Container Registry:Cross-account instance synchronization

Automatically synchronize instances across accounts

Configure a sync rule to automatically synchronize an image to a destination instance in another account when the image is pushed to the source instance. This topic assumes that the source instance belongs to Account A and the destination instance belongs to Account B.

To synchronize existing images, use one of the following methods:

• If you have a small number of existing images, synchronize them manually. For more information, see Manually synchronize instances across accounts and CreateRepoSyncTask.

• For a large number of existing images, use the OSS replication + ACR image import solution:

  1. Copy all files from the OSS bucket of the source instance to the OSS bucket of the destination ACR instance. For more information, see Data replication.

  2. Create an import rule, select OSS Bucket as the migration source, and start an image import task.

Before you begin

Before you begin, obtain the following information:

• The UIDs of Account A and Account B.

  Note

  If you use a RAM user, obtain the UID of the Alibaba Cloud account to which the RAM user belongs.

• The region and ID of the destination instance.

  Log on to the ACR console. In the top navigation bar, select a region. On the Instances page, click the target Enterprise Edition instance. On the Overview page, view the Region of the instance. In the Instance section, find the Instance ID.

• Automatic cross-account instance synchronization can be performed by namespace or by repository:

  • Synchronization by namespace requires a matching namespace name on both the source and destination instances. Automatic repository creation must also be enabled for the namespace in the destination instance. For more information about how to enable automatic repository creation, see Create a namespace.

  • Synchronization by repository requires a matching namespace and image repository name on both the source and destination instances.

Step 1: Grant permissions in Account B

In Account B, grant Account A permissions to synchronize images to the destination instance.

1. Create the aliyuncontainerregistrycrossaccoutsyncrole role.

   Note

   The role name must be exactly aliyuncontainerregistrycrossaccoutsyncrole. This exact name, including the typo, is required.

   1. Log on to the RAM console with Account B.

   2. In the navigation pane on the left, choose Identities > Roles. On the page that appears, click Create Role.

   3. On the Create Role page, set Principal Type to Cloud Account, specify the details of the Alibaba Cloud account, and then click OK.

   4. In the Create Role dialog box, enter aliyuncontainerregistrycrossaccoutsyncrole as the role name and click Confirm.

2. Create an access policy.

   1. In the navigation pane on the left of the RAM console, choose Permissions > Policies and click Create Policy.

   2. On the Create Policy page, select JSON Editor. Replace the Resource field in the following content as needed, copy the content into the text box, and then click Confirm. Then, in the Create Policy dialog box, enter a Policy Name and Description.

      Note

      Resource: The authorized resource. The format is acs:cr:<region_of_destination_instance_in_Account_B>:<UID_of_Account_B>:instance/<ID_of_destination_instance_in_Account_B>.

      If Account B is a RAM user, the UID_of_Account_B in the Resource parameter is the UID of the Alibaba Cloud account to which the RAM user belongs.

      {
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "cr:CreateSyncRule",
                      "cr:CreateRepositorySync",
                      "cr:UpdateSyncRule"
                  ],
                  "Resource": "acs:cr:cn-beijing:151356101970****:instance/cri-4im1o411ls8g****"
              },
              {
                  "Effect": "Allow",
                  "Action": [
                      "cr:CreateSyncRule",
                      "cr:CreateRepositorySync",
                      "cr:UpdateSyncRule"
                  ],
                  "Resource": "acs:cr:cn-hangzhou:151356101970****:instance/cri-4im1o411ls8gxr****"
              }
          ],
          "Version": "1"
      }

3. Attach the access policy that you created to the aliyuncontainerregistrycrossaccoutsyncrole role.

   1. On the Policies page, search for and click the name of the access policy that you created.

   2. Click the References tab and then click Attach Policy.

   3. In the Add Permission panel, set Resource Scope to Account, set Principal to Principal, and then click OK.

   4. Click Off.

4. Modify the trust policy of the aliyuncontainerregistrycrossaccoutsyncrole role.

   1. In the navigation pane on the left of the RAM console, choose Identities > Roles.

   2. On the Roles page, search for and click aliyuncontainerregistrycrossaccoutsyncrole.

   3. Click the Trust Policy tab and then click Edit Trust Policy.

   4. In the editor, replace the value of the Service field in the following policy with your information, and then click Save trust policy document.

      Note

      Service: The authorized principal. The format is <UID_of_Account_A>@cr.aliyuncs.com.

      If Account A is a RAM user, the UID_of_Account_A in the Service parameter is the UID of the Alibaba Cloud account to which the RAM user belongs.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "125287961064****@cr.aliyuncs.com"
              ]
            }
          }
        ],
        "Version": "1"
      }

Step 2: Create a sync rule in Account A

1. Log on to the ACR console with Account A.

2. In the top navigation bar, select a region.

3. In the left-side navigation pane, click Instances.

4. On the Instances page, click the Enterprise Edition instance that you want to manage.

5. In the navigation pane on the left, choose Distribution > Instance Replication. On the page that appears, click Create Rule.

6. In the Create Rule dialog box, complete the Instance step, and click Next.

   Parameter	Description
   Rule Name	Enter a name for the sync rule.
   Sync Scenario	Set Replication Scenario to Across Accounts.
   Destination UID	Enter the UID of the Alibaba Cloud account to which the destination instance belongs.
   Destination instance	Select the region of the destination instance and enter its instance ID.

7. In the Replication Information step, set Replication Level to either namespace or repository, select the corresponding namespace or repository, set a filtering rule for repository versions, and then click Create Rule.

   On the instance management page, choose Distribution > Replication Record. On the Replication Record page, if the sync task status is Completed and the image appears in the destination instance, the synchronization was successful.

Manually synchronize instances across accounts

You can manually push an image from a source instance to a destination instance in another account. This topic assumes that the source instance is in Account A and the destination instance is in Account B.

1. Obtain the UIDs of Account A and Account B, and the region and ID of the destination instance. For more information, see the Before you begin section.

2. Grant Account A permissions to synchronize images to the instance in Account B. For details, see Step 1.

3. Log on to the Container Registry console.

4. In the top navigation bar, select a region.

5. In the left-side navigation pane, click Instances.

6. On the Instances page, click the Enterprise Edition instance that you want to manage.

7. In the left-side navigation pane of the management page of the Enterprise Edition instance, choose Repository > Repositories.

8. On the Repositories page, click the name of the target image repository.

9. In the navigation pane on the left of the repository details page, click Image Version. Find the target image version and click Replication in the Actions column.

10. In the Sync dialog box, set Replication Scenario to Across Accounts, enter the following details for the destination: account UID, region, instance ID, namespace, repository name, and image version. Then, click Confirm.

    On the instance management page, choose Distribution > Replication Record. On the Replication Record page, if the sync task status is Completed and the image appears in the destination instance, the manual synchronization was successful.