fix: AWS ECR token too long cause nginx emerg error

Author: geoffreyme

files/nginx.conf

@@ -18,8 +18,19 @@ http {
   # this is necessary for us to be able to disable request buffering in all cases
   proxy_http_version 1.1;
 
+  lua_shared_dict token_dict 5m;
+
   # will run before forking out nginx worker processes
-  init_by_lua_block { require "cjson" }
+  init_by_lua_block {
+    require "cjson"
+
+    local token_file = io.open('/usr/local/openresty/nginx/token.txt', 'r')
+    if token_file then
+        local data = token_file:read()
+        ngx.shared.token_dict:set("ecr_token", data)
+        token_file:close()
+    end
+  }
 
   #https://docs.docker.com/registry/recipes/nginx/#setting-things-up
   map $upstream_http_docker_distribution_api_version $docker_distribution_api_version {
@@ -29,6 +40,10 @@ http {
   server {
     listen PORT SSL_LISTEN default_server;
 
+    set_by_lua_block $http_authorization {
+        return ngx.shared.token_dict:get("ecr_token")
+    }
+
     SSL_INCLUDE
 
     # Cache

files/renew_token.sh

@@ -6,6 +6,7 @@ set -xe
 CONFIG=/usr/local/openresty/nginx/conf/nginx.conf
 AUTH=$(grep  X-Forwarded-User $CONFIG | awk '{print $4}'| uniq|tr -d "\n\r")
 
+set +x
 # retry till new get new token
 while true; do
   TOKEN=$(aws ecr get-login --no-include-email | awk '{print $6}')
@@ -17,6 +18,7 @@ done
 
 AUTH_N=$(echo AWS:${TOKEN}  | base64 |tr -d "[:space:]")
 
-sed -i "s|${AUTH%??}|${AUTH_N}|g" $CONFIG
+echo $AUTH_N > /usr/local/openresty/nginx/token.txt
+set -x
 
 nginx -s reload

files/startup.sh

@@ -77,12 +77,14 @@ if [ -z "$AWS_USE_EC2_ROLE_FOR_AUTH" ] || [ "$AWS_USE_EC2_ROLE_FOR_AUTH" != "tru
 fi
 chmod 600 -R ${AWS_FOLDER}
 
+set +x
 # add the auth token in default.conf
 AUTH=$(grep  X-Forwarded-User $CONFIG | awk '{print $4}'| uniq|tr -d "\n\r")
 TOKEN=$(aws ecr get-login --no-include-email | awk '{print $6}')
 AUTH_N=$(echo AWS:${TOKEN}  | base64 |tr -d "[:space:]")
-sed -i "s|${AUTH%??}|${AUTH_N}|g" $CONFIG
+echo $AUTH_N > /usr/local/openresty/nginx/token.txt
 
+set -x
 # make sure cache directory has correct ownership
 chown -R nginx:nginx /cache