# ECR Credentials **URL:** \ **Category:** Rancher 2.0 Tech Preview\ **Created:** [April 11, 2018, 7:06pm UTC](https://forums.suse.com/t/ecr-credentials/10050 "2018-04-11T19:06:00Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![Alexander\_Armstrong](https://avatars.discourse-cdn.com/v4/letter/a/f475e1/32.png) [@Alexander\_Armstrong](https://forums.suse.com/u/Alexander_Armstrong)\ **Post date:** [April 11, 2018, 7:06pm UTC](https://forums.suse.com/t/ecr-credentials/10050/1 "2018-04-11T19:06:01Z")
Hi, Does the Rancher credentials updater work in 2.0. I am unable to get the container to launch. > **[GitHub - rancher/rancher-ecr-credentials: Docker container to periodically...](https://github.com/rancher/rancher-ecr-credentials)** > > Docker container to periodically update the Credentials for an AWS Elastic Container Registry in Rancher - GitHub - rancher/rancher-ecr-credentials: Docker container to periodically update the Cred... Any help for any strategy to pull images from AWS ECR would be greatly appreciated. I have everything spun up and ready to go, this is my last hurdle to seeing our app running on this!! Many thanks, Alex ---
**Author:** ![alex88](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/alex88/32/105_2.png) [@alex88](https://forums.suse.com/u/alex88)\ **Post date:** [May 10, 2018, 2:25pm UTC](https://forums.suse.com/t/ecr-credentials/10050/3 "2018-05-10T14:25:22Z")
You don’t need that, kubernetes handles it [https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry](https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry) ---
**Author:** ![sandbox](https://avatars.discourse-cdn.com/v4/letter/s/8491ac/32.png) [@sandbox](https://forums.suse.com/u/sandbox)\ **Post date:** [May 10, 2018, 2:40pm UTC](https://forums.suse.com/t/ecr-credentials/10050/4 "2018-05-10T14:40:35Z")
disregard, it looks like i forgot to enable the aws cloud provider on that test instance. seems to be able to pull from ECR just fine. ---
**Author:** ![teapot](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/teapot/32/3542_2.png) [@teapot](https://forums.suse.com/u/teapot)\ **Post date:** [June 1, 2018, 1:51am UTC](https://forums.suse.com/t/ecr-credentials/10050/5 "2018-06-01T01:51:10Z")
I installed Rancher 2.0 today and created a cluster with a few nodes. The version of Kubelet is v1.10.1 and the document linked in @alex88 message specify that Kubernetes handles it if Kubelet is v1.2.0 or newer. Did I miss something when I setup my nodes? Thank you. Edit: Waiting fixed the issue. Woke up this morning and the docker image was successfully pulled and downloaded. Would love to know if there is a way to trigger manually the ecr authentication. ---
**Author:** ![frekele](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/frekele/32/1202_2.png) [@frekele](https://forums.suse.com/u/frekele)\ **Post date:** [July 29, 2018, 10:14am UTC](https://forums.suse.com/t/ecr-credentials/10050/6 "2018-07-29T10:14:36Z")
I have a local server where I run rancher 2.0 now. But I have images that are located in the AWS ECR, so I would like to be able to pull the images out of the cloud. The closest I found to deal with this was on this site: > **[Keeping AWS Registry pull credentials fresh in Kubernetes](https://medium.com/@xynova/keeping-aws-registry-pull-credentials-fresh-in-kubernetes-2d123f581ca6)** > > Use a Kubernetes CronJob to keep AWS Registry pull credentials fresh but it would be very interesting if the rancher did this automatically to the user. ---
