<p>Do your IAM roles that are attached to EC2 instances that are in EKS cluster have ECR iam policies?
If not please update IAM roles
Ref Link: 
<a href="https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html#:~:targetText=The%20Amazon%20EKS%20worker%20node,policy%20permissions%20for%20Amazon%20ECR.&amp;targetText=When%20referencing%20an%20image%20from,tag%20naming%20for%20the%20image." rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html#:~:targetText=The%20Amazon%20EKS%20worker%20node,policy%20permissions%20for%20Amazon%20ECR.&amp;targetText=When%20referencing%20an%20image%20from,tag%20naming%20for%20the%20image.</a></p>

CC BY-SA 4.0
2019-11-12T15:54:56.593Z
Yes, the IAM role has the correct permissions.
Matthew
CC BY-SA 4.0
2019-11-12T14:24:55.050Z
2019-11-12T14:24:55.050Z
rajiv reddy
<p>This error can appear when the <a href="https://github.com/kubernetes/kubernetes/blob/v1.26.15/pkg/credentialprovider/aws/aws_credentials.go" rel="nofollow noreferrer">AWS Credentials Provider in Kubernetes</a> has a problem getting an authorization token.</p>
<p>Your node needs the permission <code>ecr:GetAuthorizationToken</code> both in IAM and, if you're using a VPC Endpoint for ECR, the node needs permission to get a token through the VPC Endpoint as well.</p>
<p>One way you may want to debug this is by attempting to pull the image to an EC2 instance where the instance has the same policies applied to the instance profile as is applied to the EKS nodes.</p>

CC BY-SA 4.0
2024-12-26T04:31:11.483Z
2024-12-26T04:31:11.483Z
Nick
<p>Using the <code>eksctl</code> tool, I created an EKS cluster with 5 nodes. My application's docker images are stored in ECR registries in the same region. I deployed my kubernetes cluster and everything has been happy for the past 6 weeks or so.</p>

<p>This morning, I came in and found 3 pods were in an <code>ErrImagePull</code> state. Using <code>kubectl describe pod &lt;pod name&gt;</code>, I found the error:</p>

<p><code>Failed to pull image "&lt;ECR REGISTRY&gt;/&lt;IMAGE&gt;": rpc error: code = Unknown desc = Error response from daemon: Get &lt;ECR REGISTRY&gt;/&lt;IMAGE&gt;: no basic auth credentials</code></p>

<p>My understanding of EKS and ECR is that I don't need a pull secret (and I haven't used one for any of the other running pods) so my guess is that some process or docker image on that node died but I can't find any docs on this.</p>

<p>Update: I forgot all about this question. When I created the original node group, I failed to include the <code>--ssh-access</code> flag which prevented me from getting onto the node and see if a kubernetes process had failed. I never found the actual solution; I simply added a taint to the problem node, created a new node, and went about my business. I'm still trying to find time to spin up a new node group with ssh access.</p>

CC BY-SA 4.0
2021-02-16T01:21:57.037Z
Did you find a solution to this?
Chris F
CC BY-SA 4.0
2021-02-17T23:26:58.427Z
Nope. Not related to this probe, we started running an internal docker registry with nexus instead.
Matthew
<docker><kubernetes>
EKS node cannot pull docker image from ECR: "no basic auth credentials"
Matthew
# EKS node cannot pull docker image from ECR: "no basic auth credentials"

(Asked by: username_0 on 2019-11-08)

Using the `eksctl` tool, I created an EKS cluster with 5 nodes. My application's docker images are stored in ECR registries in the same region. I deployed my kubernetes cluster and everything has been happy for the past 6 weeks or so.

This morning, I came in and found 3 pods were in an `ErrImagePull` state. Using `kubectl describe pod` , I found the error:

`Failed to pull image "/": rpc error: code = Unknown desc = Error response from daemon: Get /: no basic auth credentials`

My understanding of EKS and ECR is that I don't need a pull secret (and I haven't used one for any of the other running pods) so my guess is that some process or docker image on that node died but I can't find any docs on this.

Update: I forgot all about this question. When I created the original node group, I failed to include the `--ssh-access` flag which prevented me from getting onto the node and see if a kubernetes process had failed. I never found the actual solution; I simply added a taint to the problem node, created a new node, and went about my business. I'm still trying to find time to spin up a new node group with ssh access.

**Tags:** docker, kubernetes

> **Comments:**
> **username_1**: Did you find a solution to this?  
> **username_0**: Nope. Not related to this probe, we started running an internal docker registry with nexus instead.  

---

## 2 answers

### Answer by username_2 on 2019-11-12. Score: 1

Do your IAM roles that are attached to EC2 instances that are in EKS cluster have ECR iam policies?
If not please update IAM roles
Ref Link:
<https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_on_EKS.html#:~:targetText=The%20Amazon%20EKS%20worker%20node,policy%20permissions%20for%20Amazon%20ECR.&targetText=When%20referencing%20an%20image%20from,tag%20naming%20for%20the%20image.>

> **Comments:**
> **username_0**: Yes, the IAM role has the correct permissions.  

---

### Answer by username_3 on 2024-12-26. Score: 0

This error can appear when the [AWS Credentials Provider in Kubernetes](https://github.com/kubernetes/kubernetes/blob/v1.26.15/pkg/credentialprovider/aws/aws_credentials.go) has a problem getting an authorization token.

Your node needs the permission `ecr:GetAuthorizationToken` both in IAM and, if you're using a VPC Endpoint for ECR, the node needs permission to get a token through the VPC Endpoint as well.

One way you may want to debug this is by attempting to pull the image to an EC2 instance where the instance has the same policies applied to the instance profile as is applied to the EKS nodes.


---

