registry: add AWS registry implementation#324
registry: add AWS registry implementation#324sandeepvinayak merged 11 commits intosalesforce:mainfrom
Conversation
Add AwsRegistry, an AWS-specific implementation of AbstractRegistry that uses ECR token-based authentication. Add AuthStrippingInterceptor to strip Authorization headers for non-registry hosts, preventing credential leakage on redirects. Add unit tests for both classes, and add junit-jupiter-params test dependency to registry-aws pom.xml.
Codecov Report❌ Patch coverage is ❌ Your patch status has failed because the patch coverage (78.09%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #324 +/- ##
============================================
+ Coverage 81.98% 81.99% +0.01%
- Complexity 520 552 +32
============================================
Files 181 183 +2
Lines 11119 11199 +80
Branches 1480 1494 +14
============================================
+ Hits 9116 9183 +67
- Misses 1340 1351 +11
- Partials 663 665 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java
Outdated
Show resolved
Hide resolved
registry/registry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AwsRegistry.java
Outdated
Show resolved
Hide resolved
...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java
Show resolved
Hide resolved
…input parameter to ContainerRegistryClient
iamabhilaksh
force-pushed
the
registry/implement-aws-registry
branch
from
1a3b77d to
307d75e
Compare
| */ | ||
| public OciRegistryClient(String registryEndpoint, AuthProvider authProvider) { | ||
| this(registryEndpoint, authProvider, null); | ||
| public OciRegistryClient(String registryEndpoint, AbstractRegistry registry) { |
There was a problem hiding this comment.
@iamabhilaksh I remember we had refactored this name from client to transport , was that PR closed ?
There was a problem hiding this comment.
That PR was not closed as it had multiple overlapping code changes leading to serious merge conflicts. I'll be raising a separate PR for all the same :)
| return host; | ||
| this.httpClient = builder.build(); | ||
| } | ||
| this.tokenExchange = new BearerTokenExchange(this.httpClient); |
There was a problem hiding this comment.
wasn't the Bearer method provider specific ?
There was a problem hiding this comment.
That PR was not closed as it had multiple overlapping code changes leading to serious merge conflicts. I'll be raising a separate PR for all the same :)
| protected List<HttpRequestInterceptor> getInterceptors() { | ||
| return Collections.emptyList(); | ||
| } |
|
|
…input parameter to ContainerRegistryClient
Made-with: Cursor
Made-with: Cursor
Made-with: Cursor
| registry.close(); // should not throw | ||
| } | ||
|
|
||
| static Stream<org.junit.jupiter.params.provider.Arguments> |
There was a problem hiding this comment.
there doesn't seems to be any conflicting definition
There was a problem hiding this comment.
Addressed in the follow-up revision.
iamabhilaksh
force-pushed
the
registry/implement-aws-registry
branch
from
cf81cd1 to
14b4a3d
Compare
5 participants
AWS Registry Implementation + OCI Client Interceptor Refactoring + Region Support
Summary
The primary change in this PR is the full implementation of
AwsRegistryfor AWS ElasticContainer Registry (ECR). As a result of this implementation, two related refactoring changes
were required: moving
AuthStrippingInterceptorto the correct module, and adding regionsupport to
ContainerRegistryClient.Changes
1.
AwsRegistryimplementation (primary change)New full implementation of
AbstractRegistryfor AWS ECR.GetAuthorizationTokenAPI returning a Base64-encoded tokenvalidity window (6 hours)
EcrClientwith double-checked locking for thread safetycredentialsOverriderfor custom AWS credential injectionregistryEndpointandregionat build timepom.xmlupdated with required AWS SDK ECR dependency2.
AuthStrippingInterceptormoved toregistry-aws(required byAwsRegistry)AwsRegistryneeds an interceptor that strips theAuthorizationheader when redirectedto S3 for blob downloads (ECR serves layer blobs via pre-signed S3 URLs). This logic was
already present as a nested static class inside
OciRegistryClientin the sharedregistry-clientmodule, which was incorrect — it is purely AWS-specific behaviour.AuthStrippingInterceptorinto a top-level class inregistry-awsOciRegistryClientOciRegistryClientnow fetches interceptors dynamically viaAbstractRegistry.getInterceptors()AwsRegistryoverridesgetInterceptors()to returnAuthStrippingInterceptorGcpRegistryuses the default empty list3. Region support in
ContainerRegistryClient(required byAwsRegistry)AwsRegistryrequires a region to construct the ECR client, butContainerRegistryClientBuilderhad no way to pass one — causing
AwsRegistryto fail at build time withAWS region is required.Pattern followed: identical to
IamClient/AbstractIamin this codebase.AbstractRegistry.Builder— addedwithRegion(String)and aprotected String regionfieldAbstractRegistry— added aprotected final String regioninstance field assigned from thebuilder in the base constructor, mirroring
AbstractIamAwsRegistry— reads inheritedregionfromAbstractRegistry; no private copy neededContainerRegistryClientBuilder— addedwithRegion(String)delegating to the underlyingregistry builder
Tests
AwsRegistryTest— full unit test coverage: auth token caching, proactive refresh, fallbackon refresh failure,
getInterceptors(),close(), builder validation for missing requiredfields,
credentialsOverrider, region handlingAuthStrippingInterceptorTest— dedicated test class covering parameterized host matching,header stripping, null host handling, and case-insensitive host comparisons
Design Notes
ContainerRegistryClientBuilderlevel so callers remain provider-agnostic.GcpRegistrysilently ignores it — same contract as
IamClient.withRegion()already in this SDK.AWS URL format conventions, breaks for PrivateLink/FIPS endpoints, and does not generalise
to other providers.
AuthStrippingInterceptor? Separation of concerns — the sharedregistry-clientmodule should have no knowledge of AWS-specific HTTP behaviour.