Comments (4)
That is very odd @jjmilburn! The ecr plugin basically just calls docker login
under the hood and should work exactly as you describe 🤔 My first thought is that for some reason the account id's or regions aren't matching up between the two, but some troubleshooting is needed.
Mind dropping us a link to the failing build to [email protected] and we will have a look?
from ecr-buildkite-plugin.
Will do, thank you!
@lox I dropped an email to [email protected]
and can continue to engage there or here - either way.
from ecr-buildkite-plugin.
I've seen this behavior when the AWS role used by the Buildkite agent doesn't have access to the AWS ECR: the login succeeds, but the cannot access the repository.
Worth a look to see if it's the cause of your problem.
from ecr-buildkite-plugin.
EDIT: PEBCAK. I was missing the leading ci:
in front of cache-from: <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci:latest
. It should have been cache-from: ci:<ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci:latest
Original post below
I'm having this same/similar issue. For the record, the IAM role has been granted full ECR access, as a sanity check, and still does not pull from ECR, although it pushes to ECR totally fine...
Here's the relevant part of my pipeline.yml
:
steps:
- label: ":docker: Build an image"
plugins:
- ecr#v2.1.1:
login: true
region: us-west-2
no-include-email: true
- docker-compose#v3.7.0:
build: ci
image-repository: <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci
cache-from: <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci:latest
push:
- ci:<ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci
- ci:<ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci:latest
AFAICT it should be working but it fails to pull from the repo, even tho the images are there and tagged latest. Here's the log of successful ECR login:
Logs successful ECR login:
Running plugin ecr environment hook
[2020-10-16T14:35:18Z] $ var/lib/buildkite-agent/plugins/github-com-buildkite-plugins-ecr-buildkite-plugin-v2-1-1/hooks/environment
[2020-10-16T14:35:19Z] WARNING! Your password will be stored unencrypted in /var/lib/buildkite-agent/.docker/config.json.
[2020-10-16T14:35:19Z] Configure a credential helper to remove this warning. See
[2020-10-16T14:35:19Z] https://docs.docker.com/engine/reference/commandline/login/#credentials-store
[2020-10-16T14:35:19Z]
[2020-10-16T14:35:19Z] Login Succeeded
But then the ECR pull fails, saying I may need docker login:
:docker: Pulling cache image for <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci
[2020-10-16T14:35:24Z] $ docker pull latest
[2020-10-16T14:35:25Z] Using default tag: latest
[2020-10-16T14:35:26Z] Error response from daemon: pull access denied for latest, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
[2020-10-16T14:35:26Z] Exited with 1
[2020-10-16T14:35:26Z] !!! :docker: Pull failed. latest will not be used as a cache for <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci
The repo + image definitely exist in ECR, and are in the us-west-2 region: <ACCOUNT>.dkr.ecr.us-west-2.amazonaws.com/d2-ci:latest
As @lox said, I should not need a to define a separate docker login
plugin, since ecr
should be using it under the hood anyway. Also I'm able to push to ECR fine, confirming that ecr
login is working, at least in that case.
Any advice would be a huge help, thank you in advance.
from ecr-buildkite-plugin.
Related Issues (20)
- Needs a new release for the documented `region` option to work HOT 3
- Action Required: Fix Renovate Configuration
- Windows: "Expected buildkite-agent to be in the form x.y.z" HOT 4
- Docker login command written as output HOT 3
- Account ids inconsistent in the readme HOT 1
- Doesn't play nice with `aws-assume-role` HOT 6
- Confused about default AWS region HOT 2
- Incompatible with awscli v2
- Use of `mapfile` introduces bash4 dependency making local runs difficult on macOS HOT 4
- Document permissions required for this repo HOT 1
- Add support for logging to ECR public
- Clarify which versions no-include-email option applies to HOT 1
- ECR login hangs forever – sporadically HOT 2
- Dependency Dashboard
- Retry doesn't seems to work on docker login HOT 1
- Environment Variable strangeness HOT 1
- AWS Profile Support
- Documentation mismatch HOT 1
- Unable to checkout version tags? HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from ecr-buildkite-plugin.