aws-eks: OCI HelmChart from public.ecr.aws only works in us-east-1

[esw-amzn]

Describe the bug

I'm trying to add a HelmChart from the public.ecr.aws OCI repository to a stack deployed in us-west-2 and am getting this error.

Received response status [FAILED] from custom resource. Message returned: Error: b'\nAn error occurred (UnsupportedCommandException) when calling the GetAuthorizati
onToken operation: GetAuthorizationToken command is only supported in us-east-1.\nLogin Succeeded\nError: public.ecr.aws/aws-controllers-k8s/apigatewayv2-chart:0.1.
5: not found\n'  

Expected Behavior

I expect the chart to install without error.

Current Behavior

Failing with the following error.

Received response status [FAILED] from custom resource. Message returned: Error: b'\nAn error occurred (UnsupportedCommandException) when calling the GetAuthorizati
onToken operation: GetAuthorizationToken command is only supported in us-east-1.\nLogin Succeeded\nError: public.ecr.aws/aws-controllers-k8s/apigatewayv2-chart:0.1.
5: not found\n'  

Reproduction Steps

The HelmChart used looks like this. Stack was deployed into us-west-2.

        const chart = new eks.HelmChart(this, 'Resource', {
            cluster: cluster,
            chart: 'apigatewayv2-controller',
            version: '0.1.5',
            repository: 'oci://public.ecr.aws/aws-controllers-k8s/apigatewayv2-chart',
            namespace: NAMESPACE,
            values: {
                cloudProvider: 'aws',
                awsRegion: cluster.env.region,
                autoDiscovery: {
                  clusterName: cluster.clusterName,
                },
                rbac: {
                  serviceAccount: {
                    create: false,
                    name: this._service_account.serviceAccountName,
                  },
                },
                metrics: {
                  enabled: true,
                },
              },
            });

Possible Solution

Change this line of code https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-eks/lib/kubectl-handler/helm/__init__.py#L113

to

region = 'us-east-1'

Additional Information/Context

According to the Amazon ECR public registries documentation the region should always be us-east-1 for the ecr-public get-login-password operation.

https://docs.aws.amazon.com/AmazonECR/latest/public/public-registries.html#public-registry-auth
When authenticating to a public registry, always authenticate to the us-east-1 Region when using the AWS CLI.

CDK CLI Version

2.62.2 (build c164a49)

Framework Version

No response

Node.js Version

v14.21.2

OS

Amazon Linux 2

Language

Typescript

Language Version

4.7.4

Other information

No response

[pahud]

related to #23052

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[pahud]

reopening this issue as #23176 is not resolved yet.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.