As part of the MCSP adoption initiative within FedRamp boundary, product teams are required to transfer container images across various container registries in compliance with stringent FedRAMP security and operational standards.

Manual synchronization of these images is not only labor-intensive but also prone to errors and lacks traceability. To overcome these limitations, the Image Sync Automation solution provides a Kubernetes-native, GitOps-driven framework that automates and simplifies the synchronization process. This approach ensures secure, consistent, and auditable image transfers across registries, aligning with FedRAMP compliance requirements.

Solution Overview: Image Sync Automation

The Image Sync Automation solution is built using Kubernetes-native tools and follows a GitOps approach. It is packaged as a Helm chart and integrates seamlessly with ArgoCD, enabling automated synchronization of container images from source registries (e.g., IBM Cloud Registry, Amazon ECR) to destination registries (typically Amazon ECR).

Core Components

1. Image Sync Helm Chart: Orchestrates the synchronization workflow.
2. Image Sync Tool: A purpose-built container image containing all required utilities.
3. ArgoCD Integration: Enables GitOps-based automation and deployment triggers.
4. Configuration Management: Flexible setup using Helm values.yaml files.
5. Secret Management: Secure handling of registry credentials using Kubernetes secrets and AWS Secrets Manager.

Workflow Overview

The synchronization process follows a GitOps-driven pipeline:

1. Configuration: Define source and destination image mappings in the Helm chart’s values.yaml.
2. Version Control: Commit and push changes to the Git repository.
3. Change Detection: ArgoCD monitors the repository for updates.
4. Deployment Trigger: ArgoCD initiates Helm chart deployment upon detecting changes.
5. Image Synchronization: The sync tool pulls images from source registries and pushes them to destination registries.
6. Completion & Notification: The process concludes with optional notifications (e.g., Slack alerts).

Technology Stack

The solution utilizes several open-source tools:

• Skopeo: Facilitates image copying between registries.
• AWS CLI: Manages authentication with Amazon ECR.
• JQ: Parses configuration files to extract image data.
• Bash: Orchestrates the synchronization logic.
• Curl: Sends notifications via webhooks.

Configuration Details

Image Mapping Format

images:
  - source: "source-registry.com/repo/image:tag"
    destination: "destination-registry.com/repo/image:tag"
  - source: "another-source-registry.com/repo/image:tag"
    destination: "another-destination-registry.com/repo/image:tag"

Credential Management

source:
  secretName: source-creds
  access_key: <arn path | base64encode>
  access_secret: <arn path | base64encode>
destination:
  secretName: destination-creds
  access_key: <arn path | base64encode>
  access_secret: <arn path | base64encode>

ArgoCD Integration

spec:
  project: <product name>
  source:
    repoURL: <gitlab url>
    targetRevision: <branch name>
    path: resources/image-sync-chart
  plugin:
    name: argocd-vault-plugin-helm-custom
    env:
      - name: HELM_VALUES
        value: '--values values.yaml --values ../../configurations/aws-prod/us-gov-east/instance1/environment-config.yaml --name-template image-sync-chart --namespace <namespace>'
      - name: HELM_ARGS
        value: --set server={{ cluster.url }},region={{ region }}
      - name: AVP_SECRET
        value: <AVP Secret>

Key Use Cases

• Cross-Cloud Synchronization: Maintain consistent images across multiple cloud platforms.
• Security Boundary Transitions: Transfer images securely between public and private or air-gapped environments.
• GitOps Ready: The whole automation triggers through a git commit.

Benefits

Implementing the Image Sync Automation solution provides:

• Reduced Manual Effort: Eliminates repetitive synchronization tasks.
• Enhanced Security: Ensures secure and auditable image transfers.
• Improved Reliability: Automation minimizes human error.
• Governance & Traceability: Git-based version control for all sync activities.
• Operational Efficiency: Frees up engineering resources for core development tasks.

Conclusion

The Image Sync Automation solution offers a robust, scalable, and secure method for managing container image synchronization across registries. By leveraging Kubernetes-native tools like Helm and ArgoCD, and integrating powerful utilities such as Skopeo and AWS CLI, it aligns with modern DevOps practices and supports diverse organizational needs.

Whether you're operating in a multi-cloud environment, managing secure deployments, or aiming to streamline operations, this solution provides a comprehensive and automated approach to container image management.

Helm chart and details can be found below:

https://github.ibm.com/automation-paas-cd-pipeline/image-sync-automation