feat(nodeadm): support public ecr authenticated ipv6 pulls#2593
feat(nodeadm): support public ecr authenticated ipv6 pulls#2593mselim00 merged 1 commit intoawslabs:mainfrom
Conversation
|
flipped to draft, it doesn't seem like the ecr cred provider currently supports dualstack for ipv6 for the public registry, the host is hardcoded to the ipv4 one https://github.com/kubernetes/cloud-provider-aws/blob/742c08cb45041fa4650199179947714ad21b49b8/cmd/ecr-credential-provider/main.go#L44 |
|
working on adding that support in the cred provider then we can do this: |
mselim00
force-pushed
the
public-dualstack
branch
2 times, most recently
from
f9ee86c to
c00097b
Compare
|
gosec failure is unrelated: #2640 |
| "public.ecr.aws", | ||
| } | ||
| if semver.Compare(kubeletVersion, "v1.36.0") >= 0 { | ||
| // currently only v1.36.0+ of ecr-credential-provider supports this |
There was a problem hiding this comment.
I'm confused by this line -- is ecr-credential-provider versioning locked to kubernetes versions? Can you backport your change to the earlier release branches of ecr provider?
There was a problem hiding this comment.
yeah ecr credential provider is Kubernetes versioned, it needs to handle kubelet’s credential request/response schema and is bundled w/ cloud provider aws atm.
I’ll check on back porting the change
mselim00
force-pushed
the
public-dualstack
branch
from
c00097b to
1cc3755
Compare
2 participants
Issue #, if available:
Resolves #2592
Description of changes:
Adds the dualstack endpoint for public ECR per https://docs.aws.amazon.com/AmazonECR/latest/public/public-ecr-requests.html.
This will support authenticated image pulls for Ipv6 nodes from public ECR. This is not strictly necessary, but it increases pull allowances to reduce throttling, as detailed in https://docs.aws.amazon.com/AmazonECR/latest/public/public-service-quotas.html.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Testing Done
See this guide for recommended testing for PRs. Some tests may not apply. Completing tests and providing additional validation steps are not required, but it is recommended and may reduce review time and time to merge.