<p>If you're encountering an authorization error when pulling an image in an EKS environment, even though the credentials are correct, here are a few steps to ensure everything is set up correctly:</p>
<p>Verify IAM Policies: Ensure the worker nodes (or Fargate tasks) have the appropriate IAM role attached.</p>
<p>For example, if pulling from AWS ECR, the role should include policies like AmazonEC2ContainerRegistryReadOnly. The minimum required actions include:
ecr:GetAuthorizationToken
ecr:BatchCheckLayerAvailability
ecr:GetDownloadUrlForLayer
ecr:BatchGetImage</p>
<p>Test Access Manually: If you have access to the worker nodes, SSH into one of the nodes and try pulling the image manually using Docker:
docker login 
docker pull </p>
<p>This can help confirm whether the issue is with Kubernetes configuration or the registry itself.</p>
<p>Check Pod Security Policies (PSPs): If your cluster uses Pod Security Policies or admission controllers, ensure they are not restricting the use of the imagePullSecret. Review the PSP configuration to verify permissions related to secrets and image pulling.</p>

CC BY-SA 4.0
2024-11-20T17:34:41.787Z
2024-11-20T17:34:41.787Z
Bharat goud
<p>I am working on deploying Violet Labs' Helm chart on an AWS EKS cluster. Following the setup instructions provided by Violet Labs, the deployment encounters two primary issues:</p>
<p>PostgreSQL Pod Authentication Failure:</p>
<p>Error: password authentication failed for user &quot;postgres&quot;</p>
<p>Image Pulling Failures:</p>
<p>Error: Failed to pull image &quot;violet-jupyter-user:main&quot;: failed to resolve reference &quot;docker.io/library/violet-jupyter-user:main&quot;: pull access denied, repository does not exist or may require authorization</p>
<p>The myviolet-app-0 pod is failing with the error:</p>
<p>Error during migration run: error: password authentication failed for user &quot;postgres&quot; Steps Taken to Resolve:</p>
<p>Verify Environment Variables:</p>
<p>POSTGRES_USER and POSTGRES_PASSWORD are set correctly.</p>
<p>Verify Secrets:</p>
<p>The secret myviolet-app-db contains the correct password.</p>
<p>Check Database Configuration:</p>
<p>src/config/orm.config.ts matches the environment variables.</p>
<p>Manual Connection Attempt:</p>
<p>Unable to install the PostgreSQL client for manual connection testing.</p>
<p>Issue 2: Image Pulling Failures The image puller pods are failing to pull the violet-jupyter-user:main image with errors indicating insufficient authorization:</p>
<p>Failed to pull image &quot;violet-jupyter-user:main&quot;: failed to resolve reference &quot;docker.io/library/violet-jupyter-user:main&quot;: pull access denied, repository does not exist or may require authorization Steps Taken to Resolve:</p>
<p>Deleted and recreated the secret ecr-creds with correct credentials.</p>
<p>Pod Deletion and Re-creation:</p>
<p>Deleted and recreated the image puller pods to use the new credentials.</p>
<p>Despite these steps, the issues persist. Any insights or suggestions on how to resolve these would be greatly appreciated!</p>

<kubernetes><helm><eks>
PostgreSQL Pod and Image Pull Issues in AWS EKS Deployment
Quan B
# PostgreSQL Pod and Image Pull Issues in AWS EKS Deployment

(Asked by: username_0 on 2024-11-18)

I am working on deploying Violet Labs' Helm chart on an AWS EKS cluster. Following the setup instructions provided by Violet Labs, the deployment encounters two primary issues:

PostgreSQL Pod Authentication Failure:

Error: password authentication failed for user "postgres"

Image Pulling Failures:

Error: Failed to pull image "violet-jupyter-user:main": failed to resolve reference "docker.io/library/violet-jupyter-user:main": pull access denied, repository does not exist or may require authorization

The myviolet-app-0 pod is failing with the error:

Error during migration run: error: password authentication failed for user "postgres" Steps Taken to Resolve:

Verify Environment Variables:

POSTGRES\_USER and POSTGRES\_PASSWORD are set correctly.

Verify Secrets:

The secret myviolet-app-db contains the correct password.

Check Database Configuration:

src/config/orm.config.ts matches the environment variables.

Manual Connection Attempt:

Unable to install the PostgreSQL client for manual connection testing.

Issue 2: Image Pulling Failures The image puller pods are failing to pull the violet-jupyter-user:main image with errors indicating insufficient authorization:

Failed to pull image "violet-jupyter-user:main": failed to resolve reference "docker.io/library/violet-jupyter-user:main": pull access denied, repository does not exist or may require authorization Steps Taken to Resolve:

Deleted and recreated the secret ecr-creds with correct credentials.

Pod Deletion and Re-creation:

Deleted and recreated the image puller pods to use the new credentials.

Despite these steps, the issues persist. Any insights or suggestions on how to resolve these would be greatly appreciated!

**Tags:** kubernetes, helm, eks


---

## 1 answers

### Answer by username_1 on 2024-11-20. Score: 0

If you're encountering an authorization error when pulling an image in an EKS environment, even though the credentials are correct, here are a few steps to ensure everything is set up correctly:

Verify IAM Policies: Ensure the worker nodes (or Fargate tasks) have the appropriate IAM role attached.

For example, if pulling from AWS ECR, the role should include policies like AmazonEC2ContainerRegistryReadOnly. The minimum required actions include:
ecr:GetAuthorizationToken
ecr:BatchCheckLayerAvailability
ecr:GetDownloadUrlForLayer
ecr:BatchGetImage

Test Access Manually: If you have access to the worker nodes, SSH into one of the nodes and try pulling the image manually using Docker:
docker login
docker pull

This can help confirm whether the issue is with Kubernetes configuration or the registry itself.

Check Pod Security Policies (PSPs): If your cluster uses Pod Security Policies or admission controllers, ensure they are not restricting the use of the imagePullSecret. Review the PSP configuration to verify permissions related to secrets and image pulling.


---

