Container Service for Kubernetes:aliyun-acr-credential-helper - Container Service for Kubernetes - Alibaba Cloud - Container Service for Kubernetes

aliyun-acr-credential-helper enables credential-free pulls of private images from Container Registry (ACR) in ACK clusters.

Important

Credential-free authentication for ACR Personal Edition is only supported for instances created on or before September 8, 2024. For instances created after that date, configure an AccessKey ID and AccessKey Secret instead.

Overview

aliyun-acr-credential-helper reads the acr-configuration ConfigMap in the kube-system namespace of an ACK cluster to authenticate and pull private images without manual credentials.

Key capabilities:

Credential-free authentication: Authenticates automatically with ACR Enterprise Edition and Personal Edition (instances created on or before September 8, 2024), eliminating manual Secret creation and rotation.
Multi-account support: Pulls from the current account's registry by default. Supports cross-account pulls via cross-account authorization or AccessKey configuration.
Cross-region support: Pulls private images from ACR instances in other regions.

Usage

See Use aliyun-acr-credential-helper to pull images without credentials (unmanaged) or Use aliyun-acr-credential-helper to pull images without credentials (managed).

Release history

July 2025

Version	Date	Description	Impact
v25.07.21.1-67f1f51-aliyun	July 21, 2025	Feature: Unmanaged credential helper now supports Security Hardening Mode for Elastic Compute Service (ECS) metadata.	This update does not affect your services.

September 2024

Version	Date	Description	Impact
v24.09.05.1-e65351a-aliyun	September 5, 2024	Bug fix: Unmanaged credential helper: Fixed intermittent Secret invalidation in `v24.08.01.1-1aa1880-aliyun`.	This update does not affect your services.

August 2024

Version	Date	Description	Impact
v24.08.01.1-1aa1880-aliyun	August 26, 2024	Security: Unmanaged credential helper: Restricted Secret permissions.	This update does not affect your services.

May 2024

Version	Date	Description	Impact
v24.01.29.1-5318af4-aliyun	May 10, 2024	Bug fix: Managed credential helper: Fixed error handling for API call failures.	This update does not affect your services.

January 2024

Version	Date	Description	Impact
v24.01.16.1-aeea43b-aliyun	January 22, 2024	Bug fix: Unmanaged credential helper: Fixed error handling for API call failures.	This update does not affect your services.

April 2023

Version	Date	Description	Impact
v23.02.06.2-74e2172-aliyun	April 4, 2023	Feature: Added managed role support, making worker role dependency optional.	This affects add-on usage. See [Product Change] Announcement on changing the permission dependencies of aliyun-acr-credential-helper.

March 2023

Version	Date	Description	Impact
v23.02.06.1-74e2172-aliyun	March 15, 2023	Bug fix: Fixed several known issues. Feature: Added RAM Roles for Service Accounts (RRSA) permission configuration. Feature: `ServiceAccounts` created during Helm chart installation are now immediately available. Feature: Added intelligent O&M diagnostics for the credential-free add-on.	This update does not affect your services.

March 2022

Version	Date	Description	Impact
v22.03.25.1-efe240e-aliyun	March 25, 2022	Bug fix: Fixed Secret version conflicts from concurrent controller updates. Feature: Enabled auto scaling for the default node pool.	This update does not affect your services.

January 2022

Version	Date	Description	Impact
v22.01.04.0-f637776-aliyun	January 4, 2022	Feature: Added ARM architecture support. Change: No longer installed by default during cluster creation. Install manually from the Add-ons page. Optimization: Improved add-on performance.	This update does not affect your services.

November 2021

Version	Date	Description	Impact
v21.11.15.0-19d8bc1-aliyun	November 15, 2021	Optimization: Upgraded the ClusterRole version.	This update does not affect your services.

September 2021

Version	Date	Description	Impact
v21.09.22.0-450db22-aliyun	September 22, 2021	Feature: The add-on now reports cluster events on errors.	This update does not affect your services.

January 2021

Version	Date	Description	Impact
v21.01.26.0-9ac7d9b-aliyun	January 26, 2021	Optimization: Improved the authentication method.	This update does not affect your services.

August 2020

Version	Date	Description	Impact
v20.08.20.0-c2da10b-aliyun	August 24, 2020	Bug fix: Fixed private image pull failures from expired tokens.	This update does not affect your services.

July 2020

Version	Date	Description	Impact
v20.07.13.0-2866ccd-aliyun	July 13, 2020	Feature: Added internal network support for OpenAPI calls. Feature: Added custom AccessKey support for image pull credentials. Optimization: Reduced the frequency of OpenAPI calls.	This update does not affect your services.

March 2020

Version	Date	Description	Impact
v20.03.16.0-36d5d7e-aliyun	March 16, 2020	Feature: Added cross-account private image pull support.	This update does not affect your services.