registry: add AWS registry implementation by iamabhilaksh · Pull Request #324 · salesforce/multicloudj

iamabhilaksh · 2026-03-04T07:02:04Z

AWS Registry Implementation + OCI Client Interceptor Refactoring + Region Support

Summary

The primary change in this PR is the full implementation of AwsRegistry for AWS Elastic
Container Registry (ECR). As a result of this implementation, two related refactoring changes
were required: moving AuthStrippingInterceptor to the correct module, and adding region
support to ContainerRegistryClient.

Changes

1. `AwsRegistry` implementation (primary change)

New full implementation of AbstractRegistry for AWS ECR.

Authenticates via ECR's GetAuthorizationToken API returning a Base64-encoded token
Token is cached in memory and proactively refreshed at the halfway point of its 12-hour
validity window (6 hours)
Falls back to the cached token if a refresh fails, rather than failing the request
Lazily initializes EcrClient with double-checked locking for thread safety
Supports credentialsOverrider for custom AWS credential injection
Builder validates registryEndpoint and region at build time
pom.xml updated with required AWS SDK ECR dependency

2. `AuthStrippingInterceptor` moved to `registry-aws` (required by `AwsRegistry`)

AwsRegistry needs an interceptor that strips the Authorization header when redirected
to S3 for blob downloads (ECR serves layer blobs via pre-signed S3 URLs). This logic was
already present as a nested static class inside OciRegistryClient in the shared
registry-client module, which was incorrect — it is purely AWS-specific behaviour.

Extracted AuthStrippingInterceptor into a top-level class in registry-aws
Removed the nested class from OciRegistryClient
OciRegistryClient now fetches interceptors dynamically via AbstractRegistry.getInterceptors()
AwsRegistry overrides getInterceptors() to return AuthStrippingInterceptor
GcpRegistry uses the default empty list

3. Region support in `ContainerRegistryClient` (required by `AwsRegistry`)

AwsRegistry requires a region to construct the ECR client, but ContainerRegistryClientBuilder
had no way to pass one — causing AwsRegistry to fail at build time with AWS region is required.

Pattern followed: identical to IamClient / AbstractIam in this codebase.

AbstractRegistry.Builder — added withRegion(String) and a protected String region field
AbstractRegistry — added a protected final String region instance field assigned from the
builder in the base constructor, mirroring AbstractIam
AwsRegistry — reads inherited region from AbstractRegistry; no private copy needed
ContainerRegistryClientBuilder — added withRegion(String) delegating to the underlying
registry builder

Tests

AwsRegistryTest — full unit test coverage: auth token caching, proactive refresh, fallback
on refresh failure, getInterceptors(), close(), builder validation for missing required
fields, credentialsOverrider, region handling
AuthStrippingInterceptorTest — dedicated test class covering parameterized host matching,
header stripping, null host handling, and case-insensitive host comparisons

Design Notes

Why region in the base class? Region is AWS-specific but exposed at the
ContainerRegistryClientBuilder level so callers remain provider-agnostic. GcpRegistry
silently ignores it — same contract as IamClient.withRegion() already in this SDK.
Why not extract region from the endpoint URL? Fragile — couples the implementation to
AWS URL format conventions, breaks for PrivateLink/FIPS endpoints, and does not generalise
to other providers.
Why move AuthStrippingInterceptor? Separation of concerns — the shared registry-client
module should have no knowledge of AWS-specific HTTP behaviour.

Add AwsRegistry, an AWS-specific implementation of AbstractRegistry that uses ECR token-based authentication. Add AuthStrippingInterceptor to strip Authorization headers for non-registry hosts, preventing credential leakage on redirects. Add unit tests for both classes, and add junit-jupiter-params test dependency to registry-aws pom.xml.

codecov-commenter · 2026-03-04T07:12:21Z

Codecov Report

❌ Patch coverage is 78.09524% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.99%. Comparing base (be14812) to head (a266b07).

Files with missing lines	Patch %	Lines
...lesforce/multicloudj/registry/aws/AwsRegistry.java	80.24%	13 Missing and 3 partials ⚠️
.../multicloudj/registry/driver/AbstractRegistry.java	25.00%	3 Missing ⚠️
...loudj/registry/client/ContainerRegistryClient.java	0.00%	2 Missing ⚠️
...multicloudj/registry/driver/OciRegistryClient.java	75.00%	1 Missing and 1 partial ⚠️

❌ Your patch status has failed because the patch coverage (78.09%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #324      +/-   ##
============================================
+ Coverage     81.98%   81.99%   +0.01%     
- Complexity      520      552      +32     
============================================
  Files           181      183       +2     
  Lines         11119    11199      +80     
  Branches       1480     1494      +14     
============================================
+ Hits           9116     9183      +67     
- Misses         1340     1351      +11     
- Partials        663      665       +2

Flag	Coverage Δ
unittests	`81.99% <78.09%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java

sharatchandrag

Plz check the test coverage, other than that lgtm

registry/registry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AwsRegistry.java

...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java

…input parameter to ContainerRegistryClient

sandeepvinayak · 2026-03-06T02:17:35Z

...istry-client/src/main/java/com/salesforce/multicloudj/registry/driver/OciRegistryClient.java

     */
-    public OciRegistryClient(String registryEndpoint, AuthProvider authProvider) {
-        this(registryEndpoint, authProvider, null);
+    public OciRegistryClient(String registryEndpoint, AbstractRegistry registry) {


@iamabhilaksh I remember we had refactored this name from client to transport , was that PR closed ?

