docs(QOV-2094): document ECR pull through cache

[pggb25]

Summary by cubic

Documents the aws.ecr.enable_pull_through_cache cluster advanced setting, which caches public ECR images used by managed infrastructure in the cluster's private regional ECR registry to reduce NAT Gateway traffic.

• Covers prerequisites: only Qovery-managed EKS clusters with Karpenter and a Qovery-managed VPC with NAT Gateways, plus Qovery enablement.
• Notes cached images expire after 90 days and that enabling adds ECR storage and VPC interface endpoint charges while reducing NAT Gateway processing charges.

^{Written for commit 4852faf. Summary will update on new commits.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
qovery	🟢 Ready	View Preview	Aug 27, 2026, 4:08 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	qovery-doc-mintlify-proxy	4852faf	Aug 27 2026, 04:07 PM

[cubic-dev-ai]

2 issues found across 1 file

Confidence score: 3/5

• In docs/configuration/cluster-advanced-settings.mdx, the ECR pull-through-cache entry may incorrectly imply a 90-day expiry, which could lead users to expect automatic cleanup that AWS does not provide by default — clarify whether Qoavy applies this lifecycle policy and document it accurately.
• In docs/configuration/cluster-advanced-settings.mdx, aws.ecr.enable_pull_through_cache is advertised without a corresponding ClusterAdvancedSettings schema field, so users may configure a setting the API does not accept — add it to the API source or remove the documentation entry.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="docs/configuration/cluster-advanced-settings.mdx">

<violation number="1" location="docs/configuration/cluster-advanced-settings.mdx:525">
P2: This entry advertises `aws.ecr.enable_pull_through_cache` as a supported cluster setting, but the current public `ClusterAdvancedSettings` schema does not define it. Update the API source before advertising this setting for API use, or state the configuration surface that actually supports it.</violation>

<violation number="2" location="docs/configuration/cluster-advanced-settings.mdx:545">
P2: Amazon ECR does not give pull-through-cache repositories a 90-day expiry by default; the linked AWS documentation says the default lifecycle policy is omitted. If Qovery applies a 90-day lifecycle policy, identify it as Qovery's policy; otherwise remove this expiry claim and describe lifecycle-policy-controlled retention.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: This entry advertises aws.ecr.enable_pull_through_cache as a supported cluster setting, but the current public ClusterAdvancedSettings schema does not define it. Update the API source before advertising this setting for API use, or state the configuration surface that actually supports it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/configuration/cluster-advanced-settings.mdx, line 525:

<comment>This entry advertises `aws.ecr.enable_pull_through_cache` as a supported cluster setting, but the current public `ClusterAdvancedSettings` schema does not define it. Update the API source before advertising this setting for API use, or state the configuration surface that actually supports it.</comment>

<file context>
@@ -520,6 +520,35 @@ Changing this setting will only affect new ECR repositories created after the ch
 
+<a id="aws-ecr-enable-pull-through-cache"></a>
+
+### aws.ecr.enable_pull_through_cache
+
+**Cloud Provider:** <img src="/images/logos/cloud-providers/aws-icon.svg" alt="AWS" width="20"  style={{display: "inline", verticalAlign: "middle", marginRight: "4px"}} />
</file context>

[cubic-dev-ai]

P2: Amazon ECR does not give pull-through-cache repositories a 90-day expiry by default; the linked AWS documentation says the default lifecycle policy is omitted. If Qovery applies a 90-day lifecycle policy, identify it as Qovery's policy; otherwise remove this expiry claim and describe lifecycle-policy-controlled retention.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/configuration/cluster-advanced-settings.mdx, line 545:

<comment>Amazon ECR does not give pull-through-cache repositories a 90-day expiry by default; the linked AWS documentation says the default lifecycle policy is omitted. If Qovery applies a 90-day lifecycle policy, identify it as Qovery's policy; otherwise remove this expiry claim and describe lifecycle-policy-controlled retention.</comment>

<file context>
@@ -520,6 +520,35 @@ Changing this setting will only affect new ECR repositories created after the ch
+</Warning>
+
+<Info>
+Cached images expire 90 days after they are imported into the private ECR registry. If an expired image is requested again, Amazon ECR imports it again from the public registry. Enabling this setting adds private ECR storage and VPC interface endpoint charges to the AWS account, while reducing NAT Gateway processing charges for public ECR pulls.
+</Info>
+
</file context>

Suggested change

	Cached images expire 90 days after they are imported into the private ECR registry. If an expired image is requested again, Amazon ECR imports it again from the public registry. Enabling this setting adds private ECR storage and VPC interface endpoint charges to the AWS account, while reducing NAT Gateway processing charges for public ECR pulls.
	Cached images are revalidated against the public registry at least once every 24 hours; retention is controlled by the lifecycle policy applied to the cache repositories.