feat: add CloudEvents webhook support for AWS ECR

cmd/common.go

@@ -21,11 +21,19 @@ import (
 
 // WebhookConfig holds the options for the webhook server
 type WebhookConfig struct {
-	Port                        int
-	DockerSecret                string
-	GHCRSecret                  string
-	QuaySecret                  string
-	HarborSecret                string
+	// Port is the port number for the webhook server to listen on
+	Port int
+	// DockerSecret is the secret for validating Docker Hub webhooks
+	DockerSecret string
+	// GHCRSecret is the secret for validating GitHub Container Registry webhooks
+	GHCRSecret string
+	// QuaySecret is the secret for validating Quay webhooks
+	QuaySecret string
+	// HarborSecret is the secret for validating Harbor webhooks
+	HarborSecret string
+	// CloudEventsSecret is the secret for validating CloudEvents webhooks
+	CloudEventsSecret string
+	// RateLimitNumAllowedRequests is the number of allowed requests per hour for rate limiting (0 disables rate limiting)
 	RateLimitNumAllowedRequests int
 }
 
@@ -117,6 +125,7 @@ func SetupWebhookServer(webhookCfg *WebhookConfig, reconciler *controller.ImageU
 	handler.RegisterHandler(webhook.NewGHCRWebhook(webhookCfg.GHCRSecret))
 	handler.RegisterHandler(webhook.NewHarborWebhook(webhookCfg.HarborSecret))
 	handler.RegisterHandler(webhook.NewQuayWebhook(webhookCfg.QuaySecret))
+	handler.RegisterHandler(webhook.NewCloudEventsWebhook(webhookCfg.CloudEventsSecret))
 
 	// Create webhook server
 	server := webhook.NewWebhookServer(webhookCfg.Port, handler, reconciler)

cmd/run.go

@@ -318,6 +318,7 @@ This enables a CRD-driven approach to automated image updates with Argo CD.
 	controllerCmd.Flags().StringVar(&webhookCfg.GHCRSecret, "ghcr-webhook-secret", env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), "Secret for validating GitHub Container Registry webhooks")
 	controllerCmd.Flags().StringVar(&webhookCfg.QuaySecret, "quay-webhook-secret", env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), "Secret for validating Quay webhooks")
 	controllerCmd.Flags().StringVar(&webhookCfg.HarborSecret, "harbor-webhook-secret", env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), "Secret for validating Harbor webhooks")
+	controllerCmd.Flags().StringVar(&webhookCfg.CloudEventsSecret, "cloudevents-webhook-secret", env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), "Secret for validating CloudEvents webhooks")
 	controllerCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-allowed", env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt), "The number of allowed requests in an hour for webhook rate limiting, setting to 0 disables ratelimiting")
 
 	return controllerCmd

cmd/run_test.go

@@ -65,6 +65,7 @@ func TestNewRunCommand(t *testing.T) {
 	asser.Equal(env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), controllerCommand.Flag("ghcr-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), controllerCommand.Flag("quay-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), controllerCommand.Flag("harbor-webhook-secret").Value.String())
+	asser.Equal(env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), controllerCommand.Flag("cloudevents-webhook-secret").Value.String())
 	asser.Equal(strconv.Itoa(env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt)), controllerCommand.Flag("webhook-ratelimit-allowed").Value.String())
 
 	asser.Nil(controllerCommand.Help())

cmd/webhook.go

@@ -41,7 +41,8 @@ Supported registries:
 - Docker Hub
 - GitHub Container Registry (GHCR)
 - Quay
-- Harbor 
+- Harbor
+- AWS ECR (via EventBridge CloudEvents)
 `,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if err := log.SetLogLevel(cfg.LogLevel); err != nil {
@@ -89,6 +90,7 @@ Supported registries:
 	webhookCmd.Flags().StringVar(&webhookCfg.GHCRSecret, "ghcr-webhook-secret", env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), "Secret for validating GitHub Container Registry webhooks")
 	webhookCmd.Flags().StringVar(&webhookCfg.QuaySecret, "quay-webhook-secret", env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), "Secret for validating Quay webhooks")
 	webhookCmd.Flags().StringVar(&webhookCfg.HarborSecret, "harbor-webhook-secret", env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), "Secret for validating Harbor webhooks")
+	webhookCmd.Flags().StringVar(&webhookCfg.CloudEventsSecret, "cloudevents-webhook-secret", env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), "Secret for validating CloudEvents webhooks")
 	webhookCmd.Flags().IntVar(&webhookCfg.RateLimitNumAllowedRequests, "webhook-ratelimit-allowed", env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt), "The number of allowed requests in an hour for webhook rate limiting, setting to 0 disables ratelimiting")
 
