{"id":50886134,"url":"https://github.com/hops-ops/aws-ecr-registry-cache","last_synced_at":"2026-06-15T17:02:49.719Z","repository":{"id":362997156,"uuid":"1261557950","full_name":"hops-ops/aws-ecr-registry-cache","owner":"hops-ops","description":"ECR pull-through cache rules for platform image registries.","archived":false,"fork":false,"pushed_at":"2026-06-06T22:19:52.000Z","size":22,"stargazers_count":0,"open_issues_count":3,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-07T00:07:43.671Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"KCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hops-ops.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-06T21:16:01.000Z","updated_at":"2026-06-06T22:16:05.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/hops-ops/aws-ecr-registry-cache","commit_stats":null,"previous_names":["hops-ops/aws-ecr-registry-cache"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/hops-ops/aws-ecr-registry-cache","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ecr-registry-cache","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ecr-registry-cache/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ecr-registry-cache/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ecr-registry-cache/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hops-ops","download_url":"https://codeload.github.com/hops-ops/aws-ecr-registry-cache/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hops-ops%2Faws-ecr-registry-cache/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34372130,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-15T02:00:07.085Z","response_time":63,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-15T17:02:48.839Z","updated_at":"2026-06-15T17:02:49.712Z","avatar_url":"https://github.com/hops-ops.png","language":"KCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-ecr-registry-cache\n\nECR pull-through cache rules for platform image registries.\n\n`ECRRegistryCache` manages Amazon ECR pull-through cache rules in one AWS\naccount and region. It can also create repository creation templates for the\nrepositories ECR creates on first pull, and it can optionally own registry-wide\nenhanced scanning through Amazon Inspector.\n\nThis XR does not rewrite image references by itself. Consumers still pull from\nthe private ECR registry URI, for example:\n\n```text\n123456789012.dkr.ecr.us-east-2.amazonaws.com/ghcr/hops-ops/aws-auto-eks-cluster:v0.11.0\n```\n\n## Getting Started\n\nCreate no-auth cache rules for public upstreams:\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: ECRRegistryCache\nmetadata:\n  name: platform\n  namespace: default\nspec:\n  accountId: \"123456789012\"\n  region: us-east-2\n  rules:\n    - name: ecr-public\n      ecrRepositoryPrefix: ecr-public\n      upstreamRegistryUrl: public.ecr.aws\n      repositoryCreationTemplate:\n        enabled: true\n    - name: kubernetes\n      ecrRepositoryPrefix: kubernetes\n      upstreamRegistryUrl: registry.k8s.io\n      repositoryCreationTemplate:\n        enabled: true\n```\n\nThe first pull creates the cached repository:\n\n```bash\ndocker pull 123456789012.dkr.ecr.us-east-2.amazonaws.com/ecr-public/docker/library/busybox:latest\n```\n\n## Growing\n\nAuthenticated upstreams such as Docker Hub and GHCR require existing AWS\nSecrets Manager secrets. AWS requires those secret names to start with\n`ecr-pullthroughcache/`, and the secret must live in the same account and\nregion as the rule.\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: ECRRegistryCache\nmetadata:\n  name: platform\n  namespace: default\nspec:\n  accountId: \"123456789012\"\n  region: us-east-2\n  rules:\n    - name: docker-hub\n      ecrRepositoryPrefix: docker-hub\n      upstreamRegistryUrl: registry-1.docker.io\n      credentialArn: arn:aws:secretsmanager:us-east-2:123456789012:secret:ecr-pullthroughcache/docker-hub-AbCdEf\n      repositoryCreationTemplate:\n        enabled: true\n        imageTagMutability: MUTABLE\n    - name: ghcr\n      ecrRepositoryPrefix: ghcr\n      upstreamRegistryUrl: ghcr.io\n      credentialArn: arn:aws:secretsmanager:us-east-2:123456789012:secret:ecr-pullthroughcache/ghcr-AbCdEf\n      repositoryCreationTemplate:\n        enabled: true\n        imageTagMutability: MUTABLE\n```\n\nDo not make pull-through cache repositories immutable by default. AWS refreshes\ncached tags over time, and immutable tags can prevent ECR from updating a\nrepository when the upstream reuses a tag.\n\nRepository creation template `resourceTags` are not inherited from top-level\n`spec.tags`. Set them explicitly only after verifying first-pull repository\ncreation can tag repositories in the target account; otherwise ECR can fail to\nauto-create the cache repository.\n\n## Enterprise Scale\n\nEnhanced scanning is registry-wide and disabled by default because it makes\nthis XR the owner of ECR scanning configuration for the account and region and\ncan create Amazon Inspector cost.