Merge pull request #72 from mozilla-iam/#-and-build

chore(codebuild): Login to dockerhub

buildspec.yml

@@ -15,6 +15,7 @@ phases:
       - echo "running for ${COMMIT_SHA} in ${DEPLOY_ENV}"
       - aws eks update-kubeconfig --name $CLUSTER
       - aws ecr get-login --region us-west-2 --no-include-email | bash
+      - echo $DOCKERHUB_PASSWORD | docker login -u $DOCKERHUB_USERNAME --pasword-stdin
   build:
     commands:
       - if [ "$PR" = 1 ]; then myke docker; fi

terraform/codebuild/main.tf

@@ -29,6 +29,19 @@ resource "aws_codebuild_project" "build" {
       name  = "DOCKER_REPO"
       value = aws_ecr_repository.registry.repository_url
     }
+
+    environment_variable {
+      name  = "DOCKERHUB_USERNAME"
+      type  = "SECRETS_MANAGER"
+      value = "/CodeBuild/dockerhub:username"
+    }
+
+    environment_variable {
+      name  = "DOCKERHUB_PASSWORD"
+      type  = "SECRETS_MANAGER"
+      value = "/CodeBuild/dockerhub:password"
+    }
+
   }
 
   source {
@@ -115,6 +128,15 @@ resource "aws_iam_role_policy" "codebuild" {
         "eks:DescribeCluster"
       ],
       "Resource": "*"
+    },
+    {
+      "Effect": "Allow",
+      "Resource": [
+        "arn:aws:secretsmanager:*:*:secret:/CodeBuild/dockerhub*"
+      ],
+      "Action": [
+        "secretsmanager:GetSecretValue"
+      ]
     }
   ]
 }