aws ecr chart pull error: 403 Forbidden failed to download chart

[jerryc8]

Hi, we are using oci// to download private helm charts stored in AWS ECR. However, we are encountering 403 Forbidden when trying this. source-controller is at the latest version v0.31.0

The chart on AWS Console look like:

The helm release file:

apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: httpbin
spec:
  chart:
    spec:
      chart: httpbin
      sourceRef:
        kind: HelmRepository
        name: httpbin
      version: 0.1.0
  interval: 5m0s

The helm repo file:

apiVersion: source.toolkit.fluxcd.io/v1beta2
kind: HelmRepository
metadata:
  name: httpbin
spec:
  interval: 1m0s
  provider: "aws"
  type: "oci"
  url: oci://0123123123.dkr.ecr.us-west-2.amazonaws.com/httpbin

The 403 Forbidden error in source-controller:

{"level":"error","ts":"2022-11-08T07:54:04.315Z","msg":"Reconciler error","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","HelmChart":{"name":"httpbin-httpbin","namespace":"httpbin"},"namespace":"httpbin","name":"httpbin-httpbin","reconcileID":"df2c1e52-77c9-4720-a458-b7220e9b8ca0","error":"chart pull error: failed to download chart for remote reference: pulling from host 0123123123.dkr.ecr.us-west-2.amazonaws.com failed with status code [manifests 0.1.0]: 403 Forbidden","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\tsigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:326\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\tsigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:273\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\tsigs.k8s.io/controller-runtime@v0.13.0/pkg/internal/controller/controller.go:234"}

In the helm repo file, already tried these url variations and encountered errors too:

• oci://0123123123.dkr.ecr.us-west-2.amazonaws.com : error "failed to get credential from aws: could not validate OCI provider aws with URL oci://0123123123.dkr.ecr.us-west-2.amazonaws.com"
• oci://0123123123.dkr.ecr.us-west-2.amazonaws.com/: error "failed to get credential from aws: failed to parse URL '0123123123.dkr.ecr.us-west-2.amazonaws.com/': could not parse reference: 0123123123.dkr.ecr.us-west-2.amazonaws.com/"

Any idea how to get private repo helm charts working for AWS ECR?

[souleb]

this seems related to #951. Passing the aws account in those public issues is not a good idea.

[jerryc8]

closing because this is duplicate of #951