Skip to content

[BUG] Problem checking tags on ECR public repository #390

@cHiv0rz

Description

@cHiv0rz

Describe the bug
I'm getting this error trying to configuring the override-url annotation in one of my pods, to use the public ECR repository for aws-vpc-cni image.

failed to get tags from remote registry for \"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni-init\": failed to describe images: operation error ECR: DescribeImages, get identity: get credentials: failed to refresh cached credentials, failed to retrieve credentials, operation error STS: AssumeRoleWithWebIdentity, https response error StatusCode: 403, RequestID: 145863d9-425a-4f44-a48a-660c507f559c, api error AccessDenied: Not authorized to perform sts:AssumeRoleWithWebIdentity,failed to check container image \"aws-node\": failed to get tags from remote registry for \"602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni\": failed to describe images: operation error ECR: DescribeImages, get identity: get credentials: failed to refresh cached credentials,

This is the policy for the role I created:

data "aws_iam_policy_document" "version_checker" {
  statement {
    sid    = "CustomAmazonElasticContainerRegistryPublicReadOnly"
    effect = "Allow"
    actions = [
      "ecr-public:GetAuthorizationToken",
      "sts:GetServiceBearerToken",
      "ecr-public:BatchCheckLayerAvailability",
      "ecr-public:GetRepositoryPolicy",
      "ecr-public:DescribeRepositories",
      "ecr-public:DescribeRegistries",
      "ecr-public:DescribeImages",
      "ecr-public:DescribeImageTags",
      "ecr-public:GetRepositoryCatalogData",
      "ecr-public:GetRegistryCatalogData"
      "sts:AssumeRoleWithWebIdentity"
    ]
    resources = ["*"]
  }

This policy is attached to an IAM Role.

I added the IAM Role in the ecr.iamRole parameter in the values.yaml, and it also correctly add the role to the Service Account.

To Reproduce
Using `version-checker v0.9.2
in your aws-node pods, use the following annotation: override-url.version-checker.io/aws-node: 602401143452.dkr.ecr.us-east-1.amazonaws.com/eks/amazon-k8s-cni

Expected behavior
Not seeing the IAM errors with the proper, and could fetch the tags

Screenshots
If applicable, add screenshots to help explain your problem.

Environment (please complete the following information):

  • Version-Checker: 0.9.2
  • Kubernetes: 1.31

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions