Issue with Docker Image build using Kaniko and push to AWS ECR in GitHub Actions Workflow on AWS EKS about kaniko HOT 2 OPEN

I've been attempting to setup the same thing. I think that in your case, it seems like you don't have a /kaniko/.docker/config.json in place that contains { "credsStore": "ecr-login" }.

Once that's in place, you can try dumping the contents of /root/.ecr/log/ecr-login.log after running executor to see what docker-credential-ecr-login is doing.

    steps:
      - name: Build and Push Image to ECR with Kaniko
        run: |
          set +e
          echo '{ "credsStore": "ecr-login" }' > /kaniko/.docker/config.json

          /kaniko/executor <your kaniko args here>

          cat /root/.ecr/log/ecr-login.log

To verify that your pod has the right role you could also try:
echo -n https://your_ecr_repo | docker-credential-ecr-login
But note that this will spew an ECR token into the GH runner logs, so probably don't do this.

I get the same result error checking push permissions -- make sure you entered the correct tag name, and that you are authenticated correctly, and try again: checking push permission for "url": Post "url": EOF

I'm not sure if AWS changed something, but using executor:v1.19.2-debug has suddenly started working (and it provides a better error message). I'll go back to the latest after this build completes. In my case, part of the problem was that cross account ECR perms weren't setup correctly.

from kaniko.

I had to give my IAM role extra permissions to ecr:GetAuthorizationToken for resources: *, in addition to permission to push/pull to selected ECR repos (I didn't have to do that for Kaniko 1.9.1). I didn't need to define a /kaniko/.docker/config.json or set AWS_SDK_LOAD_CONFIG either.

"Statement": [
        {
            "Action": "ecr:GetAuthorizationToken",
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "EcrGetAuthForKaniko"
        }
    ],

from kaniko.