Skip to content

Instantly share code, notes, and snippets.

@qclaogui

qclaogui/rancher_aws_ecr_secret.md

Forked from flybd5/rancher_aws_ecr_secret.md
Created August 11, 2021 10:17
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save qclaogui/aeb9126d280d4632b52265e360ab3fd0 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save qclaogui/aeb9126d280d4632b52265e360ab3fd0 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @flybd5 flybd5 revised this gist Jun 22, 2021. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion rancher_aws_ecr_secret.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    The easiest way to create and update a docker-registry secret for an AWS ECR repo is to set up a CRON job that uses the AWS CLI and Kubectl.
    The easiest way to create and update a docker-registry secret in Rancher 2.x for an AWS ECR repo is to set up a CRON job that uses the AWS CLI and Kubectl.

    - Log into the host machine where the cluster is running
    - Install AWS CLI and configure it to use an IAM role that can read the ECR credentials.
  2. @flybd5 flybd5 created this gist Jun 22, 2021.
    22 changes: 22 additions & 0 deletions rancher_aws_ecr_secret.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,22 @@
    The easiest way to create and update a docker-registry secret for an AWS ECR repo is to set up a CRON job that uses the AWS CLI and Kubectl.

    - Log into the host machine where the cluster is running
    - Install AWS CLI and configure it to use an IAM role that can read the ECR credentials.
    - Test the CLI config using this command: `aws ecr --region <your_ecr's_region> get-login-password`
    - Install kubectl and configure it with the yaml for the cluster in which you want to define the secret
    - Create a shell script like this:

    ```
    # Delete the secret if it already exists (there is no way to update it)
    kubectl delete secret <name_of_the_docker_registry_secret>
    # Create the secret
    kubectl create secret docker-registry <name_of_the_docker_registry_secret> \
    --docker-server=<your_ecr_registry_uri> \
    --docker-username=AWS \
    --docker-password=$(aws ecr --region <your_ecr's_region> get-login-password) \
    --docker-email=<your_notification_email>
    ```

    - Now setup a cron job to run this shell script every 6 hours (AWS resets the password every 12, so just to be on the safe side).

    The secret will show up in the default project for the cluster. If you know how to have kubectl create it in a specific project, let me know.