<p>I'm new to Kubernetes and as a tutorial for myself I've been working on deploying a basic project to Kubernetes with helm (v3).
I have an image in AWS's ECR as well as a local helm chart for this project.
However, I am struggling to run my image with Kubernetes.</p>

<p>My image is set up correctly. If I try something like <code>docker run my_image_in_ecr</code> locally it behaves as expected (after configuring my IAM access credentials locally).
My helm chart is properly linted and in my image map, it specifies:</p>

<pre><code>image:
  repository: my_image_in_ecr
  tag: latest
  pullPolicy: IfNotPresent
</code></pre>

<p>When I try to use helm to deploy though, I'm running into issues. 
My understanding is to run my program with helm, I should:</p>

<ol>
<li><p>Run helm install on my chart</p></li>
<li><p>Run the image inside my new kubernetes pod</p></li>
</ol>

<p>But when I look at my kubernetes pods, it looks like they never get up and running.</p>

<pre><code>hello-test1-hello-world-54465c788c-dxrc7           0/1     ImagePullBackOff    0          49m
hello-test2-hello-world-8499ddfb76-6xn5q           0/1     ImagePullBackOff    0          2m45s
hello-test3-hello-world-84489658c4-ggs89           0/1     ErrImagePull        0          15s
</code></pre>

<p>The logs for these pods look like this:</p>

<pre><code>Error from server (BadRequest): container "hello-world" in pod "hello-test3-hello-world-84489658c4-ggs89" is waiting to start: trying and failing to pull image
</code></pre>

<p>Since I don't know how to set up imagePullSecrets properly with Kubernetes I was expecting this to fail. But I was expecting a different error message such as bad auth credentials. </p>

<ol>
<li>How can I resolve the error in image pulling? Is this issue not even related to the fact that my image is in ecr?</li>
<li>How can I properly set up credentials (such as imagePullSecrets) to authorize pulling the image from ecr? I have followed some guides such as <a href="https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/" rel="nofollow noreferrer">this one</a> and <a href="https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry" rel="nofollow noreferrer">this one</a> but am confused on how to tranlate this information into a proper authorization configuration for ecr.</li>
</ol>

Thomas Scruggs
<blockquote>
  <p>How can I properly set up credentials (such as imagePullSecrets) to authorize pulling the image from ecr?</p>
</blockquote>

<p>The traditional way is to grant the Node an <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" rel="nofollow noreferrer">instance role</a> that includes <a href="https://github.com/kubernetes-sigs/kubespray/blob/v2.11.0/contrib/aws_iam/kubernetes-minion-policy.json#L34-L40" rel="nofollow noreferrer"><code>ecr:*</code> IAM Permissions</a> , ensure you have <code>--cloud-provider=aws</code> set on <code>apiserver</code>, <code>controller-manager</code>, and <code>kubelet</code> (which if you are doing anything with kubernetes inside AWS you will for sure want to enable and configure correctly), and <code>kubelet</code> will then automatically coordinate with ECR to Just Work&trade;</p>

<p>That information was present on the page you cited, under the heading <a href="https://kubernetes.io/docs/concepts/containers/images/#using-amazon-elastic-container-registry" rel="nofollow noreferrer">Using Amazon Elastic Container Registry</a> but it isn't clear if you read it and didn't understand, or read it and it doesn't apply to you, or didn't get that far down the page</p>
