AWS Token Auto-Renewal Guide

AWS temporary tokens are valid for 12 hours.The token validity period in the AWS  ECR environment cannot be adjusted, and tokens without an expiration date are not issued (this is beyond our control). Thus to solve this problem, we can use the following method: 

1. If you are using an EKS environment, use IRSA ( IAM Role for Service Account) to process.

   1. You can think of it as a way to receive separate authentication from the your K8s environment to Thinkfree's K8s environment.

   2. However , processing is only possible if you are using EKS.

2. Create a CronJob and process it

   1. This method creates a K8s CronJob to periodically refresh the token.

   2. It can operate regardless of the your environment.

3. Converting our ECR environment to a public environment

   1. Areas requiring policy review

Here, we'll guide you through creating a CronJob to handle this process. This method renews your AWS token every 11 hours.

(1) Enter your AWS credentials.

kubectl -n <NAMESPACE> create secret generic aws-credentials \
  --from-literal=AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID> \
  --from-literal=AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY> \
  --from-literal=AWS_REGION=<AWS_REGION>

.
.
.

spec:
  schedule: "0 */11 * * *"  # Performed every 11 hours. Modified as needed.

.
.
.

echo "kubectl version:"
kubectl version --client

AWS_ACCOUNT_ID=""  # Enter the Account ID you received.

.
.
.

TARGET_SECRET="thinkfree-registry-secret"
NAMESPACE=""  # Enter the namespace.
USERNAME="AWS"

.
.
.

kubectl -n <NAMESPACE> apply -f docker-registry-token-refresh-cronjob.yaml