<p>I have a docker image in AWS ECR which is in my secondary account. I want to pull that image to the Minikube Kubernetes cluster using AWS IAM Role ARN where MFA is enabled on it. Due to this, my deployment failed while pulling the Image.</p>
<p>I enabled the registry-creds addon to access ECR Image but didn't work out.</p>
<p>May I know any other way to access AWS ECR of AWS Account B via AWS IAM Role ARN with MFA enabled using the credential of the AWS Account A?</p>
<p>For example, I provided details like this</p>
<ul>
<li>Enter AWS Access Key ID: <strong>Access key of Account A</strong></li>
<li>Enter AWS Secret Access Key: <strong>Secret key of Account A</strong></li>
<li>(Optional) Enter AWS Session Token:</li>
<li>Enter AWS Region: <strong>us-west-2</strong></li>
<li>Enter 12 digit AWS Account ID (Comma separated list): [<strong>AccountA, AccountB</strong>]</li>
<li>(Optional) Enter ARN of AWS role to assume: &lt;<strong>role_arn of AccountB</strong>&gt;</li>
</ul>
<p><strong>ERROR MESSAGE:</strong>
<code>Warning  Failed     2s (x3 over 42s)   kubelet            Failed to pull image &quot;XXXXXXX.dkr.ecr.ca-central-1.amazonaws.com/sample-dev:latest&quot;: rpc error: code = Unknown desc = Error response from daemon: Head &quot;https://XXXXXXX.dkr.ecr.ca-central-1.amazonaws.com/v2/sample-dev/manifests/latest&quot;: no basic auth credentials</code></p>
<p><code>Warning  Failed     2s (x3 over 42s)   kubelet            Error: ErrImagePull</code></p>

<p>While the <code>minikube addons</code> based solution shown by @DavidMaze is probably cleaner and generally preferable, I wasn't able to get it to work.</p>
<p>Instead, I <a href="https://stackoverflow.com/questions/55223075/automatically-use-secret-when-pulling-from-private-registry">found out</a> it is possible to give the service account of the pod a copy of the docker login tokens in the local home. If you haven't set a serviceaccount, it's <code>default</code>:</p>
<pre class="lang-sh prettyprint-override"><code># Log in with aws ecr get-login or however
kubectl create secret generic regcred \
  --from-file=.dockerconfigjson=$HOME/.docker/config.json \
  --type=kubernetes.io/dockerconfigjson
kubectl patch serviceaccount default -p '{&quot;imagePullSecrets&quot;: [{&quot;name&quot;: &quot;regcred&quot;}]}'
</code></pre>
<p>This will work fine in a bind.</p>
