-
Notifications
You must be signed in to change notification settings - Fork 81
Description
Describe the bug
I'm getting this error trying to configuring the override-url
annotation in one of my pods, to use the public ECR repository for aws-vpc-cni
image.
failed to get tags from remote registry for \"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni-init\": failed to describe images: operation error ECR: DescribeImages, get identity: get credentials: failed to refresh cached credentials, failed to retrieve credentials, operation error STS: AssumeRoleWithWebIdentity, https response error StatusCode: 403, RequestID: 145863d9-425a-4f44-a48a-660c507f559c, api error AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity,failed to check container image \"aws-node\": failed to get tags from remote registry for \"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni\": failed to describe images: operation error ECR: DescribeImages, get identity: get credentials: failed to refresh cached credentials,
This is the policy for the role I created:
data "aws_iam_policy_document" "version_checker" {
statement {
sid = "CustomAmazonElasticContainerRegistryPublicReadOnly"
effect = "Allow"
actions = [
"ecr-public:GetAuthorizationToken",
"sts:GetServiceBearerToken",
"ecr-public:BatchCheckLayerAvailability",
"ecr-public:GetRepositoryPolicy",
"ecr-public:DescribeRepositories",
"ecr-public:DescribeRegistries",
"ecr-public:DescribeImages",
"ecr-public:DescribeImageTags",
"ecr-public:GetRepositoryCatalogData",
"ecr-public:GetRegistryCatalogData"
"sts:AssumeRoleWithWebIdentity"
]
resources = ["*"]
}
This policy is attached to an IAM Role.
I added the IAM Role in the ecr.iamRole
parameter in the values.yaml, and it also correctly add the role to the Service Account.
To Reproduce
Using `version-checker v0.9.2
in your aws-node pods, use the following annotation: override-url.version-checker.io/aws-node: 602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni
Expected behavior
Not seeing the IAM errors with the proper, and could fetch the tags
Screenshots
If applicable, add screenshots to help explain your problem.
Environment (please complete the following information):
- Version-Checker: 0.9.2
- Kubernetes: 1.31