Re: [I] ECR Create-on-Push with EKS Pod Identity [camel-k]

["davea93 (via GitHub)" <gi...@apache.org>]

davea93 commented on issue #6534:
URL: https://github.com/apache/camel-k/issues/6534#issuecomment-5597934541

   @matteoredaelli I solved this on EKS with a custom kaniko push task in the IntegrationPlatform builder trait. Instead of relying on Jib's credential discovery, I replaced the built-in publish step with a direct kaniko push that pulls credentials from the builder pod's environment.
   
   `spec:
     build:
       registry:
         address: 123456789.dkr.ecr.eu-west-2.amazonaws.com
         organization: camel-integrations/camel-k
         secret: null
     traits:
       builder:
         tasks:
           - 'kaniko-push;gcr.io/kaniko-project/executor:v1.23.2-debug;/busybox/sh -c "cd context && /kaniko/executor --dockerfile=Dockerfile --context=. --destination=$(INTEGRATION_KIT_IMAGE) --digest-file=/dev/termination-log";0'
         tasksFilter: builder,package,kaniko-push
   `
   
   The builder pod (camel-k-builder ServiceAccount) has an IAM role with ECR push permissions via EKS Pod Identity. Kaniko executor automatically picks up those credentials from the pod environment, no credential helpers or Docker config needed.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org