Ecr

ECR Repositories

What This Skill Produces

Generate Terraform for ECR repositories under a stable cluster prefix, plus repository outputs and pull permissions needed by EKS nodes or pod identity.

This skill does not copy images or charts. Use ecr-mirror for NGC to ECR mirroring after repositories and permissions are ready.

Inputs

Required:

Optional:

Repository Contract

Create repositories with this naming convention:

${TARGET_REPOSITORY}/${image-or-chart-name}

Do not mirror to the registry root. Stop if TARGET_REPOSITORY is empty.

Pull Permissions

For EKS pulls, confirm the node role or pod identity has ECR read access:

ecr:GetAuthorizationToken
ecr:BatchCheckLayerAvailability
ecr:GetDownloadUrlForLayer
ecr:BatchGetImage

Preflight

Check for collisions before creating repositories:

aws ecr describe-repositories --region "$AWS_REGION" \
  --query "repositories[?starts_with(repositoryName, '${CLUSTER_NAME}/')].repositoryName"

If repositories already exist with the cluster prefix, stop and ask whether to adopt, clean up, or choose a new prefix.

Outputs

Expose values later skills can consume:

output "ecr_registry" {
  value = "${var.aws_account_id}.dkr.ecr.${var.aws_region}.amazonaws.com"
}

output "ecr_repository_prefix" {
  value = var.target_repository
}

Validation Checklist

• Repository prefix is non-empty.
• Repository names use ${TARGET_REPOSITORY}/....
• EKS pull permissions are present.
• No NGC credentials, ECR passwords, or mirror jobs are in Terraform.
• ecr-mirror remains the only skill that copies images/charts.