Crossplane cannot pull xpkg OCI packages from ECR with IRSA

TL;DR

Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.

Steps

1. Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. The reporter expected the pod's IAM role to be enough for ECR auth.
2. Maintainer-confirmed setup: pulling ECR-hosted OCI packages works with IRSA and Pod Identity, but the IAM role attached to the Crossplane service account needs explicit ECR permissions. Attach a policy like: allow ecr:GetAuthorizationToken on all resources, plus ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage on the ECR repository. The pod having "all required auth via IRSA" is not enough on its own; without those ECR actions on the role, the pull fails. Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.

When to use

You are seeing this: Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. Use this skill when you run into "Crossplane cannot pull xpkg OCI packages from ECR with IRSA".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In the GitHub issue gh:crossplane/crossplane#6137 (https://github.com/crossplane/crossplane/issues/6137), the problem reported was: Issue crossplane/crossplane#6137 (closed, 45 comments): A package OCI image built with xpkg and pushed to AWS ECR cannot be pulled by Crossplane, even though the Crossplane pod's service account has IRSA credentials. The reporter expected the pod's IAM role to be enough for ECR auth. The verified resolution was: Maintainer-confirmed setup: pulling ECR-hosted OCI packages works with IRSA and Pod Identity, but the IAM role attached to the Crossplane service account needs explicit ECR permissions. Attach a policy like: allow ecr:GetAuthorizationToken on all resources, plus ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage on the ECR repository. The pod having "all required auth via IRSA" is not enough on its own; without those ECR actions on the role, the pull fails. Add the policy to the role, restart or re-trigger the package fetch, and the ECR pull goes through.