Configuring secret for ECR pull through cache for dockerhub or github cr docs don't specify the valid key names

53 views Asked by At

As per the title, you need to set up a secret containing the username and access tokens for accessing images in certain repos but the documentation never specifies the specific key names that need to be set in the AWS secrets manager secret. So I've guessed at username and I've tried access token, access-token, access_token and token. None seem to have worked so far so I'm looking for an answer to what the key names are for both ghcr.io and dockerhub (if they are different).

I'm implementating via Terraform but that makes no difference here, and the highly suspect docs are here. I do have public repos like the k8s one working already.

Also, the required permissions for the access token are never specified and I'm suspecting that accessing a public ghcr.io image, like those published by keda are maybe not supported by the pull through cache (if anyone has got this set up I'd be interested as to how).

Tried a lucky dip of potential key names. Endless Google searches and searches across YouTube videos without luck so far.

1

There are 1 answers

0
richardnpaul On

The documentation for this is here (just in case AWS break the link in future, the username key should be "username", without quotes and the access token key should be "accessToken" again without quotes).

Just another tidbit. I was using our own secrets module which automatically creates and uses a unique KMS key per secret. This doesn't work. You need to use the default aws/secretsmanager KMS key used if you don't specify a key.