:Pull images from a Container Registry instance without using Secrets

Background information

Container Registry provides Container Registry Personal Edition instances and Container Registry Enterprise Edition instances. Container Registry Enterprise Edition is an enterprise-grade platform designed to manage the lifecycle of cloud native application artifacts, including container images, Helm charts, and Open Container Initiative (OCI) artifacts. It is suitable for large-scale business deployment scenarios and helps enterprises reduce the delivery complexity. For more information, see What is Container Registry?

If your image is stored on a Container Registry instance, you can pull the image without using Secrets when you create an ACS cluster to improve efficiency and avoid disclosing the Secret.

Prerequisites

Before you start, make sure that you have completed the following tasks:

1. An ACS cluster is created. For more information, see Create an ACS cluster.

2. A Container Registry instance is created, and related configurations such as image repositories and images are completed for the instance.

   • For more information about how to configure a Container Registry Personal Edition instance, see Use a Container Registry Personal Edition instance to push and pull images.

   • For more information about how to configure a Container Registry Enterprise Edition instance, see Use a Container Registry Enterprise Edition instance to push and pull images.

3. Access to the Container Registry instance without using Secrets is configured if the instance is an Enterprise Edition instance.

   By default, a newly created Container Registry Enterprise Edition instance is disconnected from all networks. You must configure access control lists (ACLs) to allow access to the instance over the Internet or virtual private clouds (VPCs).

   • Over the Internet: After you enable Internet access for an Enterprise Edition instance, you can access images in the Enterprise Edition instance across regions by using public endpoints of the Enterprise Edition instance. For more information, see Configure access over the Internet.

   • Over a VPC: To access a Container Enterprise Edition instance over a VPC, you must enable relevant authorization by using the service-linked role AliyunServiceRoleForContainerRegistryAccessCustomerPrivateZone. For more information, see Configure a VPC ACL.

Usage notes

To pull private images, the managed aliyun-acr-credential-helper component needs to read your configurations in the console. After you configure the aliyun-acr-credential-helper component, the component generates a Secret in your cluster and associates the Secret with the service account that you specified in the acr-configuration ConfigMap. By default, all pods that use this service account use the generated Secret to pull images without using a password.

Install the managed aliyun-acr-credential-helper component

1. Log on to the ACS console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you created.

3. In the left-side navigation pane, choose Operations > Add-ons.

4. On the Add-ons page, click the Security tab, find aliyun-acr-credential-helper, and click Install.

Configure the managed aliyun-acr-credential-helper component

Add a Container Registry instance

After you click Install, you must add a Container Registry instance in the dialog box that appears so that you can use the component.

The following table describes the parameters.

The following table describes other parameters.

Pull images across accounts

Pull images across accounts by configuring RRSA

The RRSA feature can be used to perform access control on pods in a cluster.

1. On the Cluster Information page of your ACS cluster, click the Basic Information tab, find RRSA OIDC,

2. and enable RRSA.

3. Grant the required permissions to access Container Registry resources across accounts.

   After the RRSA feature is enabled for the cluster, you must perform the following operations to enable RRSA for aliyun-acr-credential-helper. For example, the current cluster is in Account A and the Container Registry instance is in Account B. If you want to pull images of the Container Registry instance, you must grant the cluster in Account A the permissions to access Container Registry resources of Account B.

   1. Configure a RAM role for Account A

      Create a RAM role in Account A and associate the AliyunSTSAssumeRoleAccess policy with the RAM role. This policy grants the RAM role the permission to assume the role of Account A. Modify the trust policy of the RAM role.

      • Replace <oidc_issuer_url> in the example with the URL of the OIDC provider of the cluster. You can view the URL on the Basic Information tab of the ACS cluster.

      • Replace <oidc_provider_arn> in the example with the ARN of the OIDC provider of the cluster. You can view the ARN on the Basic Information tab of the ACS cluster.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Condition": {
              "StringEquals": {
                "oidc:aud": "sts.aliyuncs.com",
                "oidc:iss": "<oidc_issuer_url>",
                "oidc:sub": "system:serviceaccount:kube-system:aliyun-acr-credential-helper"
              }
            },
            "Effect": "Allow",
            "Principal": {
              "Federated": [
                "<oidc_provider_arn>"
              ]
            }
          }
        ],
        "Version": "1"
      }

   2. Configure a RAM role for Account B

      Create a RAM role that has Container Registry-related permissions in Account B. On the Trust Policy Management tab, enter the ARN of the RAM role of Account A in the Principal field of the trust policy. Associate the following policy with the RAM role in Account B. The policy grants the RAM role in Account B the permissions to obtain information of Container Registry instances and pull images from the instances.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "cr:GetAuthorizationToken",
                      "cr:ListInstanceEndpoint",
                      "cr:PullRepository"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

      You can configure the MaxSessionDuration parameter for the RAM role. Valid values of this parameter range from 3600 to 43200 seconds. You must configure the expireDuration parameter in the following "aliyun-acr-credential-helper Parameters" dialog box. We recommend that you specify the same value for MaxSessionDuration and expireDuration. The value of expireDuration can be smaller than or equal to the value of MaxSessionDuration.