jogold / cloudstructs

High-level constructs for AWS CDK
Apache License 2.0
167 stars 13 forks source link

Toolkit Cleaner: Images with prefixed tags always deleted #246

Closed kurtisz closed 10 months ago

kurtisz commented 11 months ago

The CDK App class can be given a custom synthesizer, with the option to prefix the image tag for any Docker image in the app, i.e.:

const app = new cdk.App({
  defaultStackSynthesizer: new DefaultStackSynthesizer({
    dockerTagPrefix: 'api-svc'
  })
})

Creating a Docker image in this stack results in an image tag like api-svc5a7abf30ce10141adcb73c9b836ec68479c65fb4d1693df160563e36ece0d55e.

The Extract Template Hashes function specifically looks for an asset with just a hash (no prefix)...

const hashes = template.TemplateBody.match(/[a-f0-9]{64}/g);

...which means a Docker image with an additional prefix does not get extracted and ultimately gets deleted.

Admittedly, I originally used the image prefix feature as a means of tagging images to apply a lifecycle rule to remove old images, and I've moved toward using the Toolkit Cleaner instead (and have since removed the prefix), but in the interim where I had both the prefix and was using the Toolkit Cleaner, the Toolkit Cleaner was removing all of my images, even when they were in use.

A few routes that might work:

  1. Document that the Toolkit Cleaner is not compatible with usage of ECR image tag prefixes
  2. Relax the Extract Template Hashes function so it matches something like (just conceptual, not a regex) ':<64-char-hash'
  3. If (2) is untenable, add an optional prop to the ToolkitCleaner construct for image prefixes and pass those in to the Extract Template Hashes function to search for any assets starting with one of those prefixes and ending with the traditional 64-char hash. This would leave it to users to specify the prefix to prevent their images from always being deleted.
jogold commented 11 months ago

Hi @kurtisz,

I'm creating a dummy docker image asset here

https://github.com/jogold/cloudstructs/blob/8ff1ab7f1b777ca24a327cf39a10fab599cd992d/src/toolkit-cleaner/index.ts#L60-L62

and use it to get the name of the repository that I need to clean.

I can maybe use the hash of this dummy asset to determine the type of hash that docker images are using. Need to check this.