Container Service for Kubernetes:Pull images from a Container Registry instance without using a Secret

Step 1: Create and configure the RAM role

1. Create a RAM role for a trusted Alibaba Cloud service. See Create a RAM role for a trusted Alibaba Cloud service. Use the following parameters:

   Parameter	Value
   Select Trusted Entity	Alibaba Cloud Service
   Role Type	Normal Service Role
   RAM Role Name	Example: acr-test
   Select Trusted Service	ECI

2. Create a custom permission policy. See Create a custom policy. The following policy allows listing all instances (cr:Get*, cr:List*) but restricts image pulls to a single specified instance:

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Get*",
                   "cr:List*"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "cr:Pull*"
               ],
               "Resource": [
                   "acs:cr:cn-hangzhou:1609982529******:instance/cri-nwj395hgf6f3****"
               ]
           }
       ]
   }

   Replace the Resource ARN with the ARN of your Container Registry instance. For the policy syntax, see Policy elements.

3. Attach the custom policy to the RAM role. See Grant permissions to a RAM role.

4. On the role details page, verify the permissions and copy the Alibaba Cloud Resource Name (ARN) of the role. You need this ARN in the next step.

   

Step 2: Reference the RAM role in your workload

Add the k8s.aliyun.com/acr-service-arns annotation to your pod spec, referencing the ARN from Step 1.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/acr-service-arns: "acs:ram::1609982529******:role/acr-test"  # ARN of the RAM role
    spec:
      containers:
      - name: nginx
        image: test****-registry.cn-hangzhou.cr.aliyuncs.com/eci_test/nginx:1.0     # Image in the allowed instance
        ports:
        - containerPort: 80

Create a pod

Add the k8s.aliyun.com/acr-instance-ids annotation to spec.template.metadata in your Deployment:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/acr-instance-ids: "cri-j36zhodptmyq****"                  # Container Registry instance ID
    spec:
      containers:
      - name: nginx
        image: test****-registry.example.com/eci_test/nginx:1.0                   # Image using a custom domain name
        ports:
        - containerPort: 80

Create an image cache

Add the same k8s.aliyun.com/acr-instance-ids annotation to the image cache metadata:

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/acr-instance-ids: "cri-j36zhodptmyq****"                      # Container Registry instance ID
spec:
  images:
  - test****-registry.example.com/eci_test/nginx:1.0                              # Image using a custom domain name
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize: 25
  retentionDays: 7

Step 1: Create RAM roles in both accounts

In Account A (ECI account):

1. Create a RAM role for a trusted Alibaba Cloud service. See Create a RAM role for a trusted Alibaba Cloud service.

   Parameter	Value
   Select Trusted Entity	Alibaba Cloud Service
   Role Type	Normal Service Role
   RAM Role Name	Example: role-assume
   Select Trusted Service	ECI

2. Grant the role-assume role the AliyunSTSAssumeRoleAccess system policy. See the "Method 2" section of Grant permissions to a RAM role.

3. On the role details page, verify the permissions and trust policy, and copy the ARN of role-assume.

   • Permissions and ARN:

   • Trust policy:

In Account B (Container Registry account):

1. Create a RAM role for a trusted Alibaba Cloud account. See Create a RAM role for a trusted Alibaba Cloud account.

   Parameter	Value
   Select Trusted Entity	Alibaba Cloud Account
   RAM Role Name	Example: role-acr
   Select Trusted Alibaba Cloud Account	Other Alibaba Cloud Account — enter Account A to which the ECI resource belongs

2. Grant the role-acr role the AliyunContainerRegistryFullAccess system policy. See the "Method 2" section of Grant permissions to a RAM role.

3. Edit the trust policy of role-acr to restrict assumption to role-assume only. See Edit the trust policy of a RAM role. By default, role-acr can be assumed by any RAM user or role in Account A. To restrict access, set the RAM field in the Principal element to the ARN of role-assume:

   "Principal": {
     "RAM": [
       "acs:ram::1609982529******:role/role-assume"
     ]
   }

4. Verify the permissions and trust policy, and copy the ARN of role-acr.

   • Permissions and ARN:

   • Trust policy:

Step 2: Reference both RAM roles in your workload

Add the following annotations to your pod or image cache. All three annotations are required when the Container Registry instance uses a custom domain name:

Enterprise Edition instances can be used across regions. To pull from an instance in a different region, prefix the instance ID with the region ID: cn-beijing:cri-j36zhodptmyq****.

Create a pod:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test
  labels:
    app: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
      annotations:
        k8s.aliyun.com/acr-instance-ids: "cri-j36zhodptmyq****"
        k8s.aliyun.com/acr-service-arns: "acs:ram::1609982529******:role/role-assume"
        k8s.aliyun.com/acr-user-arns: "acs:ram::1298452580******:role/role-acr"
    spec:
      containers:
      - name: nginx
        image: test****-registry.example.com/eci_test/nginx:1.0   # Image using a custom domain name
        ports:
        - containerPort: 80

Create an image cache:

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/acr-instance-ids: "cri-j36zhodptmyq****"
    k8s.aliyun.com/acr-service-arns: "acs:ram::1609982529******:role/role-assume"
    k8s.aliyun.com/acr-user-arns: "acs:ram::1298452580******:role/role-acr"
spec:
  images:
  - test****-registry.example.com/eci_test/nginx:1.0              # Image using a custom domain name
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize: 25
  retentionDays: 7