Update doc for ecr and codeartifact

What would you like Renovate to be able to do?

In order to successfully self-host renovate to work with aws ecr for docker images and aws codeartifact for nuget/pypi/... quite some configuration effort is needed. I wanted to share my results so the documentation can be updated. Hopefully this will be helpful to someone =)

If you have any ideas on how this should be implemented, please tell us here.

First of all, codeartifact requires temporary credentials. I obtained those using an init-container. Here is my cron job:

kind: CronJob
metadata:
  name: renovate
  namespace: renovate
spec:
  schedule: '@daily'
  concurrencyPolicy: Forbid
  jobTemplate:
    spec:
      backoffLimit: 0
      template:
        spec:
          serviceAccountName: renovate
          initContainers:
            - name: init-config
              image: <e.g. alpine with aws cli installed>
              # code artifact is only accessible via temporary credentials. 
              # Until https://github.com/renovatebot/renovate/issues/11325 is done, we need to obtain the token manually, and insert it into the config
              command:
                - /bin/bash
                - -c
                - |
                  #!/bin/bash
                  AUTH_TOKEN=$( aws codeartifact get-authorization-token --domain <domain> --domain-owner 123456789012 --query authorizationToken --output text )
                  sed "s/<PLACEHOLDER>/$AUTH_TOKEN/g" /workdir/config.json >> /processed/config.json
              volumeMounts:
                - name: config-volume
                  mountPath: /processed
                - name: template-volume
                  mountPath: /workdir
          containers:
            - name: renovate
              image: renovate/renovate:31.28
              env:
                - name: LOG_LEVEL
                  value: info
                - name: RENOVATE_CONFIG_FILE
                  value: "/usr/src/app/config/config.json"
              envFrom:
                - secretRef:
                    name: bitbucket-renovate-token
                - secretRef:
                    name: github-renovate-token
              volumeMounts:
                - name: config-volume
                  mountPath: /usr/src/app/config/
                  readOnly: true
          restartPolicy: Never
          volumes:
            - name: template-volume
              configMap:
                name: renovate-config
            - name: config-volume
              emptyDir: {}

This is my config map:

kind: ConfigMap
metadata:
  name: renovate-config
  namespace: renovate
data:
  config.json: |-
    {
      "dryRun"            : false,
      "autodiscover"      : true,
      "platform"          : "bitbucket-server",
      "endpoint"          : "https://git.my_company.com",
      "username"          : "<the bots name>",
      "gitAuthor"         : "<the bots name>",
      "packageRules": [
        {
          "matchDatasources": ["nuget"],
          "registryUrls": [
            "https://api.nuget.org/v3/index.json",
            "https://<domain>-123456789012.d.codeartifact.<region>.amazonaws.com/nuget/<nu-get-repo>/v3/index.json"
          ]
        }
      ],
      "hostRules"    : [
        {"matchHost":"https://123456789012.dkr.ecr.<region>.amazonaws.com", "enabled":true, "hostType":"docker"},
        {"matchHost":"<domain>-123456789012.d.codeartifact.<region>.amazonaws.com", "enabled":true, "token":"<PLACEHOLDER>"}
      ],
      "branchPrefix"       : "renovate-",
      "onboardingBranch"   : "renovate-configure"
    }

In addition, you need to create the namespace, service account and secrets obviously, as well as a iam role for the service account. I use the following iam role, which (in my opinion) has sufficiently minimalistic permissions:

    "Version" : "2012-10-17",
    "Statement" : [
      {
        "Sid" : "Stmt1642517217303",
        "Action" : [
          "ecr:BatchCheckLayerAvailability",
          "ecr:BatchGetImage",
          "ecr:DescribeImageReplicationStatus",
          "ecr:DescribeImageScanFindings",
          "ecr:DescribeImages",
          "ecr:DescribePullThroughCacheRules",
          "ecr:DescribeRegistry",
          "ecr:DescribeRepositories",
          "ecr:GetDownloadUrlForLayer",
          "ecr:GetLifecyclePolicy",
          "ecr:GetLifecyclePolicyPreview",
          "ecr:GetRegistryPolicy",
          "ecr:GetRegistryScanningConfiguration",
          "ecr:GetRepositoryPolicy",
          "ecr:ListImages",
          "ecr:ListTagsForResource"
        ],
        "Effect" : "Allow",
        "Resource" : "arn:aws:ecr:<region>:123456789012:repository/*"
      },
      {
        "Sid" : "Stmt1642517217304",
        "Action": ["ecr:GetAuthorizationToken"],
        "Effect": "Allow",
        "Resource": "*"        
      },
      {
        "Sid" : "Stmt1642517217305",
        "Action" : [
          "codeartifact:Get*",
          "codeartifact:List*",
          "codeartifact:Describe*",
          "codeartifact:Read*"
        ],
        "Effect" : "Allow",
        "Resource" : [
          "arn:aws:codeartifact:<region>:123456789012:domain/<domain>",
          "arn:aws:codeartifact:<region>:123456789012:repository/<domain>/*"
        ]
      },
      {
        "Sid" : "Stmt1642517217306",
        "Action" : "sts:GetServiceBearerToken",
        "Effect" : "Allow",
        "Resource" : "*",
        "Condition" : {
          "StringEquals" : {
            "sts:AWSServiceName" : "codeartifact.amazonaws.com"
          }
        }
      }
    ]
  }

Is this a feature you are interested in implementing yourself?

No