Domain public.aws.ecr fails if not authed to AWS about docker-credential-magic

[rothgar]

Thanks for pinging me on this. If it is found to be an ECR issue I'll ping the team to figure it out.

[jonjohnsonjr]

Binary appears to be doing the right thing, but helm isn't interpreting the response correctly:

https://github.com/docker/docker-credential-helpers/blob/e595cd69465c6b0f7af2d49582b82fdeddecbf75/credentials/error.go#L6

See here: https://github.com/docker/cli/blob/a32cd16160f1b41c1c4ae7bee4dac929d1484e59/cli/config/credentials/native_store.go#L118-L126

[jdolitsky]

Yep, appears a bug in Helm (or underlying lib). I'll try to track it down.

We are able to docker pull images from that endpoint:

$ docker pull public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest
latest: Pulling from cloudwatch-agent/cloudwatch-agent
c0f00c860e21: Pull complete 
2e2cc64243eb: Pull complete 
6d4302a1fa16: Pull complete 
Digest: sha256:5e22a8c01449f1acf2d37e4670487e05a5d54590653236fee953abf61220cf17
Status: Downloaded newer image for public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest
public.ecr.aws/cloudwatch-agent/cloudwatch-agent:latest

Closing for now

[jdolitsky]

Appears to work on latest Helm 3.8 RC:

$ helm version
version.BuildInfo{Version:"v3.8.0-rc.2", GitCommit:"d14138609b01886f544b2025f5000351c9eb092e", GitTreeState:"clean", GoVersion:"go1.17.5"}

$ helm pull oci://public.ecr.aws/aws-controllers-k8s/apigatewayv2-chart --version v0.0.8
Pulled: public.ecr.aws/aws-controllers-k8s/apigatewayv2-chart:v0.0.8
Digest: sha256:299d8b520291ade6d136a7529b7fd44338d58b5b8239813aed97e8fd81ca1f0

So, it appears to OK? Sorry, perhaps user error on my end.