Configuring a ROSA cluster to pull images from AWS Elastic Container Registry (ECR)

Prerequisites

• AWS CLI
• Openshift CLI 4.11+
• Podman Desktop
• ROSA Cluster

Background

Quick Introduction by Ryan Niksch & Charlotte Fung on YouTube .

There are two options to use to authenticate wth Amazon ECR to pull images.

The traditional method is to create a pull secret for ecr.

Example:

However Amazon ECR tokens expire every 12 hours which will mean you will need to re-authenticate every 12 hours either through scripting or do so manually.

A second, and preferred method, is to attach an ECR Policy to your cluster’s worker machine profiles which this guide will walk you through.

ROSA worker nodes are provisioned with predefined IAM roles ( ManagedOpenShift-HCP-ROSA-Worker-Role for ROSA HCP and ManagedOpenShift-Worker-Role for ROSA Classic) which can be updated with an Amazon ECR policy to allow the cluster to pull images from your registries.

Configure ECR with ROSA

1. Set ENV variables

2. Create an ECR repository

3. Create the IAM policy with ECR permissions.

4. Create the Customer Managed Policy

5. Attach policy to the worker IAM role.

6. Log into ECR

7. Pull an image

8. Tag the image for ecr

9. Push the image to ECR

10. Create a new project

11. Create a new app using the image on ECR

12. View a list of pods in the namespace you created:

    Expected output:

    If you see the hello-ecr pod running … congratulations! You can now pull images from your ECR repository.

Clean up

1. Simply delete the project you created to test pulling images:

2. Detach and delete the IAM policy

3. Remove local files and ECR repository