Why is imagescan not using my instance profile?

[mmclane]

I have rancher 2.6.3 installed on an EKS cluster. I assigned the AWS managed policy AmazonECSContainerRegistryReadOnly. I also have tried attaching the AmazonECSContainerRegistryFullAccess policy. I would expect that would give me the permissions needed for ImageScan to look up the tags ECR but I was getting auth errors. I was able to get past those errors by creating a docker-registry secret with ECR token and specifying that with secretRef in my fleet.yaml and that got imagescan working but the token expires after several hours.

I am going to try to create an automated process to renew that token but I don't think it should be needed. I believe it should get those rights through the instance profile.

[MKlimuszka]

This may be team/area1 We'll refine this soon and decide.

[kkaempf]

@MKlimuszka any update ?

[SamuZad]

Hello team, are there any plans to ever implement this?

It would be nice if the fleet-controller pod was able to assume cloud identities based on IRSA/workload identity. It would make the integration of imagescan with EKS/AKS/GKE much easier