tsuru names app images <registry>/<namespace>/app-<name>:vN — a new registry
repository per app — and deploy-agent assumes the registry creates repositories
on first push. That's true for Docker Hub, GCR/Artifact Registry, Harbor, and
Distribution, but not for Amazon ECR, where a repository is a provisioned
resource that must exist before any push (long-standing upstream ask:
aws/containers-roadmap#853). So on ECR-backed clusters, every deploy of a new
app fails at the push:
#5 pushing layers 0.5s done
#5 ERROR: unexpected status: 404 Not Found
── ERROR during deploy:
rpc error: code = Unknown desc = failed to solve: unexpected status: 404 Not Found
…unless someone pre-creates <namespace>/app-<name> out of band (per-app IaC
changes for every tsuru app create, which defeats self-service).
deploy-agent already has exactly the right extension point: the remote
repository providers framework (REMOTE_REPOSITORY_PATH,
pkg/repository, added in #43) with an oci provider for Oracle Cloud
Registry — which has the same no-create-on-push behavior. ECR just needs a
provider there.
Proposed fix: add an ecr provider that calls ecr:CreateRepository
(treating RepositoryAlreadyExists as success) using the same ambient AWS
credentials the push itself uses. I have this working in production and will
open a PR. Pairs with #53 (ECR push authentication).
tsuru names app images
<registry>/<namespace>/app-<name>:vN— a new registryrepository per app — and deploy-agent assumes the registry creates repositories
on first push. That's true for Docker Hub, GCR/Artifact Registry, Harbor, and
Distribution, but not for Amazon ECR, where a repository is a provisioned
resource that must exist before any push (long-standing upstream ask:
aws/containers-roadmap#853). So on ECR-backed clusters, every deploy of a new
app fails at the push:
…unless someone pre-creates
<namespace>/app-<name>out of band (per-app IaCchanges for every
tsuru app create, which defeats self-service).deploy-agent already has exactly the right extension point: the remote
repository providers framework (
REMOTE_REPOSITORY_PATH,pkg/repository, added in #43) with anociprovider for Oracle CloudRegistry — which has the same no-create-on-push behavior. ECR just needs a
provider there.
Proposed fix: add an
ecrprovider that callsecr:CreateRepository(treating
RepositoryAlreadyExistsas success) using the same ambient AWScredentials the push itself uses. I have this working in production and will
open a PR. Pairs with #53 (ECR push authentication).