Skip to content

Commit 22da7b3

Browse files
CLJ2006CLJ2006
committed
ecr lifecycle policy updates
1 parent 7bd107a commit 22da7b3

File tree

7 files changed

+118
-39
lines changed

7 files changed

+118
-39
lines changed

‎ansible/build-ecs-proxies.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,5 @@
2020

2121
roles:
2222
- setup-facts
23-
- build-ecs-proxies
23+
- build-ecs-proxies
24+
- ecr-lifecycle-policy

‎ansible/deploy-ecs-proxies.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,7 @@
4545

4646
roles:
4747
- setup-facts
48-
- deploy-ecs-proxies
48+
- deploy-ecs-proxies
49+
50+
# - role: ecr-lifecycle-policy
51+
# when: RELEASE_RELEASEID is defined and RELEASE_RELEASEID != ""

‎ansible/roles/build-ecs-proxies/files/ecr_lifecycle.json‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,38 +2,38 @@
22
"rules": [
33
{
44
"rulePriority": 1,
5-
"description": "Always keep the latest 500 ECS builds -AMEND NUMBER AFTER TEST",
5+
"description": "Keep the 10 most recent ECS deployment images - AMEND NUMBER AFTER TEST",
66
"selection": {
77
"tagStatus": "tagged",
88
"tagPrefixList": ["ecs-"],
99
"countType": "imageCountMoreThan",
10-
"countNumber": 500
10+
"countNumber": 800
1111
},
1212
"action": {
1313
"type": "expire"
1414
}
1515
},
1616
{
1717
"rulePriority": 2,
18-
"description": "Keep the latest 50 non‑ECS builds -AMEND NUMBER AFTER TEST",
18+
"description": "Keep the 5 most recent build images - AMEND NUMBER AFTER TEST",
1919
"selection": {
2020
"tagStatus": "tagged",
21-
"tagPatternList": ["*"],
21+
"tagPrefixList": [""],
2222
"countType": "imageCountMoreThan",
23-
"countNumber": 500
23+
"countNumber": 800
2424
},
2525
"action": {
2626
"type": "expire"
2727
}
2828
},
2929
{
3030
"rulePriority": 3,
31-
"description": "Expire untagged images older than 3 days",
31+
"description": "Never expire the 'latest' tag",
3232
"selection": {
33-
"tagStatus": "untagged",
34-
"countType": "sinceImagePushed",
35-
"countUnit": "days",
36-
"countNumber": 3
33+
"tagStatus": "tagged",
34+
"tagPrefixList": ["latest"],
35+
"countType": "imageCountMoreThan",
36+
"countNumber": 9999
3737
},
3838
"action": {
3939
"type": "expire"

‎ansible/roles/build-ecs-proxies/tasks/build-container.yml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -32,28 +32,28 @@
3232
cmd: "docker push {{ image_name }}"
3333
when: build_result.rc == 0
3434

35-
- name: Get existing lifecycle policy JSON for {{ service_id }}_{{ item }}
36-
ansible.builtin.command: >
37-
{{ aws_cmd }} ecr get-lifecycle-policy
38-
--repository-name {{ service_id }}_{{ item }}
39-
--query 'lifecyclePolicyText'
40-
--output text
41-
register: existing_policy
42-
failed_when: false
43-
changed_when: false
44-
45-
- name: Read lifecycle policy from the local file
46-
ansible.builtin.slurp:
47-
src: "{{ role_path }}/files/ecr_lifecycle.json"
48-
register: desired_policy_raw
49-
50-
- name: Decode lifecycle policy file
51-
set_fact:
52-
desired_policy: "{{ desired_policy_raw.content | b64decode }}"
53-
54-
- name: Apply lifecycle policy to ecr {{ service_id }}_{{ item }} if different
55-
ansible.builtin.command: >
56-
{{ aws_cmd }} ecr put-lifecycle-policy
57-
--repository-name {{ service_id }}_{{ item }}
58-
--lifecycle-policy-text file://{{ role_path }}/files/ecr_lifecycle.json
59-
when: existing_policy.stdout != desired_policy and build_result.rc == 0
35+
# - name: Get existing lifecycle policy JSON for {{ service_id }}_{{ item }}
36+
# ansible.builtin.command: >
37+
# {{ aws_cmd }} ecr get-lifecycle-policy
38+
# --repository-name {{ service_id }}_{{ item }}
39+
# --query 'lifecyclePolicyText'
40+
# --output text
41+
# register: existing_policy
42+
# failed_when: false
43+
# changed_when: false
44+
45+
# - name: Read lifecycle policy from the local file
46+
# ansible.builtin.slurp:
47+
# src: "{{ role_path }}/files/ecr_lifecycle.json"
48+
# register: desired_policy_raw
49+
50+
# - name: Decode lifecycle policy file
51+
# set_fact:
52+
# desired_policy: "{{ desired_policy_raw.content | b64decode }}"
53+
54+
# - name: Apply lifecycle policy to ecr {{ service_id }}_{{ item }} if different
55+
# ansible.builtin.command: >
56+
# {{ aws_cmd }} ecr put-lifecycle-policy
57+
# --repository-name {{ service_id }}_{{ item }}
58+
# --lifecycle-policy-text file://{{ role_path }}/files/ecr_lifecycle.json
59+
# when: existing_policy.stdout != desired_policy and build_result.rc == 0

