feat: ecr cross account assume role

chart-sync/go.mod

@@ -4,7 +4,7 @@ go 1.24.0
 
 toolchain go1.24.3
 
-replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72
+replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee
 
 require (
 	github.com/caarlos0/env v3.5.0+incompatible

chart-sync/go.sum

@@ -43,8 +43,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72 h1:L1XupZ+tdjzcMjtzncAszzTeDZKUm7h9HThDIFYkTz4=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72/go.mod h1:CqHnvltrng2O40hNGVl56qcAhv7tiXK3SKx47LKyE/A=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee h1:uLS8EqfamtnQpChZVwW3f34uF/TSk9CocfcFDFq5sAQ=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee/go.mod h1:d6awSGcXQc57s4PJlwcyACovJ4PgBmR9jZJ7h6CScUM=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/distribution/distribution/v3 v3.0.0 h1:q4R8wemdRQDClzoNNStftB2ZAfqOiN6UX90KJc4HjyM=

chart-sync/vendor/modules.txt

@@ -95,7 +95,7 @@ github.com/containerd/platforms
 # github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
 ## explicit
 github.com/davecgh/go-spew/spew
-# github.com/devtron-labs/common-lib v0.19.1 => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72
+# github.com/devtron-labs/common-lib v0.19.1 => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee
 ## explicit; go 1.24.0
 github.com/devtron-labs/common-lib/constants
 github.com/devtron-labs/common-lib/fetchAllEnv
@@ -975,4 +975,4 @@ sigs.k8s.io/structured-merge-diff/v4/value
 sigs.k8s.io/yaml
 sigs.k8s.io/yaml/goyaml.v2
 sigs.k8s.io/yaml/goyaml.v3
-# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72
+# github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee

ci-runner/executor/util/envUtils.go

@@ -19,13 +19,14 @@ package util
 import (
 	"encoding/json"
 	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
 	"github.com/caarlos0/env"
 	"github.com/devtron-labs/ci-runner/helper"
 	"github.com/devtron-labs/ci-runner/pubsub"
 	"github.com/devtron-labs/ci-runner/util"
-	"os"
-	"strconv"
-	"strings"
 )
 
 type ScriptEnvVariables struct {
@@ -96,6 +97,7 @@ func GetGlobalEnvVariables(ciCdRequest *helper.CiCdTriggerEvent) (*ScriptEnvVari
 		envs["ACCESS_KEY"] = ciCdRequest.CommonWorkflowRequest.AccessKey
 		envs["SECRET_KEY"] = ciCdRequest.CommonWorkflowRequest.SecretKey
 		envs["AWS_REGION"] = ciCdRequest.CommonWorkflowRequest.AwsRegion
+		envs["ASSUME_ROLE_ARN"] = ciCdRequest.CommonWorkflowRequest.AssumeRoleArn
 		envs["LAST_FETCHED_TIME"] = ciCdRequest.CommonWorkflowRequest.CiArtifactLastFetch.String()
 
 		//adding some envs for Image scanning plugin

ci-runner/go.mod

@@ -4,7 +4,7 @@ go 1.24.0
 
 toolchain go1.24.3
 
-replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72
+replace github.com/devtron-labs/common-lib => github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee
 
 require (
 	github.com/Knetic/govaluate v3.0.0+incompatible
@@ -136,12 +136,12 @@ require (
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	golang.org/x/crypto v0.40.0 // indirect
-	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
 	golang.org/x/sys v0.34.0 // indirect
 	golang.org/x/term v0.33.0 // indirect
 	golang.org/x/text v0.27.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
 	google.golang.org/api v0.234.0 // indirect
 	google.golang.org/genproto v0.0.0-20250519155744-55703ea1f237 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 // indirect

ci-runner/go.sum

@@ -114,8 +114,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72 h1:L1XupZ+tdjzcMjtzncAszzTeDZKUm7h9HThDIFYkTz4=
-github.com/devtron-labs/devtron-services/common-lib v0.0.0-20251217072256-6c8429c6cc72/go.mod h1:CqHnvltrng2O40hNGVl56qcAhv7tiXK3SKx47LKyE/A=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee h1:uLS8EqfamtnQpChZVwW3f34uF/TSk9CocfcFDFq5sAQ=
+github.com/devtron-labs/devtron-services/common-lib v0.0.0-20260407100807-54c5450aedee/go.mod h1:d6awSGcXQc57s4PJlwcyACovJ4PgBmR9jZJ7h6CScUM=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v28.1.1+incompatible h1:eyUemzeI45DY7eDPuwUcmDyDj1pM98oD5MdSpiItp8k=
@@ -393,8 +393,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
-golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
+golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
 golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
 golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -450,8 +450,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
 golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
-golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
-golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=

ci-runner/helper/DockerHelper.go

@@ -23,11 +23,24 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
+	"io/ioutil"
+	"log"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
-	"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/aws/aws-sdk-go/service/sts"
 	"github.com/caarlos0/env"
 	cicxt "github.com/devtron-labs/ci-runner/executor/context"
 	bean2 "github.com/devtron-labs/ci-runner/helper/bean"
@@ -38,18 +51,6 @@ import (
 	"github.com/devtron-labs/common-lib/utils/dockerOperations"
 	"github.com/devtron-labs/common-lib/utils/retryFunc"
 	"golang.org/x/sync/errgroup"
-	"io"
-	"io/ioutil"
-	"log"
-	"os"
-	"os/exec"
-	"path"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"sync"
-	"syscall"
-	"time"
 )
 
