Elastic Container Instance:Image cache annotations

Annotations that can be added when you create an image cache

The following table describes the annotations that can be added when you create an image cache.

Create an image cache by using the multi-zone feature

When you create an image cache, the system creates a temporary elastic container instance. To ensure the image cache can be created, you can specify multiple vSwitches that reside in different zones.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/vswitch-ids: "vsw-bp1dktddjsg5nktv****,vsw-bp1xpiowfm5vo8o3c****"  # Specifies multiple vSwitches.
spec:
  images:
  - centos:latest
  - busybox:latest
  imageCacheSize:
   25
  retentionDays:
   7

Specify the CPU architecture

When you pull an image of the Arm architecture to create an image cache, you must specify the CPU architecture.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/imc-cpu-arch: "arm64" # Specifies the CPU architecture as Arm.
spec:
  images:
  -arm64v8/centos:7.9.2009 # Specifies the container image that uses the Arm architecture.
  imageCacheSize:
   25
  retentionDays:
   7

Specify the operating system

When you pull a Windows image to create an image cache, you must specify the operating system.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/imc-os-type: "windows" # Specifies the operating system as Windows.
spec:
  images:
  -mcr.microsoft.com/windows/nanoserver:ltsc2022 # Specifies the container image that contains the operating system.
  imageCacheSize:
   25
  retentionDays:
   7

Configure a security group and resource group

By default, the security group and resource group that are configured in eci-profile are used when you create an image cache. You can configure a security group and resource group based on your business requirements.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/security-group-id: "sg-bp1dktddjsg5nktv****" # Specifies a security group.
    k8s.aliyun.com/resource-group-id: "rg-aek2z3elfs4****"      # Specifies a resource group.
spec:
  images:
  - centos:latest
  - busybox:latest
  imageCacheSize:
   25
  retentionDays:
   7

Pull images from a Container Registry instance without using secrets

The following table describes the scenarios in which you can pull images from a Container Registry instance without using Secrets.

For more information, see Pull images from a Container Registry instance without using a Secret.

Use self-managed image repositories

If a self-managed image repository uses the HTTP protocol or a self-signed certificate when you use an image in the image repository to create an image cache, you must configure annotations to prevent image pull failures.

• The self-managed image repository uses the HTTP protocol.

  By default, elastic container instances pull images over the HTTPS protocol. When you create an image cache, you must add the k8s.aliyun.com/plain-http-registry annotation. This allows the elastic container instance to interact with the image repository over the HTTP protocol.

  apiVersion: eci.alibabacloud.com/v1
  kind: ImageCache
  metadata:
    name: imagecache-sample
    annotations:
      k8s.aliyun.com/plain-http-registry: "192.168.XX.XX:5000"  # Specifies the address of the self-managed image repository, which is used to pull an image over HTTP protocol.
  spec:
    images:
    - 192.168.XX.XX:5000/test/nginx:latest
    imagePullSecrets:
    - default:secret1
    - default:secret2
    - kube-system:secret3
    imageCacheSize:
     25
    retentionDays:
     7

• The self-managed image repository uses a self-signed certificate.

  If the self-managed image repository uses a self-issued certificate, certificate authentication fails when the system attempts to pull an image from the image repository. You must add the k8s.aliyun.com/insecure-registry annotation to skip certificate authentication.

  apiVersion: eci.alibabacloud.com/v1
  kind: ImageCache
  metadata:
    name: imagecache-sample
    annotations:
      k8s.aliyun.com/insecure-registry: "harbor***.pre.com"  # Specifies the address of the self-managed image repository. The system skips certificate authentication when the system tries to pull an image from the image repository to create a pod.
  spec:
    images:
    - harbor***.pre.com/test/nginx:latest
    imagePullSecrets:
    - default:secret1
    - default:secret2
    - kube-system:secret3
    imageCacheSize:
     25
    retentionDays:
     7

Enable reuse of image cache layers

The time required to create an image cache depends on factors such as the image size and network conditions. You can enable the image cache layer reuse feature to reduce the time required to create an image cache.

After you enable the feature, the system inspects existing image caches when you create an image cache. If an existing image cache contains an image layer that you want to use, the system reuses the image layer to reduce the time required to create the image cache.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/imc-enable-reuse: "true"   # Enables reuse of image cache layers.
spec:
  images:
  - centos:latest
  - busybox:latest
  imageCacheSize:
   25
  retentionDays:
   7

Enable the instant image cache feature

The time required to create an image cache depends on factors such as the image size and network conditions. You can enable the instant image cache feature to reduce the time required to create an image cache.

After you enable the instant image cache feature, the system creates a temporary local snapshot for the disks of the temporary elastic container instance during the creation of the image cache. After the local snapshot is created, the image cache is available for use.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/imc-enable-flash: "true"   # Enables the instant image cache feature.
spec:
  images:
  - centos:latest
  - busybox:latest
  imageCacheSize:
   25
  retentionDays:
   7

Configure the size and retention period of the image cache

By default, a manually created image cache is 20 GiB in size and is permanently retained after it is created. If you want to specify the size and retention period of the image cache, you can specify the imageCacheSize and retentionDays parameters in the spec section, or add annotations.

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/imc-retention-days: "7"   # Specifies the retention period of the image cache.
    k8s.aliyun.com/imc-size: "25"            # Specifies the size of the image cache.
spec:
  images:
  - centos:latest
  - busybox:latest

Configure an EIP to pull images over the Internet

EIPs are public IP addresses that you can purchase and use as independent resources. When an EIP is associated with a cloud resource, the cloud resource can use the EIP to connect to the Internet. For more information, see What is an Elastic IP Address?

When you create an image cache, make sure that you are connected to the Internet before you pull images over the Internet. You can connect to the Internet by configuring a NAT gateway or configuring an EIP. If your virtual private cloud (VPC) is not associated with a NAT gateway, you can configure an EIP to pull images over the Internet. You can use one of the following methods to configure an EIP.

• Associate an existing EIP with the temporary elastic container instance

  apiVersion: eci.alibabacloud.com/v1
  kind: ImageCache
  metadata:
    name: imagecache-sample
    annotations:
      k8s.aliyun.com/eip-instance-id: "eip-bp1q5n8cq4p7f6dzu****"   # Associates an existing EIP with the temporary elastic container instance.
  spec:
    images:
    - centos:latest
    - busybox:latest
    imageCacheSize:
     25
    retentionDays:
     7

• Automatically create an EIP and associate it with the temporary elastic container instance

  apiVersion: eci.alibabacloud.com/v1
  kind: ImageCache
  metadata:
    name: imagecache-sample
    annotations:
      k8s.aliyun.com/auto-create-eip: "true"                                       # Automatically creates an EIP and associates it with the temporary elastic container instance.
      k8s.aliyun.com/eip-bandwidth: "10"                                           # Specifies the bandwidth limit of the EIP. Unit: Mbit/s.
      k8s.aliyun.com/eip-internet-charge-type: PayByBandwidth                      # Specifies the metering method of the EIP.
      k8s.aliyun.com/eip-common-bandwidth-package-id: "cbwp-2zeukbj916scmj51m****" # Specifies the ID of the EIP bandwidth plan.
  spec:
    images:
    - centos:latest
    - busybox:latest
    imageCacheSize:
     25
    retentionDays:
     7