<p>I am currently having trouble trying to pull my remote docker image hosted via AWS ECR. I am getting this error when running a deployment </p>

<p>Step 1)</p>

<p>run </p>

<pre><code>aws ecr get-login-password --region cn-north-1 | docker login --username AWS --password-stdin xxxxxxxxxx.dkr.ecr.cn-north-1.amazonaws.com.cn
</code></pre>

<p>Step 2)</p>

<p>run <code>kubectl create -f backend.yaml</code></p>

<p>from here the following happens:</p>

<pre><code>➜  backend git:(kubernetes-fresh) ✗ kubectl get pods
NAME                      READY   STATUS             RESTARTS   AGE
backend-89d75f7df-qwqdq   0/1     Pending            0          2s

➜  backend git:(kubernetes-fresh) ✗ kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
backend-89d75f7df-qwqdq   0/1     ContainerCreating   0          4s

➜  backend git:(kubernetes-fresh) ✗ kubectl get pods
NAME                      READY   STATUS             RESTARTS   AGE
backend-89d75f7df-qwqdq   0/1     ErrImagePull       0          6s

➜  backend git:(kubernetes-fresh) ✗ kubectl get pods
NAME                      READY   STATUS             RESTARTS   AGE
backend-89d75f7df-qwqdq   0/1     ImagePullBackOff   0          7s
</code></pre>

<p>So then I run <code>kubectl describe pod backend</code> and it will output:</p>

<pre><code>Events:
  Type     Reason     Age                 From               Message
  ----     ------     ----                ----               -------
  Normal   Scheduled  117s                default-scheduler  Successfully assigned default/backend-89d75f7df-qwqdq to minikube
  Normal   Pulling    32s (x4 over 114s)  kubelet, minikube  Pulling image "xxxxxxxxx.dkr.ecr.cn-north-1.amazonaws.com.cn/baopals:latest"
  Warning  Failed     31s (x4 over 114s)  kubelet, minikube  Failed to pull image "xxxxxxxxx.dkr.ecr.cn-north-1.amazonaws.com.cn/baopals:latest": rpc error: code = Unknown desc = Error response from daemon: Get https://xxxxxxxxx.dkr.ecr.cn-north-1.amazonaws.com.cn/v2/baopals/manifests/latest: no basic auth credentials
  Warning  Failed     31s (x4 over 114s)  kubelet, minikube  Error: ErrImagePull
  Warning  Failed     19s (x6 over 113s)  kubelet, minikube  Error: ImagePullBackOff
  Normal   BackOff    4s (x7 over 113s)   kubelet, minikube  Back-off pulling image "xxxxxxxxx.dkr.ecr.cn-north-1.amazonaws.com.cn/baopals:latest"

</code></pre>

<p>the main error being <code>no basic auth credentials</code></p>

<p>Now what I am confused about is that I can push images to my ECR fine and I can also push to my remote EKS cluster I feel like essentially the only thing I cant do right now is pull from my private repository that is hosted on ECR.</p>

<p>Is there something obvious that I'm missing here that is preventing me from pulling from private repos so i can use them on my local machine?</p>

<p>For fetching ECR image locally you have login to ECR and fetch docker image. while if you are on Kubernetes you have to use <code>secret</code> for storing ECR login details and use it each time for pulling image from ECR.</p>

<p>here shell script if you are on Kubernetes, it will automatically take values from AWS configuration or else you can update variables at starting of script.</p>

<pre><code>ACCOUNT=$(aws sts get-caller-identity --query 'Account' --output text) #aws account number
REGION=ap-south-1                                     #aws ECR region
SECRET_NAME=${REGION}-ecr-registry                    #secret_name
EMAIL=abc@xyz.com                                     #can be anything

TOKEN=`aws ecr --region=$REGION get-authorization-token --output text --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2`

kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
 --docker-server=https://$ACCOUNT.dkr.ecr.${REGION}.amazonaws.com \
 --docker-username=AWS \
 --docker-password="${TOKEN}" \
 --docker-email="${EMAIL}"
</code></pre>

<p><code>imagePullSecret</code> used in YAML file for pulling storing secret for private docker repos.</p>

<p><a href="https://github.com/harsh4870/ECR-Token-automation/blob/master/aws-token.sh" rel="nofollow noreferrer">https://github.com/harsh4870/ECR-Token-automation/blob/master/aws-token.sh</a></p>
