Expedited image manifest digest reporting #4177
Merged
+3,015
−226
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR contains all the changes for expedited image digest reporting enhancement. The functional changes are listed below.
Image
field in the task payload, Agent will resolve the manifest digest for the container image during the container's transition toMANIFEST_PULLED
state. Digest will be resolved by calling the image repository if image pull is required for the container and by inspecting a locally available image if image pull is not required for the container.MANIFEST_PULLED
state, then Agent will make a STSC (SubmitTaskStateChange) call to ECS backend to report all the resolved digests for the task.MANIFEST_PULLED
state, then a canonical image reference, prepared using the image repository name and the resolved digest, will be used for pulling the container image. For example, instead ofdocker image pull public.ecr.aws/library/busybox:latest
, Agent will perform the equivalent ofdocker image pull public.ecr.aws/library/busybox@sha256:<resolved-digest>
. After pulling the image, Agent will tag the pulled image with the value of container'sImage
field so that the image is discoverable on the host using the container'sImage
field.Impact
Users can notice these changes in a few ways.
Approved PRs included
This PR merges a feature branch for expedited digest reporting feature to
dev
branch. The individual PRs included in this PR were reviewed in the past and are listed below.Testing
New unit, integration, and functional tests have been added.
Comprehensive manual testing was performed. Stress testing was performed to measure the additional task start delay (results noted above) and it was decided that the additional task start delay is acceptable.
New tests cover the changes: yes
Description for the changelog
Feature: Expedited reporting of container image manifest digests to ECS backend. This change makes Agent resolve container image manifest digests for container images prior to image pulls by either calling image registries or inspecting local images depending on the host state and Agent configuration. Resolved digests will be reported to ECS backend using an additional SubmitTaskStateChange API call.
Does this PR include breaking model changes? If so, Have you added transformation functions?
No breaking model changes included.
Licensing
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.