Unable to pull images from ecr

[juanxhos]

Hi I am having this issue:

        * unable to inspect the image (XXXXXXXX.dkr.ecr.us-west-2.amazonaws.com/XXXXXX:XXXXXXX): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
        * GET https://XXXXXXXX.dkr.ecr.us-west-2.amazonaws.com/v2/XXXXXXX/manifests/XXXXXX: unsupported status code 401; body: Not Authorized```

Images from public registries can do vuns scan but private I cant, 

Please Help

[danielpacak]

👋 @jcalonsoh Are you using Starboard CLI or the Starboard Operator? Currently the Operator does not support private registries. We'll add such support shortly, but we're also considering to switch over from Trivy stand-alone to Trivy client-server mode.

If you're using CLI, we should be able to scan an image from a private registry if you set imagePullSecret on Pod descriptor or service account level.

[juanxhos]

I wait for this beautiful feature =)

[giovannirco]

do we have an update on this? I have discovered starboard earlier this week and deployed the helm chart for the operator but I only see reports for public images

[danielpacak]

If you run workloads on EKS and container images are pulled from private ECR you usually don't create image pull secrets as documented in https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

If that's the case you have to attach an IAM policy to the starboard-operator service account as an additional configuration step. See https://aquasecurity.github.io/starboard/latest/integrations/managed-registries/#amazon-elastic-container-registry-ecr for more details.

[adelwin]

hi @danielpacak.
Seems the url regarding integration with managed-registries (ECR) no longer works.
Does this mean that ECR is no longer supported or is the page moved?
if so, i can't seem to find it.

[danielpacak]

The URL was broken. I've fixed it. Thanks for pointing this out.

[adelwin]

hi @danielpacak,
I've tried to run the eksctl steps there, it created a new IAM-Role,
Then I added the annotation in the ServiceAccount.
But i still see the an error

2022-01-18T12:06:01.595Z	 FATAL 	scan error: unable to initialize a scanner: unable to initialize a docker scanner: 3 errors occurred:
	* unable to inspect the image (602401143452.dkr.ecr.ap-southeast-1.amazonaws.com/amazon-k8s-cni:v1.10.1-eksbuild.1): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
	* unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
	* Get \"https://602401143452.dkr.ecr.ap-southeast-1.amazonaws.com/v2/\": Forbidden

I have a few questions about that,

• that error is on AWS-EKS own image, in this case, the CNI image, that image is public tho
• the error mentions about unable to connect to the Docker socket, doesn't seem to be related to access issue, i'm puzzled
• The last error says "Forbidden", different from the original poster, theirs was "Not Authorized"
• I've also tried to create a simple http-echo app, from a private ECR, still same error, the same 3 errors,

Am I missing something?

[danielpacak]

We have limited capacity to support managed clusters and managed registries. What's more we don't have enough information and permissions to investigate such issues as there are many different options and peculiarities of integrating ECR with K8s.

However, to further identify the root cause of the problems you have described, I'd probably confirm that you can scan this particular container image with Trivy executable by following this guide.

[adelwin]

i just tried to run it in a public cluster, clean, and open. it works fine.
So something must be wrong in my setup, let me review my setup and double check everything.
I suspect it's my service-account setup.
I'll report back here on what i find.

[VF-mbrauer]

@jcalonsoh, @adelwin, @giovannirco, you might look on the PR: #1103
Eventually, this is something you can make use of.

Cheers