# Using secrets from the drone registry plugin

**URL:** <https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873>\
**Category:** Drone Support\
**Created:** [November 14, 2019, 5:56pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873 "2019-11-14T17:56:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![peregrinator](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/peregrinator/32/5091_2.png) [@peregrinator](https://drone.discourse.group/u/peregrinator)\
**Post date:** [November 14, 2019, 5:56pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/1 "2019-11-14T17:56:09Z")

</div>

I’ve set up a drone registry plugin following the instructions here: [https://github.com/drone/drone-registry-plugin](https://github.com/drone/drone-registry-plugin). I can verify with the drone cli that there is a username and password set for my ECR repository.

I’ve also configured my drone docker runner (drone/drone-runner-docker:latest) with the DRONE\_REGISTRY\_PLUGIN\_ENDPOINT and DRONE\_REGISTRY\_PLUGIN\_TOKEN env variables.

However I can’t seem to find the correct way to reference these when running my pipeline steps. I’m just getting auth failures when using ‘plugins/docker’.

Can someone point me in the right direction?  
Thanks!

---

<div class="post-metadata">

**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\
**Post date:** [November 14, 2019, 10:31pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/2 "2019-11-14T22:31:56Z")

</div>

the registry plugin is used to `pull` private images required to run your pipeline steps:

```nohighlight
image: <image>

```

the registry plugin does not expose registry credentials to your pipeline or to your pipeline steps, which means the Docker plugin does not have access to these credentials. This is by design. If you want to globally expose secrets to a plugin you can use organization secrets ([https://docs.drone.io/configure/secrets/organization/](https://docs.drone.io/configure/secrets/organization/)).

---

<div class="post-metadata">

**Author:** ![peregrinator](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/peregrinator/32/5091_2.png) [@peregrinator](https://drone.discourse.group/u/peregrinator)\
**Post date:** [November 14, 2019, 10:49pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/3 "2019-11-14T22:49:03Z")

</div>

OK I think I understand that. How would one use organization secrets with AWS ECR where the keys expire on a regular basis? The Dockerfile I am trying to build references a private base image as the FROM image and I am getting errors trying to pull it.

---

<div class="post-metadata">

**Author:** ![bradrydzewski](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/bradrydzewski/32/3513_2.png) [@bradrydzewski](https://drone.discourse.group/u/bradrydzewski)\
**Post date:** [November 14, 2019, 10:51pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/4 "2019-11-14T22:51:04Z")

</div>

you would use `plugins/ecr` which you provide an aws access key and secret key, which are used to generate fresh login credentials.

[http://plugins.drone.io/drone-plugins/drone-ecr/](http://plugins.drone.io/drone-plugins/drone-ecr/)

---

<div class="post-metadata">

**Author:** ![peregrinator](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/peregrinator/32/5091_2.png) [@peregrinator](https://drone.discourse.group/u/peregrinator)\
**Post date:** [November 15, 2019, 12:11am UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/5 "2019-11-15T00:11:37Z")

</div>

I went ahead and used the `plugins/ecr` as my first step and it builds and pushes the new image as expected.

However in the next step where I’d like to run my tests I’m getting basic auth failures. Maybe I misunderstood but I thought this is where the registry plugin would have provided the correct credentials for pulling the private image.

My drone.yml looks like this:

```auto
---
kind: pipeline
type: docker
name: test

steps:
- name: build
  image: plugins/ecr
  settings:
    access_key:
      from_secret: aws_access_key_id
    secret_key:
      from_secret: aws_secret_access_key
    repo: example.com/example-api
    registry: 123456789.dkr.ecr.us-east-1.amazonaws.com
    cache_from:
    - 123456789.dkr.ecr.us-east-1.amazonaws.com/example.com/example-api:latest
    - 123456789.dkr.ecr.us-east-1.amazonaws.com/example.com/example-api:${DRONE_BRANCH}
    tags:
    - ${DRONE_COMMIT_BRANCH}
    - ${DRONE_COMMIT_SHA:0:7}
- name: test
  image: 123456789.dkr.ecr.us-east-1.amazonaws.com/example.com/example-api:${DRONE_COMMIT_SHA:0:7}
  commands:
  - cd /home/app
  - rspec spec

```

---

<div class="post-metadata">

**Author:** ![peregrinator](https://yyz1.discourse-cdn.com/flex003/user_avatar/drone.discourse.group/peregrinator/32/5091_2.png) [@peregrinator](https://drone.discourse.group/u/peregrinator)\
**Post date:** [November 15, 2019, 8:17pm UTC](https://drone.discourse.group/t/using-secrets-from-the-drone-registry-plugin/8873/6 "2019-11-15T20:17:10Z")

</div>

If it’s useful the error I’m getting is:

`drone-runner: Error response from daemon: Get https://123456789.dkr.ecr.us-east-1.amazonaws.com/example.com/example-api/manifests/5d00b78: no basic auth credentials`