Closed MarkSpencerTan closed 2 years ago
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale
.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close
.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten
.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close
.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen
.
Mark the issue as fresh with /remove-lifecycle rotten
.
/close
@kubevirt-bot: Closing this issue.
Pulling from ECR can be done like this:
Create a k8s secret of type kubernetes.io/dockerconfigjson
using credentials from Docker/Podman e.g.
kubectl create -n <namespace> secret generic ecr-creds --from-file=.dockerconfigjson=$HOME/.docker/config.json --type=kubernetes.io/dockerconfigjson
(replace $HOME/.docker/config.json
with the path to your Docker credentials)
Modify the default
service account in your namespace to use this secret when pulling images e.g.
kubectl patch serviceaccount default -n <namespace> \
-p '{"imagePullSecrets": [{"name": "ecr-creds"}]}'
Ensure that your DataVolume
manifest uses pullMethod: node
(see docs) and same namespace as above
Is there any way at the moment to be able to pull disk images from AWS ECR? I know the disk registry option allows a secret to be passed containing the secret/token credential of the repo, however, with ECR, the tokens are limited to a few hours until they refresh so I was wondering if we can somehow pull without needing the credentials.
Our AWS team told us that CDI should just be able to pull images using an IAM role that allows it to pull from the repo. Usually you can link an IAM Role using annotations to a service account being used by the service (CDI). I did notice that CDI has a couple of different service accounts so I'm not too sure which one to use.
Would this be doable right now with CDI or does it have to be implemented? Thank you
/kind enhancement
What happened: Tried to specify a repo from AWS ECR to pull disk images from The Image Pull failed due to error:
What you expected to happen: CDI can pull from ECR repo
How to reproduce it (as minimally and precisely as possible): Try to pull an image from an ECR repo
Anything else we need to know?: We're using an EKS cluster with Kubevirt. Trying to create persistent VMs using CDI pulling from ECR repositories
Environment:
kubectl get deployments cdi-deployment -o yaml
): 1.32.0kubectl version
): 1.18.0