Hi @blue-animal-17710. Mine is little different. My rancher management cluster is on AWS EKS and all downstream clusters on VSphere. I see this issue on 2.7.10 and below worked out for me. After upgrading management cluster from 2.7.10 to 2.8.0, I can pull images from docker.io but not from AWS ECR. Played with https://rke.docs.rancher.com/config-options/private-registries but no luck. It would be great if anyone see same issue and have a solution for this. Thank you!

services:
    kubelet:
      extra_env:
        - "AWS_ACCESS_KEY_ID=ACCESSKEY"
        - "AWS_SECRET_ACCESS_KEY=SECRETKEY"
  private_registries:
       - url: ACCOUNTID.dkr.ecr.REGION.amazonaws.com
         is_default: true
         ecrCredentialPlugin:
          user: "ACCESSKEY"
          password: "SECRETKEY"