Crossplane cannot pull xpkg OCI packages from ECR with IRSA

The problem

Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. The reporter expected the pod's IAM role to be enough for ECR auth.

What to do

Maintainer-confirmed setup: pulling ECR-hosted OCI packages works with IRSA and Pod Identity, but the IAM role attached to the Crossplane service account needs explicit ECR permissions. Attach a policy like: allow ecr:GetAuthorizationToken on all resources, plus ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage on the ECR repository. The pod having "all required auth via IRSA" is not enough on its own; without those ECR actions on the role, the pull fails. Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.

In the GitHub issue gh:crossplane/crossplane#6137 (https://github.com/crossplane/crossplane/issues/6137), the problem reported was: Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. The reporter expected the pod's IAM role to be enough for ECR auth. The verified resolution was: Maintainer-confirmed setup: pulling ECR-hosted OCI packages works with IRSA and Pod Identity, but the IAM role attached to the Crossplane service account needs explicit ECR permissions. Attach a policy like: allow ecr:GetAuthorizationToken on all resources, plus ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage on the ECR repository. The pod having "all required auth via IRSA" is not enough on its own; without those ECR actions on the role, the pull fails. Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.