Need advice how to make Spinnaker work with aws ecr?

Question

I'm setting up Spinnaker in K8s with aws-ecr. My setup and steps are:

on AWS side:

1. Added policies ecr-pull, ecr-push, and ecr-generate-token
2. Attached the policy to a role

Spinnaker setup:

3. Modified values.yaml with below above settings: ```accounts:

   • name: my-ecr address: https://123456xxx.dkr.ecr.my-region.amazonaws.com repositories:
   • 123456xxx.dkr.ecr..amazonaws.com/spinnaker-test-project ```

4. Annotated clouddriver.yaml: deployment to use created role (using the IAM role in a pod by referencing the role name in an annotation on the pod specification)

But it doesn't work and the error on the cloudrvier side is :

.d.r.p.a.DockerRegistryImageCachingAgent : Could not load tags for 1234xxxxx.dkr.ecr.<my_region>.amazonaws.com/spinnaker-test-project in https://1234xxxxx.dkr.ecr.<my_region>.amazonaws.com

Would like to get some help or advice what I'm missing, thank you

Answer 1

Got the answer from an official Spinnaker slack channel. That adding an iam policy to the clouddriver pod won't work unfortunately since it uses the docker client instead of the aws client. The workaround to make it work can be found here

Note* Ecr support currently is broken in halyard.This might get fixed in future after halyard migrates from the kubernetes v1 -> v2 or earlier so please verify with community or docs.