[AWS] ArtifactHub installation

[adloiseau]

Hi,

I followed the installation guide (on EKS), but when i want to add my first Helm chart repository store in our private AWS ECR (OCI) the tracker job sends me:

{"level":"error","cmd":"tracker","repo":"nginx-s3","kind":"helm","error":"error getting repository remote digest: GET https://xxxx.dkr.ecr.eu-west-3.amazonaws.com/v2/helm/nginx-s3/tags/list?n=1000: unexpected status code 401 Unauthorized: Not Authorized\n","time":"2023-03-17T18:05:19Z"}

My nodes are allowed to pull on AWS ECR, and I don't want to create an IAM user with "hard-coded" credentials..

Please help me ?

[tegioz]

Hi @adloiseau 👋

For private repositories, you need to provide the credentials manually in the form you shared.

[tegioz]

Yes, I understood, but it's not possible to set those credentials at the host level at the moment.

Please keep in mind that Artifact Hub is designed in a way that it can process repositories from multiple possibly unrelated publishers. When using private repositories, it may be possible that one repository requires different credentials than other repository in the same registry. Logging in at the registry level might not provide that level of flexibility.

If you want to rotate your credentials you could setup some automated process that talks to the http api or even directly to the database.

Hope that helps :)

[adloiseau]

Thanks you I understand, i think that be interesting to include authentication on backend like injecting secrets values on pods ?
I'm using AWS with SSO i can't create a user IAM..

It's possible to apply metadata without repo credentials with ArtifactHub API? Then deactivate cronjob tracker

[tegioz]

It's possible to apply metadata without repo credentials with ArtifactHub API? Then deactivate cronjob tracker

Mmm no, that's not possible, as there isn't an API endpoint to add a package, for example.

I don't know if it's an option in your case, but maybe you could consider adding a mirror registry to host the repositories you'd like to add to AH and restrict access to it at the network level so that only AH can reach it.

[adloiseau]

maybe with this values?
https://github.com/artifacthub/hub/blob/master/charts/artifact-hub/values.yaml#L63-L67

[tegioz]

That's not used for authenticating to private registries actually, it's just to avoid being rate limited by the Docker Hub (and only used for that registry).