How to pull OCI Artifacts (helm charts) cross/organizational accounts

Question

I have a chart repository that is hosted over ECR, I want to re-use these helm charts create an separate Helm Chart Repo for a diff env. Is this possible as unlike docker login, for Helm registry I would use helm registry login to pull and push charts.

I have followed the steps required for to provide cross account access on for ECR Images, assuming it would be same as the for Helm Chart Repos hosted over ECR.

But during the helm pull cmd I get this error : Cmd have been executed over the Cloud9 Machine on the TARGET ACCOUNT.

aws ecr get-login-password --region eu-central-1 | helm registry login --username AWS --password-stdin <SOURCE ACCOUNT>.dkr.ecr.eu-central-1.amazonaws.com
helm pull oci://<SOURCE ACCOUNT>.dkr.ecr.eu-central-1.amazonaws.com/argo-cd --version=7.3.11 Error: manifest does not contain a layer with mediatype application/tar+gzip

re:Post Agent · Answer

Yes, it is possible to pull OCI artifacts like Helm charts across different AWS accounts or organizations. To achieve this, you'll need to follow a few key steps:

1. Set up cross-account access: First, you need to create an IAM policy in the account hosting the ECR repository that allows the secondary account to perform the necessary API calls against the repository.

2. Authenticate to the ECR registry: In the secondary account, you'll need to authenticate your Helm client to the ECR registry hosting the charts. You can do this using the AWS CLI and Helm commands:

aws ecr get-login-password --region [region] | helm registry login --username AWS --password-stdin [account-id].dkr.ecr.[region].amazonaws.com

Replace [region] with the appropriate AWS region and [account-id] with the ID of the account hosting the ECR repository.

3. Pull the Helm chart: Once authenticated, you can pull the Helm chart from the ECR repository in the primary account using the helm pull command:

helm pull oci://[account-id].dkr.ecr.[region].amazonaws.com/[repository-name]/[chart-name] --version [chart-version]

4. Push to new repository: After pulling the chart, you can push it to a new ECR repository in your environment using the helm push command:

helm push [chart-name]-[version].tgz oci://[your-account-id].dkr.ecr.[region].amazonaws.com/[new-repository-name]

Remember that you'll need to ensure proper permissions are set up in both accounts to allow these operations. Also, make sure you're using a recent version of Helm that supports OCI artifacts and the ECR registry format.

By following these steps, you can effectively reuse Helm charts from one ECR repository and create a separate Helm chart repository for a different environment, even across different AWS accounts or organizations.  
**Sources**  
[How to pull ECR images to cross / organizational accounts? | AWS re:Post](https://repost.aws/questions/QURlxY2Qw-TWaRY8yHIlacoA/how-to-pull-ecr-images-to-cross-organizational-accounts)  
[Pushing a Helm chart to an Amazon ECR private repository - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/push-oci-artifact.html)  
[Installing a Helm chart on an Amazon EKS cluster - Amazon ECR](https://docs.aws.amazon.com/AmazonECR/latest/userguide/using-helm-charts-eks.html)

How to pull OCI Artifacts (helm charts) cross/organizational accounts

Add your answer

Relevant content