 	return webhookCmd

cmd/webhook_test.go

@@ -42,6 +42,7 @@ func TestNewWebhookCommand(t *testing.T) {
 	asser.Equal(env.GetStringVal("GHCR_WEBHOOK_SECRET", ""), controllerCommand.Flag("ghcr-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("QUAY_WEBHOOK_SECRET", ""), controllerCommand.Flag("quay-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), controllerCommand.Flag("harbor-webhook-secret").Value.String())
+	asser.Equal(env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), controllerCommand.Flag("cloudevents-webhook-secret").Value.String())
 	asser.Equal(strconv.Itoa(env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt)), controllerCommand.Flag("webhook-ratelimit-allowed").Value.String())
 
 	asser.Nil(controllerCommand.Help())

config/examples/cloudevents/README.md

@@ -0,0 +1,38 @@
+# CloudEvents Webhook Example
+
+Example Terraform configuration for setting up AWS EventBridge to send ECR push events to ArgoCD Image Updater via CloudEvents.
+
+## Quick Start
+
+### 1. Configure EventBridge with Terraform
+
+```bash
+cd terraform
+
+# Set your variables
+export TF_VAR_webhook_url="https://your-domain.com/webhook?type=cloudevents"
+export TF_VAR_webhook_secret="your-webhook-secret"
+export TF_VAR_aws_region="us-east-1"
+
+# Apply the configuration
+terraform init
+terraform apply
+
+# Return to parent directory
+cd ..
+```
+
+### 2. Test the Webhook
+
+```bash
+./test-webhook.sh https://your-webhook-url/webhook?type=cloudevents your-secret
+```
+
+## Files
+
+- `terraform/` - EventBridge configuration with input transformer for ECR events
+- `test-webhook.sh` - Script to test the webhook endpoint
+
+## Documentation
+
+For complete setup instructions, see the [webhook documentation](../../../docs/configuration/webhook.md#aws-ecr-via-eventbridge-cloudevents).

