<p>I have a helm chart which is using aws ecr to pull images and deploy them into native Kubernetes:</p>
<p><em><strong>Chart.yml:</strong></em></p>
<pre><code>apiVersion: v2
description: helm chart for microservice-registry
name: microservice-registry
type: application
version: 0.0.1
</code></pre>
<p><em><strong>values.yaml</strong></em></p>
<pre><code>namespace:

replica: 1

labels:
 app: microservice-registry

imagePullSecrets: microservice-registry-secret

image:
 repository: 123456789.dkr.ecr.us-east-1.amazonaws.com/microservice-registry
 tag: 0.0.1
 imagePullPolicy: Always
 
strategy:
 rollingUpdate:
  maxSurge: 1
  maxUnavailable: 0
 type: RollingUpdate

service:
 containerPort: 8761
 port: 80
 type: NodePort
 nodePort: 30061

secrets:
 data: 
   .dockerconfigjson: 123456789
 type: kubernetes.io/dockerconfigjson

awscreds:
 data:
  SECRET_KEY: 123456789
  ACCESS_KEY: 123456789
 name: awscreds-registry
 region: us-east-1

cronjob:
 name: microservice-registry-job
 image: gtsopour/awscli-kubectl:latest
</code></pre>
<p>When I deploy the helm chart I get:</p>
<pre><code>root@node1:~# kubectl get pods
NAME                                               READY   STATUS             RESTARTS        AGE
microservice-registry-7c4654467c-q292p             0/1     ImagePullBackOff   0               17m
cicd                                               1/1     Running            1 (22d ago)     44d
grafana-f6d989bbf-hrr6c                            1/1     Running            1 (22d ago)     45d
ingress-nginx-controller-6b8bfd7f69-cwd2b          1/1     Running            1 (22d ago)     35d
nfs-subdir-external-provisioner-5f7dff96d9-rj75j   1/1     Running            39 (2d3h ago)   38d
zookeeper-0                                        1/1     Running            1 (22d ago)     38d
root@node1:~#
</code></pre>
<p><em><strong>log:</strong></em></p>
<pre><code>root@node1:~# kubectl logs microservice-registry-7c4654467c-q292p
Error from server (BadRequest): container &quot;microservice-registry&quot; in pod &quot;microservice-registry-7c4654467c-q292p&quot; is waiting to start: trying and failing to pull image
root@node1:~#
</code></pre>
<p>I have a similar service which is using the same aws ecr credentials. It's deployed successfully. Do you know how I can fix this issue?</p>
<p><em><strong>Policy JSON:</strong></em></p>
<pre><code>{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;ecr:BatchCheckLayerAvailability&quot;,
                &quot;ecr:BatchGetImage&quot;,
                &quot;ecr:GetDownloadUrlForLayer&quot;,
                &quot;ecr:GetAuthorizationToken&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
        }
    ]
}
</code></pre>

<p>According to your <a href="https://pastebin.com/7x3NjD8s" rel="nofollow noreferrer">https://pastebin.com/7x3NjD8s</a>, you got <code>401 Unauthorized</code> from ECR. Since you have an On-Premises Kubernetes instance you need to use a process to set your AWS credentials on <code>ImagePullSecrets</code> on your PODs. I would use this one: <a href="https://github.com/upmc-enterprises/registry-creds" rel="nofollow noreferrer">https://github.com/upmc-enterprises/registry-creds</a>, it will collect your AWS credentials and update the <code>ImagePullSecrets</code> automatically with token to login on AWS ECR.</p>
