Pull images from Kubernetes running on AWS with ECR pulls images from the wrong region in other account

Question

I have k8s clusters on AWS working with ECR and pulling images from all regions. This works fine.

But when I try to pull images from a different account they get "no such host". I followed these instructions to set iam permissions (and the docs). I'm not getting permission denied - I'm getting this:

Failed to pull image "<acc id>.dkr.ecr.ap-outheast-2.amazonaws.com/image:tag": 
rpc error: code = Unknown desc = Error response from daemon: 
Get https://<acc id>.dkr.ecr.ap-outheast-2.amazonaws.com/v1/_ping: 
dial tcp: lookup <acc id>.dkr.ecr.ap-outheast-2.amazonaws.com 
on 10.71.0.2:53: no such host

My cluster is running in ap-southeast-1 and the IP 10.71.0.2:53 is the default DNS AWS set for the VPC

I'm trying to wok around this by populating this region's ECR as well. But it seems pretty wrong.

Any idea how to allow ECR to pull from another region?

Answer 1

I think you made simple typo in .dkr.ecr.ap-outheast-2.amazonaws.com/image:tag - that's why you receive no such host from DNS server, just try to replace ap-outheast-2 with ap-southeast-2.

Generally if you set ECR IAM right that should work as ECR is accessible/routable as public service in Internet with limitations based on IAM.