Container Service for Kubernetes:Use the aliyun-acr-credential-helper component to pull images without using a password

Use onectl

1. Install onectl on your on-premises machine. For more information, see Use onectl to manage registered clusters.

2. Run the following command to grant RAM permissions to aliyun-acr-credential-helper:

   onectl ram-user grant --addon aliyun-acr-credential-helper

   Expected output:

   Ram policy ack-one-registered-cluster-policy-aliyun-acr-credential-helper granted to ram user ack-one-user-ce313528c3 successfully.

Use the console

Before you can install the component in an external cluster, you must set the AccessKey pair to grant the external cluster the permissions to access Alibaba Cloud resources. Before you set the AccessKey pair, create a RAM user and grant the RAM user the permissions to access Alibaba Cloud resources.

1. Create a RAM user. For more information, see Create a RAM user.

2. Create a custom policy. For more information, see Create custom policies.

   Example:

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "cr:GetAuthorizationToken",
                   "cr:ListInstanceEndpoint",
                   "cr:PullRepository"
               ],
               "Resource": [
                   "*"
               ],
               "Effect": "Allow"
           }
       ]
   }

3. Attach the custom policy to the RAM user. For more information, see Grant permissions to a RAM user.

4. Create an AccessKey pair for the RAM user. For more information, see Obtain an AccessKey pair.

5. Use the AccessKey pair to create a Secret named alibaba-addon-secret in the registered cluster.

   The system automatically uses the AccessKey pair to access cloud resources when you install the aliyun-acr-credential-helper component.

   kubectl -n kube-system create secret generic alibaba-addon-secret --from-literal='access-key-id=<your access key id>' --from-literal='access-key-secret=<your access key secret>'

   Note

   Replace <your access key id> and <your access key secret> with the AccessKey pair that you obtained in the previous step.

Use onectl

Run the following command to install aliyun-acr-credential-helper:

onectl addon install aliyun-acr-credential-helper

Expected output:

Addon aliyun-acr-credential-helper, version **** installed.

If aliyun-acr-credential-helper is already installed, make sure that aliyun-acr-credential-helper is of the latest version. You can run the following command to update aliyun-acr-credential-helper to the latest version:

onectl addon upgrade aliyun-acr-credential-helper

Expected output:

Addon aliyun-acr-credential-helper upgraded to version ****.

Use the console

If you installed the aliyun-acr-credential-helper component, make sure that the component is of the latest version. Otherwise, update the component. Updating the component does not affect your business. For more information, see Manage components. For more information about the aliyun-acr-credential-helper component, see aliyun-acr-credential-helper.

After the aliyun-acr-credential-helper component is updated to the latest version, the RAM role on which the component relies is changed. The component provides the tokenMode parameter to allow you to specify the RAM role on which the component relies. For more information about the impacts of changing the RAM role on which the component relies, see [Product Changes] Revoke the permissions on which aliyun-acr-credential-helper relies.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Operations > Add-ons.

3. On the Add-ons page, click the Security tab, find aliyun-acr-credential-helper, and then click Install.

4. On the Parameters page, use the default value auto for the tokenMode parameter and click OK.

   After you update an ACK managed cluster to the latest version, the aliyun-acr-credential-helper component provides the tokenMode parameter. You can modify the parameter after the component is installed. After the component is modified, the system recreates the pod for the component. Old clusters described in the table refer to clusters that are created before April 3, 2023, and new clusters refer to clusters that are created on or after April 3, 2023. The following table describes the valid values of the tokenMode parameter.

   tokenMode	Description
   auto	Automatically determines whether to use the managedRole mode, which is the default value. The system uses the managedRole mode for new clusters and the workerRole mode for old clusters.
   managedRole	Uses the managedRole mode.
   workerRole	Uses the workerRole mode.

Use the console

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you want to manage and choose Configurations > ConfigMaps in the left-side navigation pane.

3. In the upper part of the ConfigMap page, select kube-system from the Namespace drop-down list. Then, find the acr-configuration ConfigMap and configure the parameters.

   If the acr-configuration ConfigMap does not exist, create a ConfigMap. For more information, see Create a ConfigMap. For information about how to update ConfigMaps, see Manage ConfigMaps.

   • Click Edit in the Actions column to configure keys and values for the ConfigMap.

   • Click Edit YAML in the Actions column to configure keys and values for the ConfigMap.

Use kubectl

1. Run the following command to go to the editing page of the acr-configuration ConfigMap:

   kubectl edit cm acr-configuration -n kube-system

2. Configure the parameters of the acr-configuration ConfigMap based on your requirements.