batch: EksContainerDefinition image from ECR raises RuntimeError: Cannot read property 'obtainExecutionRole' of undefined

[zaremb]

Describe the bug

When specifying EKS task in batch module like this:

container_definition = batch.EksContainerDefinition(
            self,
            f"foo",
            image=ecs.ContainerImage.from_ecr_repository(
            repository, image_tag
        ),
            image_pull_policy=batch.ImagePullPolicy.ALWAYS,
            volumes=[
                batch.EksVolume.empty_dir(
                    name="myEmptyDirVolume",
                    mount_path="/mount/path",
                    medium=batch.EmptyDirMediumType.MEMORY,
                    readonly=True,
                    size_limit=Size.mebibytes(2048),
                )
            ],
        )

part ecs.ContainerImage.from_ecr_repository raises RuntimeError: Cannot read property 'obtainExecutionRole' of undefined.

CDK version: CDK_CLI_VERSION: '2.115.0', Python

Expected Behavior

Image is successfully set

Current Behavior

RuntimeError: Cannot read property 'obtainExecutionRole' of undefined

Reproduction Steps

Run CDK synth with the code above

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.115.0 (build 58027ee)

Framework Version

No response

Node.js Version

v16.0.0

OS

Amazon Linux

Language

Python

Language Version

3.11

Other information

No response

[pahud]

I reproduced this in typescript. Error message below:

                                                      ^
TypeError: Cannot read properties of undefined (reading 'obtainExecutionRole')
    at EcrImage.bind (/projects/issue-triage/node_modules/aws-cdk-lib/aws-ecs/lib/images/ecr.js:1:1133)
    at new EksContainerDefinition (/projects/issue-triage/node_modules/aws-cdk-lib/aws-batch/lib/eks-container-definition.js:1:2087)
    at new Stack5 (/projects/issue-triage/lib/issue-triage-stack.ts:119:33)
    at Object.<anonymous> (/projects/issue-triage/bin/issue-triage.ts:19:16)
    at Module._compile (node:internal/modules/cjs/loader:1241:14)
    at Module.m._compile (/projects/issue-triage/node_modules/ts-node/src/index.ts:1618:23)
    at Module._extensions..js (node:internal/modules/cjs/loader:1295:10)
    at Object.require.extensions.<computed> [as .ts] (/projects/issue-triage/node_modules/ts-node/src/index.ts:1621:12)
    at Module.load (node:internal/modules/cjs/loader:1091:32)
    at Function.Module._load (node:internal/modules/cjs/loader:938:12)

aws-cdk/packages/aws-cdk-lib/aws-batch/lib/eks-container-definition.ts

Line 576 in 52a5579

this.imageConfig = props.image.bind(this, this as any);

The bind() essentually creates EcrImage()

aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/container-image.ts

Lines 22 to 24 in 52a5579

	public static fromEcrRepository(repository: ecr.IRepository, tag: string = 'latest') {
	return new EcrImage(repository, tag);
	}

which expects ecs task definition

aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/images/ecr.ts

Line 29 in 52a5579

this.repository.grantPull(containerDefinition.taskDefinition.obtainExecutionRole());

But obviously eks container def does not have that.

[zaremb]

I found workaround:
Inside container definition, one can specify image to be ContainerImage.from_registry(...). This skips the grantPull. I.e. this fixed it for me:

image=ecs.ContainerImage.from_registry(
            my_ecr_repo.repository_uri_for_tag(my_image_tag)
        )

[pahud]

@zaremb Thank you! Nice workaround!