config/examples/cloudevents/terraform/main.tf

@@ -0,0 +1,145 @@
+terraform {
+  required_version = ">= 1.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+provider "aws" {
+  region = var.aws_region
+}
+
+# EventBridge Rule to capture ECR push events
+resource "aws_cloudwatch_event_rule" "ecr_push" {
+  name        = "argocd-image-updater-ecr-push"
+  description = "Capture ECR image push events for ArgoCD Image Updater"
+
+  event_pattern = jsonencode({
+    source      = ["aws.ecr"]
+    detail-type = ["ECR Image Action"]
+    detail = {
+      action-type = ["PUSH"]
+      result      = ["SUCCESS"]
+      # Filter for events with image tags (excludes untagged/manifest-only pushes)
+      image-tag = [{
+        exists = true
+      }]
+      # Optional: Filter by specific repositories
+      repository-name = length(var.ecr_repository_filter) > 0 ? var.ecr_repository_filter : null
+    }
+  })
+
+  tags = var.tags
+}
+
+# EventBridge Connection for API authentication
+resource "aws_cloudwatch_event_connection" "webhook" {
+  name               = "argocd-image-updater-webhook"
+  description        = "Connection to ArgoCD Image Updater webhook"
+  authorization_type = "API_KEY"
+
+  auth_parameters {
+    api_key {
+      key   = "X-Webhook-Secret"
+      value = var.webhook_secret
+    }
+  }
+}
+
+# API Destination pointing to ArgoCD Image Updater webhook
+resource "aws_cloudwatch_event_api_destination" "webhook" {
+  name                             = "argocd-image-updater-webhook"
+  description                      = "ArgoCD Image Updater CloudEvents webhook endpoint"
+  invocation_endpoint              = var.webhook_url
+  http_method                      = "POST"
+  invocation_rate_limit_per_second = 10
+  connection_arn                   = aws_cloudwatch_event_connection.webhook.arn
+}
+
+# IAM Role for EventBridge to invoke API Destination
+resource "aws_iam_role" "eventbridge" {
+  name               = "argocd-image-updater-eventbridge-role"
+  assume_role_policy = data.aws_iam_policy_document.eventbridge_assume_role.json
+  tags               = var.tags
+}
+
+data "aws_iam_policy_document" "eventbridge_assume_role" {
+  statement {
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
+    }
+
+    actions = ["sts:AssumeRole"]
+  }
+}
+
+# IAM Policy for EventBridge to invoke API Destination
+resource "aws_iam_role_policy" "eventbridge_invoke_api_destination" {
+  name   = "invoke-api-destination"
+  role   = aws_iam_role.eventbridge.id
+  policy = data.aws_iam_policy_document.eventbridge_invoke_api_destination.json
+}
+
+data "aws_iam_policy_document" "eventbridge_invoke_api_destination" {
+  statement {
+    effect = "Allow"
+
+    actions = [
+      "events:InvokeApiDestination"
+    ]
+
+    resources = [
+      aws_cloudwatch_event_api_destination.webhook.arn
+    ]
+  }
+}
+
+# EventBridge Target with Input Transformer (ECR -> CloudEvents)
+resource "aws_cloudwatch_event_target" "api_destination" {
+  rule      = aws_cloudwatch_event_rule.ecr_push.name
+  target_id = "ArgocdImageUpdaterCloudEvent"
+  arn       = aws_cloudwatch_event_api_destination.webhook.arn
+  role_arn  = aws_iam_role.eventbridge.arn
+
+  input_transformer {
+    input_paths = {
+      id      = "$.id"
+      time    = "$.time"
+      account = "$.account"
+      region  = "$.region"
+      repo    = "$.detail.repository-name"
+      digest  = "$.detail.image-digest"
+      tag     = "$.detail.image-tag"
+    }
+
+    input_template = <<-EOF
+    {
+      "specversion": "1.0",
+      "id": "<id>",
+      "type": "com.amazon.ecr.image.push",
+      "source": "urn:aws:ecr:<region>:<account>:repository/<repo>",
+      "subject": "<repo>:<tag>",
+      "time": "<time>",
+      "datacontenttype": "application/json",
+      "data": {
+        "repositoryName": "<repo>",
+        "imageDigest": "<digest>",
+        "imageTag": "<tag>",
+        "registryId": "<account>"
+      }
+    }
+    EOF
+  }
+
+  retry_policy {
+    maximum_event_age_in_seconds = 3600
+    maximum_retry_attempts       = 3
+  }
+}

config/examples/cloudevents/terraform/outputs.tf

@@ -0,0 +1,20 @@
+output "eventbridge_rule_arn" {
+  description = "ARN of the EventBridge rule"
+  value       = aws_cloudwatch_event_rule.ecr_push.arn
+}
+
+output "api_destination_arn" {
+  description = "ARN of the API destination"
+  value       = aws_cloudwatch_event_api_destination.webhook.arn
+}
+
+output "eventbridge_role_arn" {
+  description = "ARN of the EventBridge IAM role"
+  value       = aws_iam_role.eventbridge.arn
+}
+
+output "webhook_endpoint" {
+  description = "Configured webhook endpoint URL"
+  value       = var.webhook_url
+  sensitive   = true
+}

config/examples/cloudevents/terraform/variables.tf

@@ -0,0 +1,37 @@
+variable "aws_region" {
+  description = "AWS region for ECR and EventBridge"
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "webhook_url" {
+  description = "ArgoCD Image Updater webhook endpoint URL (must use HTTPS)"
+  type        = string
+  # Example: "https://image-updater-webhook.example.com/webhook?type=cloudevents"
+
+  validation {
+    condition     = can(regex("^https://", var.webhook_url))
+    error_message = "webhook_url must use HTTPS protocol for secure credential transmission."
+  }
+}
+
+variable "webhook_secret" {
+  description = "Secret for webhook authentication"
+  type        = string
+  sensitive   = true
+}
+
+variable "ecr_repository_filter" {
+  description = "List of ECR repository names to monitor (empty list = all repositories)"
+  type        = list(string)
+  default     = []
+}
+
+variable "tags" {
+  description = "Tags to apply to all resources"
+  type        = map(string)
+  default = {
+    ManagedBy = "Terraform"
+    Purpose   = "ArgoCD-Image-Updater"
+  }
+}