**Author:** ![francesco2013](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/francesco2013/32/4611_2.png) [@francesco2013](https://forums.suse.com/u/francesco2013)\ **Post date:** [November 8, 2018, 8:03am UTC](https://forums.suse.com/t/ecr-credentials/10050/7 "2018-11-08T08:03:13Z")
Hello, I have exactly the same problem. I have followed the link to that Docker rancher/rancher-ecr-credentials but I really dont understand how this would work. So I can put the container on one of my nodes of Rancher and start it but I dont get which ENV variables you have to pass to the container on start. I understand AWS\_KEY AWS\_SECRET which I have but I dont get why do I need this AWS\_ROLE\_ARN … I mean I have the KEY and the SECRET and normally this is enough to authenticate on all AWS services why do I need to provide that AWS\_ROLE\_ARN ? Do I really need that ? Also why do I have to map /root/.aws to the container if I am already passing it KEY and SECRET via ENV variables ? This is really crap guys how is the hell possible such an important thing as using AWS ECR is NOT integrated in Rancher 2.0 ? What the heck ? Could you please help me understanding this ? Thanks. ---
**Author:** ![vincent](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/vincent/32/7156_2.png) [@vincent](https://forums.suse.com/u/vincent)\ **Post date:** [November 8, 2018, 9:45am UTC](https://forums.suse.com/t/ecr-credentials/10050/8 "2018-11-08T09:45:30Z")
You’re looking at a service for 1.x. Kubernetes has built in support for ECR, on clusters in AWS using the AWS cloud provider. For anything else, Amazon chooses to make their registry hard to use outside of their garden by requiring session tokens. If you can’t be polite you will not be welcome here. ---
**Author:** ![francesco2013](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/francesco2013/32/4611_2.png) [@francesco2013](https://forums.suse.com/u/francesco2013)\ **Post date:** [November 9, 2018, 9:54am UTC](https://forums.suse.com/t/ecr-credentials/10050/9 "2018-11-09T09:54:18Z")
Hi Vincent, My apologies. I have been rather under pressure lately and the last thing I was expecting was having troubles using one of the simplest services out there. I mean ECR is probably one of the most used Container Registries in the world how can it be so difficult to have it working ? Please take a look at my post … could you be able to help me ? For our organization using AWS ECR is an absolute must. > [@AWS ECR Authentication not working](http://forums.suse.com/t/aws-ecr-authentication-not-working/12291): > > I am really stuck here I have tried everything I could find on the web but nothing seems to work and manage to have Rancher 2.0 authenticating with ECR. Could someone be so nice to please post a step by step working howto on how to use ECR on Rancher 2.0 ? I have tried basically everything I could find but nothing seems to work. I am using Rancher 2.0 with kubelet 1.20. I keep on getting ErrImagePull: rpc error: code = Unknown desc = unauthorized: authentication required. I am using EC2 clus… Any help would be immensely appreciated. Thanks in advance. ---
**Author:** ![shuckepco](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/shuckepco/32/4610_2.png) [@shuckepco](https://forums.suse.com/u/shuckepco)\ **Post date:** [November 12, 2018, 9:37am UTC](https://forums.suse.com/t/ecr-credentials/10050/10 "2018-11-12T09:37:52Z")
You can spin up a special container that handles the updates of your ECR session tokens: > **[GitHub - trondhindenes/ecr-updater: Allows use of AWS ECR registries with...](https://github.com/trondhindenes/ecr-updater)** > > Allows use of AWS ECR registries with Kubernetes no matter where your cluster is running. - GitHub - trondhindenes/ecr-updater: Allows use of AWS ECR registries with Kubernetes no matter where your... Here is a version with some tweaks, too: [GitHub - sehucke/ecr-updater: Allows use of AWS ECR registries with Kubernetes no matter where your cluster is running.](https://github.com/sehucke/ecr-updater). Minor tweaks aside, most important change was to use a kubectl-proxy implementation that is more open sourced and has a credible author (Lachlan Evenson / lachie83 @ Github). But this is up to you. 🙂 See as well: [How to refresh ECR credentials in a non-AWS Rancher 2.x installation · Issue #14907 · rancher/rancher · GitHub](https://github.com/rancher/rancher/issues/14907) The above mentioned solution works pretty well to keep your ECR login token valid. But currently there are some obstacles to work around to successfully deploy using your ECR registry. 1. See [Private registry not working](http://forums.suse.com/t/private-registry-not-working/10535) → You have to manually alter the yaml file of your workloads to include this: 2. And a minor one: You have to specify the full URI to your ECR registry when you deploy a workload. It is not possible to choose a registry to pull from and just type `myimage:stable` as you are used to when pulling from Docker Hub. ---