\n\n```yaml\nspec:\n  enhancedScanning:\n    enabled: true\n    scanFrequency: CONTINUOUS_SCAN\n  rules:\n    - name: ghcr\n      ecrRepositoryPrefix: ghcr\n      upstreamRegistryUrl: ghcr.io\n      credentialArn: arn:aws:secretsmanager:us-east-2:123456789012:secret:ecr-pullthroughcache/ghcr-AbCdEf\n```\n\nWhen `repositoryFilters` is omitted, the composition creates one `WILDCARD`\nfilter per rule prefix, such as `ghcr/*`. Operators can set explicit filters\nwhen another owner already manages part of registry scanning.\n\n## Crossplane ImageConfig\n\nCrossplane package pulls need `ImageConfig` objects in the control plane that\nconsumes packages:\n\n```yaml\napiVersion: pkg.crossplane.io/v1beta1\nkind: ImageConfig\nmetadata:\n  name: ecr-ghcr-rewrite\nspec:\n  matchImages:\n    - type: Prefix\n      prefix: ghcr.io\n  rewriteImage:\n    prefix: 123456789012.dkr.ecr.us-east-2.amazonaws.com/ghcr\n  registry:\n    authentication:\n      pullSecretRef:\n        name: ecr-registry-credentials\n```\n\n`xpkg.crossplane.io` is not a supported ECR pull-through cache upstream in this\nXR. Crossplane dependency packages from `xpkg.crossplane.io` need to stay\noutside this cache path, be republished to a supported upstream such as GHCR,\nor be mirrored into ECR by a separate mechanism.\n\n## Current Hops Registry Audit\n\nThe local and `pat-local` clusters currently pull from these registry families:\n\n| Registry family | Examples observed | ECR pull-through support |\n|---|---|---|\n| Docker Hub | `docker.io/istio/*`, `docker.io/grafana/*`, `postgres`, `redis`, `busybox`, `nats`, `listmonk/listmonk` | Supported through `registry-1.docker.io`; requires Secrets Manager credentials. |\n| GHCR | `ghcr.io/hops-ops/*`, `ghcr.io/fluxcd/*`, `ghcr.io/external-secrets/*`, `ghcr.io/cloudnative-pg/*` | Supported through `ghcr.io`; requires Secrets Manager credentials. |\n| ECR Public | `public.ecr.aws/eks/aws-load-balancer-controller`, `public.ecr.aws/docker/library/node` | Supported through `public.ecr.aws`; no auth required. |\n| Kubernetes registry | `registry.k8s.io/nginx-slim`, `registry.k8s.io/external-dns/*`, `registry.k8s.io/metrics-server/*` | Supported through `registry.k8s.io`; no auth required. |\n| Quay | `quay.io/argoproj/argocd`, `quay.io/jetstack/*`, `quay.io/prometheus/*`, `quay.io/kubescape/*` | Supported through `quay.io`; no auth required. |\n| Crossplane package registries | `xpkg.crossplane.io/crossplane-contrib/*`, `xpkg.upbound.io/wildbitca/*` | Not supported by ECR pull-through cache. Needs republish, mirror, or direct pull. |\n| Google registries | `gcr.io/knative-releases/*`, `mirror.gcr.io/*`, `us-docker.pkg.dev/fairwinds-ops/*` | Not supported by ECR pull-through cache. Needs mirror or direct pull. |\n| Other registries | `reg.kyverno.io/kyverno/*` | Not supported by ECR pull-through cache. Needs mirror or direct pull. |\n\n## Import Existing\n\nFor existing pull-through cache rules, set `managementPolicies` to observe and\nupdate without delete until the adoption is verified:\n\n```yaml\napiVersion: aws.hops.ops.com.ai/v1alpha1\nkind: ECRRegistryCache\nmetadata:\n  name: existing-platform\n  namespace: default\nspec:\n  accountId: \"123456789012\"\n  region: us-east-2\n  managementPolicies:\n    - Create\n    - Observe\n    - Update\n    - LateInitialize\n  rules:\n    - name: ghcr\n      ecrRepositoryPrefix: ghcr\n      upstreamRegistryUrl: ghcr.io\n      credentialArn: arn:aws:secretsmanager:us-east-2:123456789012:secret:ecr-pullthroughcache/ghcr-AbCdEf\n```\n\n## Status\n\n```yaml\nstatus:\n  ready: true\n  registry:\n    id: \"123456789012\"\n    host: 123456789012.dkr.ecr.us-east-2.amazonaws.com\n  scanning:\n    enabled: false\n    scanType: \"\"\n  rules:\n    - name: ghcr\n      ready: true\n      ecrRepositoryPrefix: ghcr\n      upstreamRegistryUrl: ghcr.io\n      pullPrefix: 123456789012.dkr.ecr.us-east-2.amazonaws.com/ghcr\n```\n\n## Development\n\n```bash\nmake render         # Render all examples\nmake validate       # Validate rendered output against schemas\nmake test           # Run KCL composition tests\nmake e2e            # Run E2E tests (requires AWS credentials)\n```\n\nFor local control plane iteration:\n\n```bash\nhops config install --path xrs/aws/ecr-registry-cache --context colima\nkubectl --context colima apply -f local/ecrregistrycache.yaml\n```\n\n## References\n\n- AWS ECR pull-through cache: https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html\n- AWS ECR repository creation templates: https://docs.aws.amazon.com/AmazonECR/latest/userguide/repository-creation-templates.html\n- Crossplane ImageConfig: https://docs.crossplane.io/latest/packages/image-configs/\n\n## License\n\nApache-2.0\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Faws-ecr-registry-cache","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhops-ops%2Faws-ecr-registry-cache","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhops-ops%2Faws-ecr-registry-cache/lists"}