[EKS] [request]: Document ECR images and repositories required by EKS
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
I'd like to easily have access to the list of images and ECR repositories needed by EKS to be able to run. While [some add-ons have part of this information available on the "_Amazon EKS add-on container image addresses_" page](https://docs.aws.amazon.com/eks/latest/userguide/add-ons-images.html), the repository names are missing. Likewise, not all EKS components are included.
An extension of that page for all AWS-provided images would be awesome!
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
I am trying to limit what images can be pulled though the ECR VPC Endpoints. The information requested would also be helpful for folks looking into [writing an k8s admission controller that would restrict what images can be used in the EKS cluster](https://twitter.com/samuelkarp/status/1475979049574944773).
**Are you currently working around this issue?**
I manually went through a process of trial and error to find out the list of images 🙂
The current list, for my particular usecase, is composed of `repository/amazon-k8s-cni-init` and `repository/amazon-k8s-cni` for the AWS VPC CNI, `repository/eks/kube-proxy`, `repository/eks/coredns`, and the two pause containers `repository/eks/pause-amd64` and `repository/eks/pause-arm64` which somehow are not in a single multi-arch repo. Other components will extend this list (note the lack of storage drivers, for example).
Using Terraform syntax, for full repository names:
```hcl
data "aws_partition" "current" {
}
data "aws_region" "current" {
}
locals {
# AWS-managed ECR Repositories for official images
# See https://docs.aws.amazon.com/eks/latest/userguide/add-ons-images.html
# and https://github.com/aws/containers-roadmap/issues/1615
eks_ecr_image_accounts_lookup = {
"af-south-1" = "877085696533"
"ap-east-1" = "800184023465"
"ap-northeast-1" = "602401143452"
"ap-northeast-2" = "602401143452"
"ap-northeast-3" = "602401143452"
"ap-south-1" = "602401143452"
"ap-southeast-1" = "602401143452"
"ap-southeast-2" = "602401143452"
"ca-central-1" = "602401143452"
"cn-north-1" = "918309763551"
"cn-northwest-1" = "961992271922"
"eu-central-1" = "602401143452"
"eu-north-1" = "602401143452"
"eu-south-1" = "590381155156"
"eu-west-1" = "602401143452"
"eu-west-2" = "602401143452"
"eu-west-3" = "602401143452"
"me-south-1" = "558608220178"
"sa-east-1" = "602401143452"
"us-east-1" = "602401143452"
"us-east-2" = "602401143452"
"us-gov-east-1" = "151742754352"
"us-gov-west-1" = "013241004608"
"us-west-1" = "602401143452"
"us-west-2" = "602401143452"
}
}
images_required = [
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/amazon-k8s-cni-init",
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/amazon-k8s-cni",
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/eks/kube-proxy",
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/eks/coredns",
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/eks/pause-amd64",
"arn:${data.aws_partition.current.partition}:ecr:${data.aws_region.current.name}:${local.eks_ecr_image_accounts_lookup[data.aws_region.current.name]}:repository/eks/pause-arm64",
]
```
**Additional context**
Anything else we should know?
Ref: https://github.com/bottlerocket-os/bottlerocket-project-website/issues/259 is a related issue where a similar list is requested for Bottlerocket.
Contributor guide
Research direction
Start with the linked Amazon EKS add-on container image addresses page and compare its coverage with the repository and image examples in this issue. Identify the AWS-provided EKS components and regional repository names that are missing, including storage drivers, then document a complete, maintainable list for image-pull restrictions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, documentation
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100