[ECR] [bug]: Creation templates break pull through cache if there is resourceTags set
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Creation templates break pull through cache if there is any Resource Tags set
**Which service(s) is this request for?**
ECR
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
1. Create a Pull through cache for any public container image registry
2. Create a simple Creation template with resourceTags set, like
```
{
"prefix": "ROOT",
"encryptionConfiguration": {
"encryptionType": "AES256"
},
"resourceTags": [
{
"Key": "TagKey",
"Value": "TagVal"
}
],
"imageTagMutability": "MUTABLE",
"appliedFor": [
"PULL_THROUGH_CACHE"
]
}
```
3. Try to pull image via Pull through cache. **IT WILL FAIL**. You won't be able to use Pull through cache, in my case of using nerdctl to pull I get "not found" error from ECR
4. Recreate the same Creation template **without** resourceTags set
5. Try to pull the same image via Pull through cache again. **IT WILL SUCCEED**
**Are you currently working around this issue?**
The only workaround I found so far is to not set Resource Tags for a Creation template
**Additional context**
I don't know when this got broken, but I'm 100% sure it worked fine at least on July 10 2024 in us-west-2.
As of today (July 23 2024) this is broken.
**Attachments**
N/A
Contributor guide
Research direction
Start by reproducing the ECR pull-through cache workflow with the creation template shown in the issue, then compare it with the same template without resourceTags. Use nerdctl to verify the reported not-found failure and successful workaround. The issue is resolved when a tagged creation template allows the cached image pull to succeed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100