> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/continuous-integration/3.0/troubleshooting-and-resources/ci-articles-and-faqs/articles/delegate-eks-cluster.md).

# Build and Push to ECR error

## Conditions <a href="#conditions" id="conditions"></a>

* Module: Harness CI
* Environment:
  * Infrastructure: Kubernetes
  * OS: Linux
* Delegate location: EKS cluster
* AWS connector configuration: Uses IRSA

## Problem <a href="#problem" id="problem"></a>

The pipeline can pull images from private ECR repositories, but when you try to push an application image with the **Build and Push to ECR** step, you get the following error:

```
+ /kaniko/executor --dockerfile=/harness/docker/Dockerfile --context=dir:///harness/ \
--destination=<aws-account-id>.dkr.ecr.sa-east-1.amazonaws.com/hermod:latest --snapshotMode=redo \
--digest-file=/kaniko/digest-file
error checking push permissions -- make sure you entered the correct tag name, \
and that you are authenticated correctly, and try again: \
checking push permission for "<aws-account-id>.dkr.ecr.sa-east-1.amazonaws.com/hermod:latest": \
Post "https://<aws-account-id>.dkr.ecr.sa-east-1.amazonaws.com/v2/hermod/blobs/uploads/": EOF
exit status 1
```

## Solution <a href="#solution" id="solution"></a>

1. Configure the [Service account in the Kubernetes cluster build infrastructure settings](/continuous-integration/use-harness-ci/use-harness-ci/set-up-build-infrastructure/k8s-build-infrastructure/set-up-a-kubernetes-cluster-build-infrastructure.md#service-account-name). For example:

   ```yaml
   infrastructure:
     type: KubernetesDirect
     spec:
       connectorRef: test-connector
       namespace: harness-delegate-ng
       serviceAccountName: **harness-delegate-sa**
       automountServiceAccountToken: true
       nodeSelector: {}
       os: Linux
   ```
2. Before your **Build and Push to ECR** step, add a [Run step](/continuous-integration/use-harness-ci/use-harness-ci/run-step-settings.md) that runs the following command:

   ```
   aws ecr get-login-password --region <aws_region> | docker login --username AWS --password-stdin <aws_account_id>.dkr.ecr.<aws_region>.amazonaws.com
   ```