**Author:** ![shuckepco](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/shuckepco/32/4610_2.png) [@shuckepco](https://forums.suse.com/u/shuckepco)\ **Post date:** [November 12, 2018, 9:40am UTC](https://forums.suse.com/t/ecr-credentials/10050/12 "2018-11-12T09:40:54Z")
AFAIK, the guys @ Rancher Labs are working on both topics (scheduled for v2.1.2 and v2.2). See @ Github: rancher/rancher/issues/15725, rancher/rancher/issues/13339 and rancher/rancher/issues/15554 (the Github issues got a bit confusing, though 🙂 ) ---
**Author:** ![Juan\_Jimenez](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/juan_jimenez/32/6686_2.png) [@Juan\_Jimenez](https://forums.suse.com/u/Juan_Jimenez)\ **Post date:** [July 5, 2021, 3:31pm UTC](https://forums.suse.com/t/ecr-credentials/10050/13 "2021-07-05T15:31:30Z")
People are not inclined to be polite when rancher staff either ignore messages or take weeks/months to reply. If that’s how it works here, who in their right mind would PAY for support? Besides, the way your documentation sucks, getting angry customers is something you will have to get used to. If you don’t have the skills and patience to deal with that you are in the wrong place. #DontBeASnowflake ---
**Author:** ![Juan\_Jimenez](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/juan_jimenez/32/6686_2.png) [@Juan\_Jimenez](https://forums.suse.com/u/Juan_Jimenez)\ **Post date:** [July 5, 2021, 3:32pm UTC](https://forums.suse.com/t/ecr-credentials/10050/14 "2021-07-05T15:32:32Z")
The ECR password for private repos change every 12 hours. To update them I created a cronjob on the machine/vm running the Rancher server that runs the script described here: > ---
**Author:** ![vincent](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/vincent/32/7156_2.png) [@vincent](https://forums.suse.com/u/vincent)\ **Post date:** [July 6, 2021, 6:21am UTC](https://forums.suse.com/t/ecr-credentials/10050/15 "2021-07-06T06:21:39Z")
You are not entitled to anything from anybody just because you use our free software. If you can’t be civil and constructive, you will not post anything in any of our community channels. Employees have actual jobs and no engineers are paid specifically to answer you here, especially when you’re rude and [don’t answer us either](http://forums.suse.com/t/unable-to-run-rancher-2-on-ubuntu-18-04/18373/13). Lots of companies are happy to pay for access to people whose job that is. ---
**Author:** ![Juan\_Jimenez](https://sea2.discourse-cdn.com/flex022/user_avatar/forums.suse.com/juan_jimenez/32/6686_2.png) [@Juan\_Jimenez](https://forums.suse.com/u/Juan_Jimenez)\ **Post date:** [July 6, 2021, 7:54am UTC](https://forums.suse.com/t/ecr-credentials/10050/16 "2021-07-06T07:54:19Z")
And I am sure potential paying customers will be so impressed with your attitude as representative of the company’s values. ---
**Author:** ![dport2531](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@dport2531](https://forums.suse.com/u/dport2531)\ **Post date:** [June 16, 2022, 5:48pm UTC](https://forums.suse.com/t/ecr-credentials/10050/17 "2022-06-16T17:48:12Z")
Hi everyone! My company uses AWS ECR, Bitbucket, CircleCI and Rancher. Management would like to move from CircleCI to Rancher pipeline CI CD. I’m new for Rancher, so I was able to integrate Bitbucket repos with Rancher Pipeline, all images located in AWS ECR. when I run pipeline script it cannot communicate with ECR and shows up “no basic auth credentials”. In circleci we have variables option where we can add values to have an access to AWS ECR such AWS ID, Access key, Secret, Region. I use Dockerfile to build app and it pulling image from AWS ECR. Can someone explain me step by step how to add AWS variables to Rancher v.2.5.9, please? Thank you