Elastic Container Instance:Pull images from a Container Registry instance without using a secret

If the resource to be created such as an elastic container instance and the Container Registry instance belong to the same Alibaba Cloud account, and the Container Registry instance is an Enterprise Edition instance that uses a default domain name or is a Personal Edition instance, secret-free image pulling is enabled for the Container Registry instance by default. In this case, you can configure a RAM role based on your business requirements to limit the scope of Container Registry instances that support secret-free image pulling. For example, you can specify only one Container Registry instance that supports secret-free image pulling.

Procedure:

Step 1: Create RAM roles and grant permissions to the RAM roles

1. Create a RAM role for a trusted Alibaba Cloud service. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

   Take note of the following parameters:

   • Select Trusted Entity: Alibaba Cloud Service.

   • Role Type: Normal Service Role.

   • RAM Role Name: Example: acr-test.

   • Select Trusted Service: ECI.

2. Create a custom permission policy. For more information, see Create a custom policy.

   The following example shows the content of a policy, which indicates that only images in the specified Container Registry instance can be pulled. For more information about how to write a policy, see Policy elements.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Get*",
                   "cr:List*"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Pull*"
               ],
               "Resource": [
                   "acs:cr:cn-hangzhou:1609982529******:instance/cri-nwj395hgf6f3****"
               ]
           }
       ]
   }

3. Attach the custom policy to the RAM role. For more information, see Grant permissions to a RAM role.

4. Find the acr-test role that you created. Click the role name to go to the details page. Verify the permissions and obtain the Alibaba Cloud Resource Name (ARN) of the RAM role.

   

Step 2: Specify the RAM role that you created in Step 1 to create a resource

When you call the CreateContainerGroup API operation to create an elastic container instance or call the CreateImageCache API operation to create an image cache, you can use the AcrRegistryInfo.N.ArnService parameter to specify the RAM role that is used to create the resource. The following table describes the parameter. For more information, see CreateContainerGroup and CreateImageCache.

For example, if you create an elastic container instance, you can specify the following parameters in OpenAPI:

ContainerGroupName=test-acr

#Container
Container.1.Name=test
Container.1.Image=test****-registry.cn-hangzhou.cr.aliyuncs.com/eci_test/nginx:1.0

#AcrRegistryInfo
AcrRegistryInfo.1.ArnService=acs:ram::1609982529******:role/acr-test

Step 1: Create RAM roles and grant permissions to the RAM roles

1. Create a RAM role in Account A to which the resource to be created such as an elastic container instance belongs and grant permissions to the RAM role.

   1. Create a RAM role for a trusted Alibaba Cloud service. For more information, see Create a RAM role for a trusted Alibaba Cloud service.

      Take note of the following parameters:

      • Select Trusted Entity: Alibaba Cloud Service.

      • Role Type: Normal Service Role.

      • RAM Role Name: example: role-assume.

      • Select Trusted Service: ECI.

   2. Grant the role-assume role the permission to call the AssumeRole API operation of Security Token Service (STS). For more information, see the "Method 2: Grant permissions to a RAM role by clicking Input and Attach on the Roles page" section of the Grant permissions to a RAM role topic.

      Set the policy type to system policy, and the policy name to AliyunSTSAssumeRoleAccess.

   3. Find the role-assume role that you created. Click the role name to go to the details page. Verify the permissions and the trust policy, and obtain the ARN of role-assume.

      • Permissions and the ARN

        

      • The trust policy

        

2. Create a RAM role in Account B to which the Container Registry instance belongs and grant permissions to the RAM role.

   1. Create a RAM role for a trusted Alibaba Cloud account. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

      Take note of the following parameters:

      • Select Trusted Entity: Alibaba Cloud Account.

      • RAM Role Name: Example: role-acr.

      • Select Trusted Alibaba Cloud Account: Other Alibaba Cloud Account. Enter Account A to which the resource to be created such as the elastic container instance belongs.

   2. Grant the role-acr role the permission to pull images from Container Registry instances. For more information, see the "Method 2: Grant permissions to a RAM role by clicking Input and Attach on the Roles page" section of the Grant permissions to a RAM role topic.

      Set the policy type to system policy, and the policy name to AliyunContainerRegistryFullAccess.

   3. Edit the trust policy to make role-acr trusted by role-assume. For more information, see Edit the trust policy of a RAM role.

      By default, the role-acr role can be assumed by all RAM users and RAM roles in Account A. We recommend that you edit the trust policy to grant permissions only to necessary RAM users and RAM roles in Account A.

      In the Principal element, change the value of the RAM field to the ARN of role-assume. This indicates that the role-acr role can only be assumed by role-assume. Example:

      "Principal": {
      	"RAM": [
      		"acs:ram::1609982529******:role/role-assume"
      	]
      }

   4. Verify the permissions and the trust policy and obtain the ARN of role-acr.

      • Permissions and the ARN

        

      • The trust policy

        

Step 2: Specify the RAM roles that you created in Step 1 to create a resource

If you call the CreateContainerGroup API operation to create an elastic container instance or call the CreateImageCache API operation to create an image cache, you can configure AcrRegistryInfo-related parameters to specify the Container Registry instance in an Alibaba Cloud account different from the account of the resource to be created. Take note of the following items:

• If the Container Registry instance belongs to an Alibaba Cloud account different from the account of the resource to be created, you must set ArnService and ArnUser to specify RAM roles for permission configurations.

• If the Container Registry instance is an Enterprise Edition instance that uses a custom domain name, you must set InstanceId to specify the Container Registry instance.

For more information, see CreateContainerGroup and CreateImageCache.

For example, if you create an elastic container instance, you can specify the following parameters in OpenAPI:

ContainerGroupName=test-acr

#Container
Container.1.Name=test
Container.1.Image=test****-registry.cn-hangzhou.cr.aliyuncs.com/eci_test/nginx:1.0

#AcrRegistryInfo
AcrRegistryInfo.1.ArnService=acs:ram::1609982529******:role/role-assume
AcrRegistryInfo.N.ArnUser=acs:ram::1298452580******:role/role-acr