‎ansible/roles/deploy-ecs-proxies/tasks/main.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,10 +83,10 @@
8383
when: not do_not_terraform
8484

8585
- name: Retag and promote ECS image (release pipelines only)
86-
#when: pr_number is not defined or pr_number == ""
86+
when: pr_number is not defined or pr_number == ""
8787
vars:
8888
PTL_REG: "{{ PTL_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com"
89-
PROD_REG: "{{ PTL_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com"
89+
PROD_REG: "{{ PROD_ACCOUNT_ID }}.dkr.ecr.eu-west-2.amazonaws.com"
9090
IMG: "{{ service_id }}_{{ ecs_service[0].name }}"
9191
TAG: "{{ build_label }}"
9292
NEW: "ecs-{{ build_label }}"

‎ansible/roles/ecr-lifecycle-policy/tasks/files/ecr_lifecycle.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
{
2+
"rules": [
3+
{
4+
"rulePriority": 1,
5+
"description": "Keep the 10 most recent ECS deployment images - AMEND NUMBER AFTER TEST",
6+
"selection": {
7+
"tagStatus": "tagged",
8+
"tagPrefixList": ["ecs-"],
9+
"countType": "imageCountMoreThan",
10+
"countNumber": 800
11+
},
12+
"action": {
13+
"type": "expire"
14+
}
15+
},
16+
{
17+
"rulePriority": 2,
18+
"description": "Keep the 5 most recent build images - AMEND NUMBER AFTER TEST",
19+
"selection": {
20+
"tagStatus": "tagged",
21+
"tagPrefixList": [""],
22+
"countType": "imageCountMoreThan",
23+
"countNumber": 800
24+
},
25+
"action": {
26+
"type": "expire"
27+
}
28+
},
29+
{
30+
"rulePriority": 3,
31+
"description": "Never expire the 'latest' tag",
32+
"selection": {
33+
"tagStatus": "tagged",
34+
"tagPrefixList": ["latest"],
35+
"countType": "imageCountMoreThan",
36+
"countNumber": 9999
37+
},
38+
"action": {
39+
"type": "expire"
40+
}
41+
}
42+
]
43+
}

‎ansible/roles/ecr-lifecycle-policy/tasks/main.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
- name: Get existing lifecycle policy JSON for {{ service_id }}_{{ item }}
2+
ansible.builtin.command: >
3+
{{ aws_cmd }} ecr get-lifecycle-policy
4+
--repository-name {{ service_id }}_{{ item }}
5+
--query 'lifecyclePolicyText'
6+
--output text
7+
register: existing_policy_raw
8+
failed_when: false
9+
changed_when: false
10+
11+
- name: Parse existing lifecycle policy JSON
12+
set_fact:
13+
existing_policy_json: "{{ existing_policy_raw.stdout | default('{}') | from_json }}"
14+
when: existing_policy_raw.stdout != ""
15+
16+
- name: Read lifecycle policy from the local file
17+
ansible.builtin.slurp:
18+
src: "{{ role_path }}/files/ecr_lifecycle.json"
19+
register: desired_policy_raw
20+
21+
- name: Decode lifecycle policy file
22+
set_fact:
23+
desired_policy_json: "{{ desired_policy_raw.content | b64decode | from_json }}"
24+
25+
- name: Apply lifecycle policy to ecr {{ service_id }}_{{ item }} if different
26+
ansible.builtin.command: >
27+
{{ aws_cmd }} ecr put-lifecycle-policy
28+
--repository-name {{ service_id }}_{{ item }}
29+
--lifecycle-policy-text file://{{ role_path }}/files/ecr_lifecycle.json
30+
when:
31+
- existing_policy_json != desired_policy_json
32+
- env != "prod" or prod_lifecycle_update_allowed

0 commit comments

Comments
 (0)