Authenticate to AWS Using OIDC for Downloading and Verification of Images

verify-kfuse-image:
  stage: verify
  image: alpine:latest

  variables:
    # Image to verify
    IMAGE_NAME: ui
    IMAGE_TAG: "0.1.0-b2274ac0"

    # Cosign configuration
    COSIGN_VERSION: "v3.0.3"
    KMS_KEY: "awskms:///arn:aws:kms:us-west-2:502496443919:alias/kfuse-cosign-signing-key"

    # AWS OIDC authentication
    AWS_ROLE_ARN: "arn:aws:iam::YOUR_AWS_ACCOUNT_ID:role/KloudfuseImageVerificationRole"
    AWS_DEFAULT_REGION: "us-west-2"

  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.example.com

  before_script:
    # Install dependencies
    - apk add --no-cache curl aws-cli jq

    # Install cosign
    - curl -sSfL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" -o /usr/local/bin/cosign
    - chmod +x /usr/local/bin/cosign

    # Authenticate to AWS using OIDC token
    - |
      echo "Assuming AWS role using OIDC..."

      STS_RESPONSE=$(aws sts assume-role-with-web-identity \
        --role-arn "${AWS_ROLE_ARN}" \
        --role-session-name "gitlab-ci-${CI_PROJECT_NAME}-${CI_PIPELINE_ID}" \
        --web-identity-token "${GITLAB_OIDC_TOKEN}" \
        --duration-seconds 3600)

      # Extract and export temporary credentials
      export AWS_ACCESS_KEY_ID=$(echo "${STS_RESPONSE}" | jq -r '.Credentials.AccessKeyId')
      export AWS_SECRET_ACCESS_KEY=$(echo "${STS_RESPONSE}" | jq -r '.Credentials.SecretAccessKey')
      export AWS_SESSION_TOKEN=$(echo "${STS_RESPONSE}" | jq -r '.Credentials.SessionToken')

      echo "✅ Successfully authenticated to AWS"

  script:
    - |
      IMAGE_REF="502496443919.dkr.ecr.us-west-2.amazonaws.com/kfuse/${IMAGE_NAME}:${IMAGE_TAG}"

      # Step 1: Login to Kloudfuse's ECR registry
      echo "Logging in to Kloudfuse ECR..."
      aws ecr get-login-password --region us-west-2 | \
        docker login --username AWS --password-stdin 502496443919.dkr.ecr.us-west-2.amazonaws.com

      # Step 2: Pull the container image
      echo "Pulling image ${IMAGE_REF}..."
      docker pull "${IMAGE_REF}"

      # Step 3: Verify the image signature (optional but recommended)
      echo "Verifying signature for ${IMAGE_REF}..."
      if cosign verify --key "${KMS_KEY}" "${IMAGE_REF}"; then
        echo "✅ Image signature verified successfully"
      else
        echo "⚠️  Warning: Image signature verification FAILED"
        # Uncomment the next line to fail the pipeline on verification failure
        # exit 1
      fi

      echo "✅ Image pulled and verified successfully"

yamlCopied!