Kubernetes pull private external amazon ECR images

问题

I have an Amazon account with a K8S cluster which is able to pull images from the same account's ECR repository.

But, my company have another account with another ECR repository. How can I pull image from this "external" ECR repository ?

I'am also a Rancher user and I used to do this by installing a special container (https://github.com/rancher/rancher-ecr-credentials) which does the job.

Is there something equivalent for Kubernetes?

Thanks for your precious help

回答1:

Since you already have this setup for pulling images from the same account, you can do this with IAM policy level or ECR permissions, in your other AWS account set up a policy specifying the AWS account number (where k8s is) that will be able to pull images

For example grant pull permissions in the ECR Permissions tab

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "k8s-aws-permissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::aws_account_number:root"
            },
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability"
            ]
        }
    ]
}

来源：https://stackoverflow.com/questions/48265269/kubernetes-pull-private-external-amazon-ecr-images