ECR PrivateLink Support

[abby-fuller]

Provide customers with private endpoint access to their Amazon ECR repositories.

[coultn]

This should address or least mitigate the need for https://github.com/aws/amazon-ecs-agent/issues/1447.

[copumpkin]

As well as adding an enthusiastic vote for this, I'd like to vote for endpoint policies on the PrivateLink when it comes 😄 same with #20 and #22 of course

[jtoberon]

As well as adding an enthusiastic vote for this, I'd like to vote for endpoint policies on the PrivateLink when it comes 😄 same with #20 and #22 of course

We decided to break out this feature in order to ship PrivateLink sooner: #132

[christopherhein]

🚀 https://aws.amazon.com/about-aws/whats-new/2019/01/aws-fargate--amazon-ecs--and-amazon-ecr-now-have-support-for-aws/

[abby-fuller]

shipped 1/25!

[jtoberon]

We're reopening this because we need to clarify a few details: You need to upgrade to the latest ECS agent, 1.25.1. If you rely on the ECR credentials helper, you need to upgrade, too. Fargate support is not available yet, but will be available soon.

[copumpkin]

@jtoberon what goes wrong if you use it with Fargate? I just saw a blog post on the AWS blog about using them all together, so I'm a bit confused now.

[jtoberon]

@copumpkin the blog refers to ECS in EC2 mode. Apologies for the confusion. Currently, if you use Fargate with ECR PrivateLink, then pulls will fail. When Fargate works for all Platform Versions, then we will close this issue.

[copumpkin]

Ah I see the blog post I was talking about was taken down, never mind. Anyway I look forward to using it with fargate :)

…

On Jan 27, 2019, at 23:25, Josh Oberwetter ***@***.***> wrote: @copumpkin the blog refers to ECS in EC2 mode. Apologies for the confusion. Currently, if you use Fargate with ECR PrivateLink, then pulls will fail. When Fargate works for all Platform Versions, then we will close this issue. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or mute the thread.

[angusfz]

Just try to use Fargate with ECR Privatelink but task start fail with error CannotPullContainerError: inactivity time exceeded timeout

[jtoberon]

@angusfz

Just try to use Fargate with ECR Privatelink but task start fail with error CannotPullContainerError: inactivity time exceeded timeout

@angusfz Please see the information provided above: "Currently, if you use Fargate with ECR PrivateLink, then pulls will fail. When Fargate works for all Platform Versions, then we will close this issue."

[gilinachum]

@abby-fuller solved? https://aws.amazon.com/about-aws/whats-new/2019/01/aws-fargate--amazon-ecs--and-amazon-ecr-now-have-support-for-aws/

[jtoberon]

Yes, this is fully solved now.

[RyPeck]

ECR FAQs should be updated to reflect this great new feature.

Q: Can I access Amazon ECR inside a VPC?
To use Amazon ECR within a VPC, your instances must be able to communicate with the Internet. You can do this with Amazon VPC NAT Gateway.
https://aws.amazon.com/ecr/faqs/

[jtoberon]

ECR FAQs should be updated to reflect this great new feature.

Q: Can I access Amazon ECR inside a VPC?
To use Amazon ECR within a VPC, your instances must be able to communicate with the Internet. You can do this with Amazon VPC NAT Gateway.
https://aws.amazon.com/ecr/faqs/

Nice catch. Thank you!

[angusfz]

Yes, this is fully solved now.

@jtoberon Does this mean Fargate can work with PrivateLink ?

[jtoberon]

Yes.

[ronkorving]

@jtoberon
So why does https://aws.amazon.com/about-aws/whats-new/2019/01/aws-fargate--amazon-ecs--and-amazon-ecr-now-have-support-for-aws/ mention that @gilinachum linked to say AWS Fargate support for PrivateLink will be available soon.? I'm confused :)

[Sodki]

@ronkorving At the time it was going to come soon, but now it's here.

[ronkorving]

Awesome, thanks! :) That was very soon then :)

[frumania]

Is the ECR PrivateLink now also supported via EKS?

[christopherhein]

Is the ECR PrivateLink now also supported via EKS?

@frumania not yet, there are changes that need to be made in https://github.com/kubernetes/kubernetes see kubernetes/kubernetes#73435 which merged it into master and there is a cherrypick kubernetes/kubernetes#73755 to add it into 1.13 once that is done we can cherrypick in into earlier versions

[tabern]

@frumania with Kubernetes version 1.13, ECR PrivateLink is now supported via EKS. #30 (comment)