Using ECR Images

Amazon ECR is AWS's private container registry; nodes pull images from it automatically.

Amazon ECR (Elastic Container Registry) is where most EKS teams store their container images. It integrates with IAM, so worker nodes can pull images without you managing registry passwords.

How authentication works

The node IAM role includes AmazonEC2ContainerRegistryReadOnly, letting the kubelet pull private images from ECR in the same account with no imagePullSecret needed.

Push then reference

  1. Build your image and tag it with the ECR repository URI.
  2. Authenticate Docker to ECR and push.
  3. Reference the full ECR image URI in your Deployment.

Example

Example · bash
# Log in, build, tag, and push an image to ECR
aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS \
    --password-stdin 111122223333.dkr.ecr.us-east-1.amazonaws.com

docker build -t web:1.0 .
docker tag web:1.0 111122223333.dkr.ecr.us-east-1.amazonaws.com/web:1.0
docker push 111122223333.dkr.ecr.us-east-1.amazonaws.com/web:1.0

When to use it

  • A DevOps team pushes a newly built Docker image to ECR in CI and references the ECR URI in the Deployment so EKS nodes pull it without public internet access.
  • A security team configures ECR lifecycle policies to automatically delete untagged images older than 30 days, keeping storage costs under control.
  • A platform team enables ECR image scanning on push to detect known CVEs in base images before they are deployed to the EKS cluster.

More examples

Login and push image to ECR

Authenticates to ECR with a temporary token, builds a local image, tags it with the ECR repository URI, and pushes it.

Example · bash
ACCOUNT=123456789012
REGION=us-east-1
REPO=$ACCOUNT.dkr.ecr.$REGION.amazonaws.com/my-app

aws ecr get-login-password --region $REGION | \
  docker login --username AWS --password-stdin $ACCOUNT.dkr.ecr.$REGION.amazonaws.com

docker build -t my-app:v1.0 .
docker tag my-app:v1.0 $REPO:v1.0
docker push $REPO:v1.0

Use ECR image in a Deployment

A Deployment that references a private ECR image; EKS nodes use their IAM instance profile to pull the image automatically.

Example · yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0
        imagePullPolicy: Always

Set ECR lifecycle policy

Sets a lifecycle policy that automatically removes untagged images from the ECR repository after 30 days, reducing storage costs.

Example · bash
aws ecr put-lifecycle-policy \
  --repository-name my-app \
  --lifecycle-policy-text '{
    "rules": [{
      "rulePriority": 1,
      "description": "Expire untagged images after 30 days",
      "selection": {"tagStatus": "untagged", "countType": "sinceImagePushed", "countUnit": "days", "countNumber": 30},
      "action": {"type": "expire"}
    }]
  }'

Discussion

  • Be the first to comment on this lesson.