 const (
@@ -173,6 +174,7 @@ func (impl *DockerHelperImpl) StartDockerDaemonAndDockerLogin(commonWorkflowRequ
 				AwsRegion:          commonWorkflowRequest.AwsRegion,
 				AccessKey:          commonWorkflowRequest.AccessKey,
 				SecretKey:          commonWorkflowRequest.SecretKey,
+				AssumeRoleArn:      commonWorkflowRequest.AssumeRoleArn,
 				DockerRegistryURL:  commonWorkflowRequest.IntermediateDockerRegistryUrl,
 				DockerRegistryType: commonWorkflowRequest.DockerRegistryType,
 				CredentialsType:    commonWorkflowRequest.CredentialsType,
@@ -210,7 +212,7 @@ const CacheModeMax = "max"
 const CacheModeMin = "min"
 
 type DockerCredentials struct {
-	DockerUsername, DockerPassword, AwsRegion, AccessKey, SecretKey, DockerRegistryURL, DockerRegistryType, CredentialsType string
+	DockerUsername, DockerPassword, AwsRegion, AccessKey, SecretKey, AssumeRoleArn, DockerRegistryURL, DockerRegistryType, CredentialsType string
 }
 
 type EnvironmentVariables struct {
@@ -234,29 +236,54 @@ func (impl *DockerHelperImpl) DockerLogin(ciContext cicxt.CiContext, dockerCrede
 			accessKey, secretKey := dockerCredentials.AccessKey, dockerCredentials.SecretKey
 			//fmt.Printf("accessKey %s, secretKey %s\n", accessKey, secretKey)
 
-			var creds *credentials.Credentials
+			var sess *session.Session
+			var err error
 
-			if len(dockerCredentials.AccessKey) == 0 || len(dockerCredentials.SecretKey) == 0 {
-				//fmt.Println("empty accessKey or secretKey")
-				sess, err := session.NewSession(&aws.Config{
+			if len(accessKey) == 0 || len(secretKey) == 0 {
+				// Case 1: IAM role — use default credential chain (IRSA, instance profile, task role, env vars)
+				sess, err = session.NewSession(&aws.Config{
 					Region: &dockerCredentials.AwsRegion,
 				})
-				if err != nil {
-					log.Println(err)
-					return err
-				}
-				creds = ec2rolecreds.NewCredentials(sess)
 			} else {
-				creds = credentials.NewStaticCredentials(accessKey, secretKey, "")
+				// Case 2: Static credentials
+				creds := credentials.NewStaticCredentials(accessKey, secretKey, "")
+				sess, err = session.NewSession(&aws.Config{
+					Region:      &dockerCredentials.AwsRegion,
+					Credentials: creds,
+				})
 			}
-			sess, err := session.NewSession(&aws.Config{
-				Region:      &dockerCredentials.AwsRegion,
-				Credentials: creds,
-			})
 			if err != nil {
 				log.Println(err)
 				return err
 			}
+
+			// If an assume role ARN is provided, use STS to assume the cross-account role
+			if len(dockerCredentials.AssumeRoleArn) > 0 {
+				stsClient := sts.New(sess)
+				assumeOutput, err := stsClient.AssumeRole(&sts.AssumeRoleInput{
+					RoleArn:         aws.String(dockerCredentials.AssumeRoleArn),
+					RoleSessionName: aws.String("devtron-ecr-cross-account"),
+				})
+				if err != nil {
+					log.Printf("error in assuming role %s: %v", dockerCredentials.AssumeRoleArn, err)
+					return err
+				}
+				assumedCreds := credentials.NewStaticCredentials(
+					*assumeOutput.Credentials.AccessKeyId,
+					*assumeOutput.Credentials.SecretAccessKey,
+					*assumeOutput.Credentials.SessionToken,
+				)
+				sess, err = session.NewSession(&aws.Config{
+					Region:      &dockerCredentials.AwsRegion,
+					Credentials: assumedCreds,
+				})
+				if err != nil {
+					log.Println(err)
+					return err
+				}
+				log.Printf("STS AssumeRole successful for cross-account ECR access, roleArn: %s", dockerCredentials.AssumeRoleArn)
+			}
+
 			svc := ecr.New(sess)
 			input := &ecr.GetAuthorizationTokenInput{}
 			authData, err := svc.GetAuthorizationToken(input)
@@ -293,7 +320,11 @@ func (impl *DockerHelperImpl) DockerLogin(ciContext cicxt.CiContext, dockerCrede
 			log.Println(err)
 			return err
 		}
-		log.Println("Docker login successful with username ", username, " on docker registry URL ", dockerCredentials.DockerRegistryURL)
+		if len(dockerCredentials.AssumeRoleArn) > 0 {
+			log.Printf("Docker login successful (cross-account via AssumeRole %s) with username %s on registry %s", dockerCredentials.AssumeRoleArn, username, dockerCredentials.DockerRegistryURL)
+		} else {
+			log.Println("Docker login successful with username ", username, " on docker registry URL ", dockerCredentials.DockerRegistryURL)
+		}
 		return nil
 	}
 
@@ -1428,6 +1459,7 @@ func (impl *DockerHelperImpl) GetDockerAuthConfigForPrivateRegistries(workflowRe
 				AccessKeyEcr:       workflowRequest.AccessKey,
 				SecretAccessKeyEcr: workflowRequest.SecretKey,
 				EcrRegion:          workflowRequest.AwsRegion,
+				AssumeRoleArnEcr:   workflowRequest.AssumeRoleArn,
 				IsRegistryPrivate:  true,
 			}
 		}