That PR was not closed as it had multiple overlapping code changes leading to serious merge conflicts. I'll be raising a separate PR for all the same :)

sandeepvinayak · 2026-03-06T02:18:47Z

...istry-client/src/main/java/com/salesforce/multicloudj/registry/driver/OciRegistryClient.java

-            return host;
+            this.httpClient = builder.build();
        }
+        this.tokenExchange = new BearerTokenExchange(this.httpClient);


wasn't the Bearer method provider specific ?

That PR was not closed as it had multiple overlapping code changes leading to serious merge conflicts. I'll be raising a separate PR for all the same :)

sandeepvinayak · 2026-03-06T02:19:27Z

...gistry-client/src/main/java/com/salesforce/multicloudj/registry/driver/AbstractRegistry.java

+    protected List<HttpRequestInterceptor> getInterceptors() {
+        return Collections.emptyList();
+    }


iamabhilaksh · 2026-03-06T08:25:22Z

Note : Checkstyle config was updated and formatted code was pushed. This lead to merge conflicts and now the build is failing because of checkstyle errors.

…input parameter to ContainerRegistryClient

Made-with: Cursor

sandeepvinayak · 2026-03-06T17:47:55Z

...stry/registry-aws/src/test/java/com/salesforce/multicloudj/registry/aws/AwsRegistryTest.java

+    registry.close(); // should not throw
+  }
+
+  static Stream<org.junit.jupiter.params.provider.Arguments>


there doesn't seems to be any conflicting definition

Addressed in the follow-up revision.

salesforce-cla bot added the cla:signed label Mar 4, 2026

sharatchandrag reviewed Mar 4, 2026

View reviewed changes

...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java Outdated Show resolved Hide resolved

sharatchandrag approved these changes Mar 5, 2026

View reviewed changes

sharatchandrag suggested changes Mar 5, 2026

View reviewed changes

roseyang62 reviewed Mar 5, 2026

View reviewed changes

registry/registry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AwsRegistry.java Outdated Show resolved Hide resolved

roseyang62 reviewed Mar 5, 2026

View reviewed changes

...stry-aws/src/main/java/com/salesforce/multicloudj/registry/aws/AuthStrippingInterceptor.java Show resolved Hide resolved

Moving AuthStrippingInterceptor to registry-aws and adding region as …

307d75e

…input parameter to ContainerRegistryClient

iamabhilaksh force-pushed the registry/implement-aws-registry branch from 1a3b77d to 307d75e Compare March 5, 2026 10:19

Merge branch 'main' into registry/implement-aws-registry

d03c49d

iamabhilaksh mentioned this pull request Mar 5, 2026

registry: update example to include AWS provider usage #329

Open

sharatchandrag approved these changes Mar 5, 2026

View reviewed changes

roseyang62 approved these changes Mar 5, 2026

View reviewed changes

sandeepvinayak reviewed Mar 6, 2026

View reviewed changes

Merge branch 'main' into registry/implement-aws-registry

761c5fd

iamabhilaksh added 5 commits March 6, 2026 16:15

Moving AuthStrippingInterceptor to registry-aws and adding region as …

b7379e6

…input parameter to ContainerRegistryClient

fix checkstyle errors

b38cfa9

Made-with: Cursor

fix checkstyle errors

1f2aaed

Made-with: Cursor

fix checkstyle errors

afd4824

Made-with: Cursor

revert checkstyle suppressions change

186c9fb

sandeepvinayak reviewed Mar 6, 2026

View reviewed changes

remove fully qualified class names when there's no conflicting defintion

14b4a3d

iamabhilaksh force-pushed the registry/implement-aws-registry branch from cf81cd1 to 14b4a3d Compare March 9, 2026 10:46

Merge branch 'main' into registry/implement-aws-registry

a266b07

sandeepvinayak approved these changes Mar 9, 2026

View reviewed changes

sandeepvinayak merged commit 077997e into salesforce:main Mar 9, 2026
5 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

registry: add AWS registry implementation#324

registry: add AWS registry implementation#324
sandeepvinayak merged 11 commits intosalesforce:mainfrom
iamabhilaksh:registry/implement-aws-registry

iamabhilaksh commented Mar 4, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

sharatchandrag left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

sandeepvinayak Mar 6, 2026

Uh oh!

iamabhilaksh Mar 6, 2026

Uh oh!

sandeepvinayak Mar 6, 2026

Uh oh!

iamabhilaksh Mar 6, 2026

Uh oh!

sandeepvinayak Mar 6, 2026

Uh oh!

iamabhilaksh commented Mar 6, 2026

Uh oh!

sandeepvinayak Mar 6, 2026

Uh oh!

iamabhilaksh Mar 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

iamabhilaksh commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

AWS Registry Implementation + OCI Client Interceptor Refactoring + Region Support

Summary

Changes

1. AwsRegistry implementation (primary change)

2. AuthStrippingInterceptor moved to registry-aws (required by AwsRegistry)

3. Region support in ContainerRegistryClient (required by AwsRegistry)

Tests

Design Notes

Uh oh!

codecov-commenter commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

sharatchandrag left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sandeepvinayak Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

iamabhilaksh Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

sandeepvinayak Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

iamabhilaksh Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

sandeepvinayak Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

iamabhilaksh commented Mar 6, 2026

Uh oh!

sandeepvinayak Mar 6, 2026

Choose a reason for hiding this comment

Uh oh!

iamabhilaksh Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

iamabhilaksh commented Mar 4, 2026 •

edited

Loading

1. `AwsRegistry` implementation (primary change)

2. `AuthStrippingInterceptor` moved to `registry-aws` (required by `AwsRegistry`)

3. Region support in `ContainerRegistryClient` (required by `AwsRegistry`)

codecov-commenter commented Mar 4, 2026 •

edited

Loading

sharatchandrag left a comment •

edited

Loading