-
Notifications
You must be signed in to change notification settings - Fork 4.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add support for using ECR as pull-through image cache #16593
base: master
Are you sure you want to change the base?
Conversation
Hi @rsafonseca. Thanks for your PR. I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/ok-to-test |
Any idea why these e2e tests might be failing @hakman?
could something be leaking somewhere? or do you think there's any change here that could be somehow related to this weird behaviour? EDIT: nvm, found the problem... hidden tabs in string literal.. damn vscode 😂 |
Please ignore the IPv6 tests |
All good then, though it looks like pull-kops-e2e-cni-cilium-eni is flaky, passed on retest. |
a77071a
to
a7dbaac
Compare
45e0800
to
f682340
Compare
615a93f
to
a7dbaac
Compare
Any update about this PR? Do you need any help or test, to be merged faster? |
@rifelpet @hakman @johngmyers is there any way we can help you guys to get it merged before/into the 1.30 release? |
@rsafonseca can you provide some more details about this? An issue or PR from the source repo? |
There is no specific issue regarding this, simply the failure logic was changed some commits ago to not error out when it fails to parse an ECR specific url. This is easy to test with the old vs newer binaries, the version that kops currently has in the assets will drop out and not pass the ecr auth token when the referenced image repo is not ECR, so when containerd tries to use ECR as a mirror it has no creds. |
Hey folks, can anyone take a look at this? :) |
Signed-off-by: Rafael da Fonseca <[email protected]>
Signed-off-by: Rafael da Fonseca <[email protected]>
8b06aa4
to
9a76a8b
Compare
/retest-required |
@rsafonseca: The following tests failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This PR introduces a simple way to enable using ECR as a Pull-through image cache, without having to mutate images on the cluster using tools like Kyverno.
Containerd already has support for specifying registry mirrors in kops, but since ECR uses short lived tokens, it's not trivial (or even impossible without adding a few extra hacks on top of it) to use it as a pull-through cache.
This PR also bumps the ecr-credential-provider binary, which before version 1.29.0 specifically tried to parse an ECR repo URL from the image passed, leading to not being possible to enable this feature. This is now resolved in the latest versions.
This PR uses a flag to enable the feature when needed, and adds any server addresses configured in the mirrors to be allowed on the CredentialProviderConfig object that kops configures on the kubelet.
To configure this:
example: