diff --git a/docs/spec/v1alpha2/imagerepositories.md b/docs/spec/v1alpha2/imagerepositories.md index d690bd27..462d7a0b 100644 --- a/docs/spec/v1alpha2/imagerepositories.md +++ b/docs/spec/v1alpha2/imagerepositories.md @@ -122,7 +122,7 @@ type ImageRepositoryStatus struct { // +optional ObservedGeneration int64 `json:"observedGeneration,omitempty"` - // CannonicalName is the name of the image repository with all the + // CanonicalImageName is the name of the image repository with all the // implied bits made explicit; e.g., `docker.io/library/alpine` // rather than `alpine`. // +optional diff --git a/docs/spec/v1beta1/imagerepositories.md b/docs/spec/v1beta1/imagerepositories.md index e38471ba..70f1f722 100644 --- a/docs/spec/v1beta1/imagerepositories.md +++ b/docs/spec/v1beta1/imagerepositories.md @@ -61,7 +61,7 @@ type ImageRepositorySpec struct { ``` The `Suspend` field can be set to `true` to stop the controller scanning the image repository -specified; remove the field value or set to `false` to resume scanning. +specified; remove the field value or set it to `false` to resume scanning. ### Authentication @@ -77,9 +77,40 @@ For a publicly accessible image repository, you will not need to provide a `secr When running in [EKS][EKS] and using [ECR][ECR] to store images, you should be able to rely on -the controller retrieving credentials automatically. The controller must be run with the flag -`--aws-autologin-for-ecr` set for this to work. The advice under "Other platforms" below will also -work for ECR. +the controller retrieving credentials automatically. + +The `image-reflector-controller` must be run with the flag `--aws-autologin-for-ecr` set for this to work. + +This flag can be added by including a patch in the `kustomization.yaml` overlay file in your `flux-system`, +similar to the process described in [customize Flux manifests][]: + +``` +patches: + - target: + version: v1 + group: apps + kind: Deployment + name: image-reflector-controller + namespace: flux-system + patch: |- + - op: add + path: /spec/template/spec/containers/0/args/- + value: --aws-autologin-for-ecr +``` + +Alternatively, the advice under [Other platforms][other platforms] below will also work for ECR. + +> You need to upgrade to Flux version 2 release [v0.19][Flux v0.19.0] that contains the image-reflector-controller release [v0.13.0][image-reflector-controller v0.13.0]. + +> [**Release date**: 2021-10-19][image-reflector-controller v0.13.0] +> +> This prerelease adds experimental support for automatically getting +credentials from AWS when scanning an image in [Elastic Container Registry +(ECR)][ECR]. +> +> Improvements: +> * Get credentials from AWS ECR when needed +> [#174][image-reflector-controller#174] #### Other platforms @@ -190,7 +221,7 @@ type ImageRepositoryStatus struct { // +optional ObservedGeneration int64 `json:"observedGeneration,omitempty"` - // CannonicalName is the name of the image repository with all the + // CanonicalImageName is the name of the image repository with all the // implied bits made explicit; e.g., `docker.io/library/alpine` // rather than `alpine`. // +optional @@ -261,3 +292,8 @@ and reference it under `secretRef`. [sops-guide]: https://toolkit.fluxcd.io/guides/mozilla-sops/ [EKS]: https://docs.aws.amazon.com/eks/latest/userguide/what-is-eks.html [ECR]: https://docs.aws.amazon.com/AmazonECR/latest/userguide/what-is-ecr.html +[customize Flux manifests]: https://fluxcd.io/docs/installation/#customize-flux-manifests +[other platforms]: https://fluxcd.io/docs/components/image/imagerepositories/#other-platforms +[Flux v0.19.0]: https://github.com/fluxcd/flux2/releases/tag/v0.19.0 +[image-reflector-controller v0.13.0]: https://github.com/fluxcd/image-reflector-controller/blob/main/CHANGELOG.md#0130 +[image-reflector-controller#174]: https://github.com/fluxcd/image-reflector-controller/pull/174