Container Registry:Pull images from a Container Registry instance without using a secret

Install the component

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Operations > Add-ons.

3. On the Add-ons page, click the Security tab, find the aliyun-acr-credential-helper (Managed) card in the Security section, and then click Install in the lower-right corner of the card.

4. On the Install aliyun-acr-credential-helper page, you can see the AcrInstanceInfo-related parameters and other parameters. The AcrInstanceInfo-related parameters specifies the information about the Container Registry instances that you want the secret-free component to manage. Other parameter specifies the information about the secret-free component. The following tables describe the parameters.

   Note

   You can modify the AcrInstanceInfo-related parameters and other parameters after the secret-free component is installed.

   

   Parameters about the associated Container Registry instances

   AcrInstanceInfo		Description
   InstanceId		The ID of the Container Registry instance. You can obtain the ID in the Container Registry console. Important Leave this parameter empty if you use a Container Registry Personal Edition instance. You must specify this parameter if you use a Container Registry Enterprise Edition instance.
   regionId		The region ID of the Container Registry instance. You can obtain the region ID in the Container Registry console. Important You must specify this parameter if you want to pull images across regions.
   domains		The domain name that the secret-free component uses to access the Container Registry instance. By default, all public domain name and VPC domain name of the Container Registry instance are filled in. You can specify specific domain names. Separate multiple domain names with commas (,).
   Specify these parameters only if you want to pull images across accounts	assumeRoleARN	The Alibaba Cloud resource name (ARN) of the RAM role assumed by the owner of the Container Registry instance.
   	expireDuration	The validity period of the secret that is used to pull images across Alibaba Cloud accounts. Valid values: 3600 to 43200. Default value: 3600. Unit: seconds. Set MaxSessionDuration of the RAM role of Account B to 43200.
   	rrsaRoleARN	The ARN of the RAM role assumed by the owner of the ACK cluster.
   	rrsaOIDCProviderRoleARN	The ARN of the OIDC (OpenID Connect) IdP (identity provider) of the ACK cluster.

   Parameters about the secret-free component

   Parameter	Description
   Specifies whether to enable RRSA	Select this option to enable the RRSA feature if you want to pull images across accounts.
   watchNamespace	Specify the namespaces from which you want to pull images without using a secret. Default value: default. A value of all specifies all namespaces in the Container Registry instance. You can specify multiple namespaces. Separate multiple namespaces with commas (,). We recommend that you configure your business namespaces for the parameter. If you set the parameter to all or the namespace in which system components of the cluster are stored, system component images may fail to be pulled.
   serviceAccount	Specify the service accounts that are associated with managed-aliyun-acr-credential-helper. Default value: Default. A value of Default specifies the default service accounts of all specified namespaces. A value of an asterisk (*) specifies all service accounts in the specified namespaces. You can specify multiple service accounts. Separate the service accounts with commas (,).
   expiringThreshold	Specify the period of time after which the secret expires. Default value: 15m. We recommend that you use the default value. The default value specifies that the secret is automatically updated 15 minutes before the secret expires.
   notifyEmail	You do not need to specify this parameter.

Update the configurations of the secret-free component

To update the configurations of the secret-free component, you can click Configuration in the lower-right corner of the aliyun-acr-credential-helper (Managed) card on the Add-ons page. For information about the parameters used to update the configurations, see preceding tables "Parameters about the associated Container Registry instances" and "Parameters about the secret-free component".

Pull images

After you install and configure the secret-free component, you can specify a service account that is associated with the secret-free component when you create a workload to pull images without using a secret.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      serviceAccountName: my-service-account # Specify a service account that is associated with the secret-free component.
      containers:
      - name: nginx
        image: ******.cn-hangzhou.cr.aliyuncs.com/nginx/nginx:latest # Specify the address of the Container Registry image.
        ports:
        - containerPort: 80

More operations

Install the component

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, find the cluster that you want to manage and click its name. In the left-side pane, choose Operations > Add-ons.

3. On the Add-ons page, click the Security tab, find the aliyun-acr-credential-helper card in the Security section, and then click Install in the lower-right corner of the card.

4. In the Install aliyun-acr-credential-helper dialog box, select a permission mode that the component uses from the tokenMode drop-down list and then click OK. The following table describes the permission modes that can be used by the component. After you install the component, you must configure the component before you can use the component to pull images without using a secret. For information about how to configure the component, see Update the configurations of the secret-free component.

   tokenMode	Description
   auto	(Recommend) The component detects when the cluster was created and automatically determines the permission mode that the component uses. If the cluster was created before April 03, 2023, the component uses the workerRole permission mode. If the cluster was created on or after April 03, 2023, the component uses the managedRole permission mode. Important The version of aliyun-acr-credential-helper that was released after April 03, 2023 provides configuration items to allow you to specify the RAM role on which the component relies. For more information, see [Product Changes] Revoke the permissions on which aliyun-acr-credential-helper relies.
   managedRole	The component uses the AliyunCSManagedAcrRole role that is granted specific permissions in the Prerequisites to obtain permissions.
   workerRole	The component uses the worker role of the cluster to obtain permissions. To use this mode, you must grant specific permissions to the worker role of the cluster. For more information, see aliyun-acr-credential-helper uses the workerRole permission mode. Important Select this mode if you want to pull images across accounts by role assuming.

Update the configurations of the secret-free component

After the aliyun-acr-credential-helper component is installed, you must configure the acr-configuration ConfigMap by using the ACK console or kubectl before you can pull images.

Pull images

After you install and configure the secret-free component, you can specify a service account that is associated with the secret-free component when you create a workload to pull images without using a secret.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      serviceAccountName: my-service-account # Specify a service account that is associated with the secret-free component.
      containers:
      - name: nginx
        image: ******.cn-hangzhou.cr.aliyuncs.com/nginx/nginx:latest # Specify the address of the Container Registry image.
        ports:
        - containerPort: 80

Precautions

data:
    service-account: default
    watch-namespace: all
    expiring-threshold: 15m
    notify-email: c*@example.com 
    acr-registry-info: |
      - instanceId: ""  # Leave this parameter empty if you want to pull images from a Container Registry Personal Edition instance.
        regionId: cn-xxxx

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cr:GetAuthorizationToken",
                "cr:ListInstanceEndpoint",
                "cr:PullRepository"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

More operations

data:
  webhook-configuration: |
    enable: true
    failure-policy: Ignore
    timeout-seconds: 10