 needs to be able to read from the artifact store:The pod needs to be authenticated to push to the container registry in your active stack.

In case the parent image you use in your DockerSettings is stored in a private registry, the pod needs to be authenticated to pull from this registry.

If you configured your image builder to store the build context in the artifact store, the pod needs to be authenticated to read files from the artifact store storage.

ZenML is not yet able to handle setting all of the credentials of the various combinations of container registries and artifact stores on the Kaniko build pod, which is you're required to set this up yourself for now. The following section outlines how to handle it in the most straightforward (and probably also most common) scenario, when the Kubernetes cluster you're using for the Kaniko build is hosted on the same cloud provider as your container registry (and potentially the artifact store). For all other cases, check out the official Kaniko repository for more information.

Add permissions to push to ECR by attaching the EC2InstanceProfileForImageBuilderECRContainerBuilds policy to your EKS node IAM role.

Configure the image builder to set some required environment variables on the Kaniko build pod:

# register a new image builder with the environment variables

zenml image-builder register <NAME> \

--flavor=kaniko \

--kubernetes_context=<KUBERNETES_CONTEXT> \

--env='[{"name": "AWS_SDK_LOAD_CONFIG", "value": "true"}, {"name": "AWS_EC2_METADATA_DISABLED", "value": "true"}]'

# or update an existing one

zenml image-builder update <NAME> \

--env='[{"name": "AWS_SDK_LOAD_CONFIG", "value": "true"}, {"name": "AWS_EC2_METADATA_DISABLED", "value": "true"}]'

Check out the Kaniko docs for more information.

Enable workload identity for your cluster

Follow the steps described here to create a Google service account, a Kubernetes service account as well as an IAM policy binding between them.