AWS ECR Registry Authentication

[MPritsch]

Hello, how can we access an AWS ECR Registry with Kargo? We need to configure our warehouse to listen for new tags in the ECR Registry. I'm not sure if it is the correct location in the code, but I just found this:

kargo/internal/image/repository_client.go

Line 171 in 4ada872

auth.NewBasicHandler(creds),

Which would mean that currently only basic-auth credentials are supported.

I could not find the use case in the documentation of kargo.

Usually ecr needs some kind of cred-helper to be configured. How can this be done in Kargo?

Since 0.5.x Kargo uses it's own registry secrets, before it could use the creds of argo. So the behaviour might have changed since then?

Any help would be appreciated!

[krancour]

Hi @MPritsch. Even when Kargo could borrow credentials from Argo CD (a feature which was removed for security reasons), it would only actually use username/password from those creds. Additionally, Argo CD has never integrated with image registries either (they have no need), so this is definitely something that was not ever previously accounted for.

A satisfactory answer to this question is going to require a lot more research. Especially on account of the fact that Kargo doesn't communicate with registries via the docker CLI, it's not clear that this cred helper would even work.

Current priorities may not allow the Kargo teams to spend much time on this directly right now, but I will pin this conversation and tag it as help-wanted and we can see what the community has to say about this. Maybe someone has prior experience with a scenario such as this.

[MPritsch]

OK, so a Kargo-Warehouse watching for changes in a ECR-Registry is not a common use-case? I looked into some discord conversations, and some people seem to use ECR already. Are they using some different mechanism?

We are currently at the point where we need this feature, or we would need to use another solution for deployments to our AWS cluster entirely. I was brainstorming ideas with my team earlier and one temporary solution could be to implement a sidecar or init-container which runs a cred-helper and set the credentials as a secret which kargo could use. Obviously it would be better if the kargo-controller could handle the authentication directly.

[MPritsch]

We might be able to create a CronJob which refreshs the ECR token every couple of hours. Something like in this Blogpost. What do you think? https://skryvets.com/blog/2021/03/15/kubernetes-pull-image-from-private-ecr-registry/

[krancour]

I looked into some discord conversations, and some people seem to use ECR already. Are they using some different mechanism?

Now that you say that, I have a vague recollection of some such conversations. You might consider pinging some of those community members directly to see what insight they have.

We might be able to create a CronJob which refreshs the ECR token every couple of hours.

ECR is certainly a popular enough registry that Kargo should support it directly. Until we understand exactly what that involved, this seems to me like quite a reasonable workaround.

[jessesuen]

I filed #1885 for native support. Will try and formulate an official workaround while we wait for native support.