How to pull Helm chart from AWS ecr locally

user_1558312 0
Viewed 4369

We have one ecr repo on AWS. That contains all helm charts. This ecr is protected and someone assigned one role to me. this role allows me to all the images from aws cli console.

Now I am using helm to deploy chart. so for what i used following piece of code. When I run helm dep update command then this only pull postgres image and test-chart request fails with error 401.

I understand that somewhere I need to mention the aws credentials but don't know where I should use it. One more thing it would be nice if someone can tell be how to access this with AWS access-token.

dependencies:
  - name: postgresql
    version: 9.2.1
    repository: https://charts.bitnami.com/bitnami
    condition: postgresql.enabled
  - name: createdb
    version: latest
    repository: https://111.ecr.eu-central-1.amazonaws.com/test-chart
amazon-ecr kubernetes-helm
2 Answers

Helm client version 3 does support ECR as Helms chart repository now. Although, currently any OCI-based registry support is considered experimental on the Helms official documentation.

Assuming you have the required permissions and have already pushed the helm chart to ECR (follow documentation here if you haven't), you can (optionally) do a quick aws ecr describe-images to get the list of available tags of your helm-chart on the ECR repo.

aws ecr describe-images --repository-name <your-repo-name> --region <region> --profile <profile>
{
    "imageDetails": [
        {
            "registryId": "************",
            "repositoryName": "<your-repo-name>",
            "imageDigest": "sha256:******************************************",
            "imageTags": [
                "0.1.6"
            ],
            "imageSizeInBytes": 3461,
            "imagePushedAt": "2021-04-07T00:16:31+01:00",
            "imageManifestMediaType": "application/vnd.oci.image.manifest.v1+json",
            "artifactMediaType": "application/vnd.cncf.helm.config.v1+json"
        }
    ]
}

Get ECR token & login to helm repo:

aws ecr get-login-password --region <region> | helm registry login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<region>.amazonaws.com

Once you have the required details, you can run a helm chart pull command to pull the chart from ECR.

helm chart pull <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6
0.1.6: Pulling from <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>
ref:     <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6
digest:  d16af8672604ebe54********************************************
size:    3.2 KiB
name:    <your-chart-name>
version: 0.1.6
Status: Chart is up to date for <aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>:0.1.6

Verify:

helm chart list
REF                                                                       NAME              VERSION DIGEST  SIZE    CREATED
<aws_account_id>.dkr.ecr.<region>.amazonaws.com/<your-repo-name>... <your-chart-name>       0.1.6   50f03e4 3.2 KiB 22 second
user_17223260

Storing/pulling/installing a chart from any OCI compatible registry is no more an experimental from version 3.7+

With ECR, once you've logged in:

$ aws ecr get-login-password --region eu-west-1 | helm registry login \
       --username AWS --password-stdin 12345678910.dkr.ecr.eu-west-1.amazonaws.com

you can pull the chart via:

$ helm pull \
    oci://12345678910.dkr.ecr.eu-west-1.amazonaws.com/my/helm/chart --version 0.1.19
Pulled: 12345678910.dkr.ecr.eu-west-1.amazonaws.com/my/helm/chart:0.1.19
Digest: sha256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Tested with helm 3.9.0

user_36232240
Related