26357bfa245ed9066bcbb6c67927e3dd3aa7054 Mon Sep 17 00:00:00 2001 From: dhairya-majmudar Date: Mon, 31 Aug 2026 01:43:25 +0530 Subject: [PATCH 3/4] remove no-op docker logout Signed-off-by: dhairya-majmudar --- framework/inventory.framework | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/framework/inventory.framework b/framework/inventory.framework index 791cfb8f..bc2674fe 100644 --- a/framework/inventory.framework +++ b/framework/inventory.framework @@ -284,7 +284,7 @@ blackbox.framework.inventory() { return 1 } - # Logs in to a Docker registry with a password from the host credential handoff, dropping the stale baked-in credential only after a fresh token is read + # Logs in to a Docker registry, for both root and "$BLACKBOX_USER_NAME", with a password from the host credential handoff # # @arg $1 type=string Registry # @arg $2 type=enum Token file name @@ -304,11 +304,6 @@ blackbox.framework.inventory() { token=$(blackbox.framework.inventory.ecr.token.read "$name") || return 1 - { - docker logout "$registry" &>/dev/null - sudo -u "$BLACKBOX_USER_NAME" docker logout "$registry" &>/dev/null - } - docker login --username AWS --password-stdin "$registry" <<<"$token" \ && sudo -u "$BLACKBOX_USER_NAME" docker login --username AWS --password-stdin "$registry" <<<"$token" } From 4428e666dac5ed400bbf509510e6faa542aa6bb9 Mon Sep 17 00:00:00 2001 From: dhairya-majmudar Date: Mon, 31 Aug 2026 12:09:45 +0530 Subject: [PATCH 4/4] remove blackbox retries Signed-off-by: dhairya-majmudar --- blackbox | 1 - docs/framework/inventory.framework.md | 2 +- framework/inventory.framework | 24 +++++++----------------- 3 files changed, 8 insertions(+), 19 deletions(-) diff --git a/blackbox b/blackbox index f2262a87..f7383c53 100644 --- a/blackbox +++ b/blackbox @@ -55,7 +55,6 @@ blackbox() { export BLACKBOX_VERSION="2404" export BLACKBOX_ECR_TOKEN_DIR="${BLACKBOX_ECR_TOKEN_DIR:-/run/hackerrank/devops-ecr}" - export BLACKBOX_ECR_TOKEN_WAIT_SECONDS="${BLACKBOX_ECR_TOKEN_WAIT_SECONDS:-30}" export BLACKBOX_FLAG__DEBUG_MODE=${BLACKBOX_FLAG__DEBUG_MODE:-no} # shellcheck disable=SC2155 diff --git a/docs/framework/inventory.framework.md b/docs/framework/inventory.framework.md index 84b4b420..ee9d2718 100644 --- a/docs/framework/inventory.framework.md +++ b/docs/framework/inventory.framework.md @@ -205,7 +205,7 @@ blackbox.framework.inventory.ecr.token.read private-password #### Exit codes * **0**: If a non-empty token was read, which is printed to stdout -* **1**: If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" +* **1**: If the token was missing or empty #### See also diff --git a/framework/inventory.framework b/framework/inventory.framework index bc2674fe..cae09bed 100644 --- a/framework/inventory.framework +++ b/framework/inventory.framework @@ -249,12 +249,12 @@ blackbox.framework.inventory() { blackbox.framework.inventory.ecr() { # @section blackbox.framework.inventory.ecr.* - # Reads an ECR docker-login password from the host credential handoff, with a bounded wait for the atomic publish under "$BLACKBOX_ECR_TOKEN_DIR" + # Reads an ECR docker-login password from the host credential handoff published under "$BLACKBOX_ECR_TOKEN_DIR" # # @arg $1 type=enum Token file name # # @exitcode 0 If a non-empty token was read, which is printed to stdout - # @exitcode 1 If no token appeared within "$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" + # @exitcode 1 If the token was missing or empty # # @example # # Read the private ECR password @@ -263,24 +263,14 @@ blackbox.framework.inventory() { # @see blackbox.framework.inventory.ecr.token.login function blackbox.framework.inventory.ecr.token.read() { typeset -r name=$1 - typeset -ri wait_seconds="$BLACKBOX_ECR_TOKEN_WAIT_SECONDS" - typeset -ri interval_seconds=2 - typeset -i waited=0 typeset token - while true; do - if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then - printf "%s" "$token" - return 0 - fi - - (( waited < wait_seconds )) || break - - sleep "$interval_seconds" - waited=$(( waited + interval_seconds )) - done + if token=$(cat "${BLACKBOX_ECR_TOKEN_DIR}/${name}" 2>/dev/null) && [ -n "$token" ]; then + printf "%s" "$token" + return 0 + fi - printf "error: *** ECR token '%s/%s' was not available within %ss\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" "$wait_seconds" >&2 + printf "error: *** ECR token '%s/%s' is not available\n" "$BLACKBOX_ECR_TOKEN_DIR" "$name" >&2 return 1 }