Fluxcd ImageRepository authentication with AWS Elastic Container Registry Not working

Question

Fluxcd ImageRepository authentication with AWS Elastic Container Registry Not working on ARM64 graviton node.

After debugging I found that the image used in the init container to get cred credentials is not supporting Arm64 instances.

image name:-bitnami/kubectl

doc link:-https://fluxcd.io/docs/guides/image-update/

Answer 1

There are some workarounds, provided on the fluxcd documentation portal:

• AWS Elastic Container Registry
• Using a JSON key
• Using Static Credentials

AWS Elastic Container Registry

The solution proposed is to create a cronjob that runs every 6 hours which would re-create the docker-registry secret using a new token.

JSON key

A Json key doesn’t expire, so we don’t need a cronjob, we just need to create the secret and reference it in the ImagePolicy. First, create a json key file by following this documentation. Grant the service account the role of Container Registry Service Agent so that it can access GCR and download the json file.

Static Credentials

Instead of creating the Secret directly into your Kubernetes cluster, encrypt it using Mozilla SOPS or Sealed Secrets, then commit and push the encypted file to git.

This Secret should be in the same Namespace as your flux ImageRepository object. Update the ImageRepository.spec.secretRef to point to it.