Guidance for pulling images from AWS ECR with the containerd api

I have not had success pulling images down from AWS ECR with containerd following the config file approach outlined here and across several other issues.

The solution in this repo takes a different approach, passing in the resolver function the the Pull method; is this the recommended approach? If not, any pointers to current best practices would be appreciated.

[mbadibanga]

ECR_REGION=<REGION>
ECR_PASSWORD=$(aws ecr get-login-password --region $ECR_REGION)
crictl pull --creds "AWS:$ECR_PASSWORD" <IMAGE:TAG>

[robertobado]

Trying mbadibanga's suggestion, I got a crictl: command not found error on Ubuntu's EKS official base image, but his solution is essentially correct. For those encountering the same error, I could get around it with

ECR_REGION=<REGION>
ECR_PASSWORD=$(aws ecr get-login-password --region $ECR_REGION)
ctr image pull -u "AWS:$ECR_PASSWORD" <IMAGE:TAG>

[danktec]

So i think the answer to the original question would be something, along these lines.

Step 1: Generate a token from ecr

TOKEN=`aws ecr --region=$REGION get-authorization-token --output text --query authorizationData[].authorizationToken | base64 -d | cut -d: -f2`

Step 2: Store the token in a k8s docker registry secret

kubectl create secret docker-registry ecr-1
    --docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \
    --docker-username=AWS \
    --docker-password="${TOKEN}" \
    --docker-email="${EMAIL}"

Step 3: Instruct the manifest to use the secret during registry operations

      imagePullSecrets:
        - name: ecr-1

Ensure this process runs every < $TOKEN_LIFETIME hours on a cron/schedule to keep the token fresh