From 06638872d08401eef9b03dcc154b27976b9bfb0f Mon Sep 17 00:00:00 2001 From: Jason Hall Date: Thu, 24 Aug 2023 10:21:02 -0400 Subject: [PATCH] update readme Signed-off-by: Jason Hall --- image-copy-ecr/README.md | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/image-copy-ecr/README.md b/image-copy-ecr/README.md index 83235a8..754eae0 100644 --- a/image-copy-ecr/README.md +++ b/image-copy-ecr/README.md @@ -7,7 +7,7 @@ The Terraform does everything: - builds the mirroring app into an image using `ko_build` - deploys the app to a Lambda function - sets up a Chainguard Identity with permissions to pull from the private cgr.dev repo -- allows the Lambda function to assume the puller identity +- allows the Lambda function to assume the puller identity and push to ECR - sets up a subscription to notify the Lambda function when pushes happen to cgr.dev ## Setup @@ -23,8 +23,27 @@ This will prompt for a group ID and destination repo, and show you the resources When the resources are created, any images that are pushed to your group will be mirrored to the ECR repository. -The Lambda function has minimal permissions: it's only allowed to push images to the destination repo. +The Lambda function has minimal permissions: it's only allowed to push images to the destination repo and its sub-repos. The Chainguard identity also has minimal permissions: it only has permission to pull from the source repo. To tear down resources, run `terraform destroy`. + +## Demo + +After setting up the infrastructure as described above: + +```sh +crane cp random.kontain.me/random cgr.dev//random:hello-demo +``` + +This pulls a randomly generated image from `kontain.me` and pushes it to your private registry. + +The Lambda function you set up will fire and copy the image to ECR. A few seconds later: + +```sh +crane ls .dkr.ecr.us-east-1.amazonaws.com/image-copy-ecr/lambda/random +hello-demo +``` + +It worked! 🎉