Pulling private images from ghcr.io and deploying to ECS timeout

[cannahum]

Hi,

I'm running a Github Action that deploys my Stack which in the following way:

export class MyServiceStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    new ecsp.ApplicationLoadBalancedFargateService(this, 'MyService', {
      taskImageOptions: {
        image: ecs.ContainerImage.fromRegistry('ghcr.io/my-org/my-service:latest', {
          credentials: secret.Secret.fromSecretAttributes(this, 'MyOrgPackagesTokenSecret', {
            secretCompleteArn: 'secretArnGoesHere',
          }),
        }),
      },
      publicLoadBalancer: true,
    });
  }
}

The secret I have has a key and the value is a JSON {"username": "[email protected]", password:"personalaccesstoken"}

When I deploy this, Cfn tries to create 39 resources, 37th of which is the "Service" itself. The process hangs there and then times out after a while.

Is there a pattern to pull images from ghcr.io specifically? or am I doing something wrong here? I couldn't find anything in the docs.

[branislav-stp]

Hi,
I have the same issue. Stack is stuck in "CREATE_IN_PROGRESS" status for an indefinite time.
I get the secret a bit differently with "aws_secretsmanager.Secret.fromSecretCompleteArn()" but everything else is the same.

Has anyone been able to pull image from a private registry? Could someone share those couple of lines of code which work?

[jonodrew]

Did you ever fix this?

[jackfrosty908]

@cannahum @branislav-stp @jonodrew

I know this is a few months after you guys were having issues, I also ran into this issue, this is how I resolved it. Might help anyone else that stumbles across this thread.

In AWS, go to your secret manager and create a new secret. You want to make both your username and password the personal access token that you generated in github. The PAT will need packages.read privileges.

Then in your CDK stack, pull the secret out using the secret manager, and pass it into ContainerImage.FromRegistry()

Here is my C# CDK stack

using Amazon.CDK;
using Amazon.CDK.AWS.ECS;
using Amazon.CDK.AWS.ECS.Patterns;
using Amazon.CDK.AWS.SecretsManager;
using Secret = Amazon.CDK.AWS.SecretsManager.Secret;

namespace Cdk
{
    public class MyStack : Stack
    {
        internal MyStack(Construct scope, string id, IStackProps props = null) : base(scope, id, props)
        {
            ISecret containerRegistryLogin =
                Secret.FromSecretNameV2(this, "getSecret", "<secret name from AWS secret manager>");

            new ApplicationLoadBalancedFargateService(this, "load-balancer",
                new ApplicationLoadBalancedFargateServiceProps
                {
                    TaskImageOptions = new ApplicationLoadBalancedTaskImageOptions
                    {
                        Image = ContainerImage.FromRegistry("ghcr.io/<registryOwner>/<dockerImageName>",
                            new RepositoryImageProps { Credentials = containerRegistryLogin })
                    },
                    PublicLoadBalancer = true
                });
        }
    }
}

Also I found that when my deploy was stuck at "CREATE_IN_PROGRESS", the errors were getting reported in the ECS clusters UI in the AWS console site.

[mokeseven7]

Thank you for coming back and writing this. You're a hero