imjasonh/terraform-playground
1
0
Fork 0
mirror of https://github.com/imjasonh/terraform-playground synced 2026-07-07 23:35:16 +00:00
Code Activity

update readme

Browse source 
Signed-off-by: Jason Hall <jason@chainguard.dev>
This commit is contained in:
Jason Hall 2023-08-24 10:21:02 -04:00
parent b025e5ec4d
commit 06638872d0
Failed to extract signature
1 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
image-copy-ecr/README.md
View file

@ -7,7 +7,7 @@ The Terraform does everything:
- builds the mirroring app into an image using `ko_build`
- deploys the app to a Lambda function
- sets up a Chainguard Identity with permissions to pull from the private cgr.dev repo
- allows the Lambda function to assume the puller identity
- allows the Lambda function to assume the puller identity and push to ECR
- sets up a subscription to notify the Lambda function when pushes happen to cgr.dev
## Setup
@ -23,8 +23,27 @@ This will prompt for a group ID and destination repo, and show you the resources
When the resources are created, any images that are pushed to your group will be mirrored to the ECR repository.
The Lambda function has minimal permissions: it's only allowed to push images to the destination repo.
The Lambda function has minimal permissions: it's only allowed to push images to the destination repo and its sub-repos.
The Chainguard identity also has minimal permissions: it only has permission to pull from the source repo.
To tear down resources, run `terraform destroy`.
## Demo
After setting up the infrastructure as described above:
```sh
crane cp random.kontain.me/random cgr.dev/<org>/random:hello-demo
```
This pulls a randomly generated image from `kontain.me` and pushes it to your private registry.
The Lambda function you set up will fire and copy the image to ECR. A few seconds later:
```sh
crane ls <account-id>.dkr.ecr.us-east-1.amazonaws.com/image-copy-ecr/lambda/random
hello-demo
```
It worked! 🎉