amazon-ecr-credential-helper VS k8s-ecr-login-renew

Install the AWS ECR Docker Credential Helper in your runner

Instead of doing that you can download the official ecr-login credential helper tool (a binary built with Go) and configure Docker to use this helper tool every time you interact with the registry. So to you, the user, the authentication is happening in the background and you can push and pull without doing anything.

IAM instance profile that allows ECR actions. Then set up ecr credential helper so docker pull will just work.

You can use the ECR credential helper which rotates the credentials for you: https://github.com/awslabs/amazon-ecr-credential-helper

AWS ECR credential helper though..

Based on what I am seeing here, I would check for a ~/.docker/config.json file or an /etc/docker/config.json to see if anything could be misconfigured.

Use https://github.com/awslabs/amazon-ecr-credential-helper posted in another reply https://www.reddit.com/r/aws/comments/p5e9td/ecr_in_larger_organisations_looking_for_opinions/h95bv9b/

I've done some googling and found some solutions like this https://github.com/nabsul/k8s-ecr-login-renew which seems to indicate that others have had the same issue.

As for challenges I foresee: In this example, the applications are defined generically such that you could use them even if you wanted to skip Kubernetes altogether. However, I have two Kubernetes-specific applications that I run in the cluster: KCert and ecr-login-renewal. These applications require special Kubernetes configurations around service accounts and permissions. I'm not yet sure how to cleanly encode those.