AWS EC2/ECR Failed to register CRI auth plugins

[xposix]

Hello,

I'm using Talos to run single-node clusters in AWS. Everything works fine, the cluster boots up and so, until I add the credentialProviderConfig that comes on the configuration by default. I need this as I need to download images from AWS ECR.

Somehow, once I enable it in the machine section with the code below, kubelet keeps on restarting and I can't perform the bootstrap.

When I look into the cluster status I see this messages:

{
    "ts": 1765887547424.138,
    "caller": "kuberuntime/kuberuntime_manager.go:298",
    "msg": "Failed to register CRI auth plugins",
    "err": "plugin binary executable  did not exist"
}

I'm literally just using the defaul configuration, haven't modified anything how come it doesn't work? surely the AWS AMI comes with the ecr-credential-provider extension already built, right? I'm using the AMItalos-v1.11.5-eu-west-1-amd64 the problem is also there with talos-v1.10.x

What am I doing wrong?

Thank you in advance

  kubelet:
    image: ghcr.io/siderolabs/kubelet:v1.34.1
    The `KubeletCredentialProviderConfig` field is used to provide kubelet credential configuration.
    credentialProviderConfig:
        apiVersion: kubelet.config.k8s.io/v1
        kind: CredentialProviderConfig
        providers:
            - apiVersion: credentialprovider.kubelet.k8s.io/v1
              defaultCacheDuration: 12h
              matchImages:
                - '*.dkr.ecr.*.amazonaws.com'
                - '*.dkr.ecr-fips.*.amazonaws.com'
              name: ecr-credential-provider

talos-v1.11.5-eu-west-1-amd64

[smira]

AWS AMIs contain ecr-credenital-helper starting with Talos 1.12.

[xposix]

Thanks for the prompt answer! I really appreciate it. I wish you were kidding. Talos 1.12 AWS AMIs seems to be in beta.
I understand that to add the ecr-credential-provider I need to recreate the whole AMI, right?

[smira]

Talos 1.12 is in rc, with final release next Monday.

[xposix]

Perfect, what a relief. I will wait, you are a star!