<p><strong>step 1</strong> <code>sudo $(aws ecr get-login --no-include-email --region xx-xxxx-x)</code></p>

<p><strong>step 2</strong> <code>curl -LSs https://github.com/fermayo/ecr-k8s-secret/raw/master/gen-secret.sh | bash -</code></p>

<p><strong>step 3</strong> <code>kubectl describe secret aws-ecr-credentials</code></p>

<pre><code>Name:         aws-ecr-credentials
Namespace:    default
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;

Type:  kubernetes.io/dockerconfigjson

Data

.dockerconfigjson:  32 bytes
</code></pre>

<p><strong>step 4</strong> <code>kubectl describe pod x</code></p>

<blockquote>
  <p>Warning  Failed     5s               kubelet, ip-10-46-250-151  Failed to pull image "my-account.dkr.ecr.us-east-1.amazonaws.com/my-image:latest": rpc error: code = Unknown desc = Error response from daemon: Get <a href="https://my-account.dkr.ecr.us-east-1.amazonaws.com/my-image/latest" rel="noreferrer">https://my-account.dkr.ecr.us-east-1.amazonaws.com/my-image/latest</a>: no basic auth credentials</p>
</blockquote>

<p>Why can't the pod pull down the image?</p>

<p>Created a script that pulls the token from AWS-ECR</p>

<pre class="lang-sh prettyprint-override"><code>ACCOUNT=xxxxxxxxxxxx
REGION=xx-xxxx-x
SECRET_NAME=${REGION}-ecr-registry
EMAIL=email@email.com

#
#

TOKEN=`aws ecr --region=$REGION get-authorization-token --output text \
    --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2`

#
#  Create or replace registry secret
#


kubectl delete secret --ignore-not-found $SECRET_NAME
kubectl create secret docker-registry $SECRET_NAME \
    --docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
    --docker-username=AWS \
    --docker-password="${TOKEN}" \
    --docker-email="${EMAIL}"
</code></pre>

<p>and created a Linux cronjob to run this every 10 hours</p>
