How to pull Helm chart from AWS ecr locally

Question

We have one ecr repo on AWS. That contains all helm charts. This ecr is protected and someone assigned one role to me. this role allows me to all the images from aws cli console.

Now I am using helm to deploy chart. so for what i used following piece of code. When I run helm dep update command then this only pull postgres image and test-chart request fails with error 401.

I understand that somewhere I need to mention the aws credentials but don't know where I should use it. One more thing it would be nice if someone can tell be how to access this with AWS access-token.

dependencies:
  - name: postgresql
    version: 9.2.1
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled
  - name: createdb
    version: latest
    repository: https://111.ecr.eu-central-1.amazonaws.com/test-chart

ECR does not host helm charts, its hosts docker images. You need to create a k8s or helm chart template that references that ecr repo as its image setting. — Josh Beauregard, Feb 17 '21 at 17:45

score 6 · Answer 1 · answered Aug 06 '22 at 23:56

Storing/pulling/installing a chart from any OCI compatible registry is no more an experimental from version 3.7+

With ECR, once you've logged in:

$ aws ecr get-login-password --region eu-west-1 | helm registry login \
       --username AWS --password-stdin 12345678910.dkr.ecr.eu-west-1.amazonaws.com

you can pull the chart via:

$ helm pull \
    oci://12345678910.dkr.ecr.eu-west-1.amazonaws.com/my/helm/chart --version 0.1.19
Pulled: 12345678910.dkr.ecr.eu-west-1.amazonaws.com/my/helm/chart:0.1.19
Digest: sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Tested with helm 3.9.0

rock'n rolla · Answer 2 · 2021-04-15T14:41:50.260

Helm client version 3 does support ECR as Helms chart repository now. Although, currently any OCI-based registry support is considered experimental on the Helms official documentation.

Assuming you have the required permissions and have already pushed the helm chart to ECR (follow documentation here if you haven't), you can (optionally) do a quick aws ecr describe-images to get the list of available tags of your helm-chart on the ECR repo.

aws ecr describe-images --repository-name <your-repo-name> --region <region> --profile <profile>
{
    "imageDetails": [
        {
            "registryId": "************",
            "repositoryName": "<your-repo-name>",
            "imageDigest": "sha256:******************************************",
            "imageTags": [
                "0.1.6"
            ],
            "imageSizeInBytes": 3461,
            "imagePushedAt": "2021-04-07T00:16:31+01:00",
            "imageManifestMediaType": "application/vnd.oci.image.manifest.v1+json",
            "artifactMediaType": "application/vnd.cncf.helm.config.v1+json"
        }
    ]
}

Get ECR token & login to helm repo:

aws ecr get-login-password --region <region> | helm registry login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

Once you have the required details, you can run a helm chart pull command to pull the chart from ECR.

helm chart pull <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6
0.1.6: Pulling from <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>
ref:     <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6
digest:  d16af8672604ebe54********************************************
size:    3.2 KiB
name:    <your-chart-name>
version: 0.1.6
Status: Chart is up to date for <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6

Verify:

helm chart list
REF                                                                       NAME              VERSION DIGEST  SIZE    CREATED
<aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>... <your-chart-name>       0.1.6   50f03e4 3.2 KiB 22 second

How to pull Helm chart from AWS ecr locally

2 Answers2