Add App.imageFromAwsEcr for reading images from AWS ECR

modal-js/src/app.ts

@@ -1,13 +1,16 @@
 import { ClientError, Status } from "nice-grpc";
 import {
+  ImageRegistryConfig,
   NetworkAccess_NetworkAccessType,
   ObjectCreationType,
+  RegistryAuthType,
 } from "../proto/modal_proto/api";
 import { client } from "./client";
 import { environmentName } from "./config";
 import { fromRegistryInternal, Image } from "./image";
 import { Sandbox } from "./sandbox";
 import { NotFoundError } from "./errors";
+import { Secret } from "./secret";
 
 export type LookupOptions = {
   environment?: string;
@@ -82,4 +85,19 @@ export class App {
   async imageFromRegistry(tag: string): Promise<Image> {
     return await fromRegistryInternal(this.appId, tag);
   }
+
+  async imageFromAwsEcr(tag: string, secret: Secret): Promise<Image> {
+    if (!secret.secretId) {
+      throw new Error(
+        "secret must be a reference to an existing Secret, e.g. `await Secret.fromName('my_secret')`",
+      );
+    }
+
+    const imageRegistryConfig = {
+      registryAuthType: RegistryAuthType.REGISTRY_AUTH_TYPE_AWS,
+      secretId: secret.secretId,
+    };
+
+    return await fromRegistryInternal(this.appId, tag, imageRegistryConfig);
+  }
 }

modal-js/src/config.ts

@@ -78,3 +78,7 @@ export const profile = getProfile(process.env["MODAL_PROFILE"] || undefined);
 export function environmentName(environment?: string): string {
   return environment || profile.environment || "";
 }
+
+export function imageBuilderVersion(version?: string): string {
+  return version || process.env.MODAL_IMAGE_BUILDER_VERSION || "2024.10";
+}

modal-js/src/image.ts

@@ -3,8 +3,11 @@ import {
   GenericResult,
   GenericResult_GenericStatus,
   ImageMetadata,
+  ImageRegistryConfig,
 } from "../proto/modal_proto/api";
 import { client } from "./client";
+import { imageBuilderVersion } from "./config";
+import { Secret } from "./secret";
 
 export class Image {
   readonly imageId: string;
@@ -17,14 +20,16 @@ export class Image {
 export async function fromRegistryInternal(
   appId: string,
   tag: string,
+  imageRegistryConfig?: ImageRegistryConfig,
 ): Promise<Image> {
   const resp = await client.imageGetOrCreate({
     appId,
     image: {
       dockerfileCommands: [`FROM ${tag}`],
+      imageRegistryConfig: imageRegistryConfig,
     },
     namespace: DeploymentNamespace.DEPLOYMENT_NAMESPACE_WORKSPACE,
-    builderVersion: "2024.10", // TODO: make this configurable
+    builderVersion: imageBuilderVersion(),
   });
 
   let result: GenericResult;
@@ -79,6 +84,5 @@ export async function fromRegistryInternal(
       `Image build for ${resp.imageId} failed with unknown status: ${result.status}`,
     );
   }
-
   return new Image(resp.imageId);
 }

modal-js/src/index.ts

@@ -9,3 +9,4 @@ export {
 export { Function_ } from "./function";
 export { Image } from "./image";
 export { Sandbox, type StdioBehavior, type StreamMode } from "./sandbox";
+export { Secret } from "./secret";

modal-js/src/secret.ts

@@ -0,0 +1,43 @@
+import { DeploymentNamespace } from "../proto/modal_proto/api";
+import { client } from "./client";
+import { environmentName as configEnvironmentName } from "./config";
+import { ClientError, Status } from "nice-grpc";
+import { NotFoundError } from "./errors";
+
+export type SecretFromNameOptions = {
+  environment?: string;
+  requiredKeys?: string[];
+};
+
+export class Secret {
+  readonly secretId: string;
+
+  constructor(secretId: string) {
+    this.secretId = secretId;
+  }
+
+  static async fromName(
+    name: string,
+    options?: SecretFromNameOptions,
+  ): Promise<Secret> {
+    try {
+      const resp = await client.secretGetOrCreate({
+        deploymentName: name,
+        namespace: DeploymentNamespace.DEPLOYMENT_NAMESPACE_WORKSPACE,
+        environmentName: configEnvironmentName(options?.environment),
+        requiredKeys: options?.requiredKeys ?? [],
+      });
+      return new Secret(resp.secretId);
+    } catch (err) {
+      if (err instanceof ClientError && err.code === Status.NOT_FOUND)
+        throw new NotFoundError(err.details);
+      if (
+        err instanceof ClientError &&
+        err.code === Status.FAILED_PRECONDITION &&
+        err.details.includes("Secret is missing key")
+      )
+        throw new NotFoundError(err.details);
+      throw err;
+    }
+  }
+}

modal-js/test/secret.test.ts

@@ -0,0 +1,35 @@
+import { NotFoundError, Secret } from "modal";
+import { expect, test } from "vitest";
+
+test("SecretFromName", async () => {
+  const secret = await Secret.fromName("test-secret");
+  expect(secret).toBeDefined();
+  expect(secret.secretId).toBeDefined();
+  expect(secret.secretId).toMatch(/^st-/);
+
+  const promise = Secret.fromName("missing-secret");
+  await expect(promise).rejects.toThrowError(
+    /Could not find secret: 'missing-secret'./,
+  );
+});
+
+test("SecretFromNameWithEnvironment", async () => {
+  const secret = await Secret.fromName("test-secret", {
+    environment: "libmodal",
+  });
+  expect(secret).toBeDefined();
+});
+
+test("SecretFromNameWithRequiredKeys", async () => {
+  const secret = await Secret.fromName("test-secret", {
+    requiredKeys: ["a", "b", "c"],
+  });
+  expect(secret).toBeDefined();
+
+  const promise = Secret.fromName("test-secret", {
+    requiredKeys: ["a", "b", "c", "missing-key"],
+  });
+  await expect(promise).rejects.toThrowError(
+    /Secret is missing key\(s\): missing-key/,
+  );
+});