Skip to content

EKS: Unable to log in ECR on AWS China partition when adding helm chart #28460

@yubingjiaocn

Description

@yubingjiaocn

Describe the bug

When adding helm chart stored on ECR in AWS China partition, CDK can't generate correct login command to log in to ECR.

The correct repository address is 123456789012.dkr.ecr.cn-north-1.amazonaws.com.cn, while regex in the following code only matches 123456789012.dkr.ecr.cn-north-1.amazonaws.com, cause incomplete repository address.

private_ecr_pattern = 'oci://(?P<registry>\d+\.dkr\.ecr\.(?P<region>[a-z0-9\-]+)\.amazonaws\.com)*'

Expected Behavior

Login to correct repository address and helm chart should be installed successfully.

Current Behavior

Generated login command from log:
aws ecr get-login-password --region cn-north-1 | helm registry login --username AWS --password-stdin <Redacted>.dkr.ecr.cn-north-1.amazonaws.com; helm pull oci://<Redacted>.dkr.ecr.cn-north-1.amazonaws.com.cn/charts/<redacted> --version 0.1.0 --untar

Error log:
[ERROR] Exception: b'time="2023-12-21T22:46:15z” level=info msg="Error logging in to endpoint, trying next endpoint" error=Get \\"https://<Redacted>.dkr.ecr.cn-north-1.amazonaws.com/v2/\\": dial tcp: lookup <Redacted>.dkr.ecr.cn-north-1.amazonaws.com on 169.254.78.1:53: no such host"\nError: Get "https://<Redacted>.dkr.ecr.cn-north-1.amazonaws.com/v2/": dial tcp: lookup <Redacted>.dkr.ecr.cn-north-1.amazonaws.com on 169.254.78.1:53: no such host\n Error: unexpected status from HEAD request to https://<Redacted>.dkr.ecr.cn-north-1.amazonaws.com.cn/v2/sd-on-eks/charts/sd-on-eks/manifest/0.1.0: 401 Unauthorized

Reproduction Steps

  1. Push a OCI formatted helm chart to ECR in AWS China partition
  2. Add helm chart to EKS cluster with the following code. Replace 123456789012 to your account ID, and cn-northwest-1 to your region.
eks.HelmChart(self, "MyOCIChart",
    cluster=cluster,
    chart="some-chart",
    repository="oci://123456789012.dkr.ecr.cn-northwest-1.amazonaws.com.cn/${REPO_NAME}",
    namespace="oci",
    version="0.0.1"
)

Possible Solution

Change regex to match AWS China partition suffix

Additional Information/Context

No response

CDK CLI Version

2.99.1

Framework Version

No response

Node.js Version

v18.17.1

OS

Linux (Ubuntu 22.04.1)

Language

TypeScript

Language Version

5.1.6

Other information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-eksRelated to Amazon Elastic Kubernetes ServicebugThis issue is a bug.effort/smallSmall work item – less than a day of effortp2

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions