Container Registry:Install the P2P acceleration agent in an ACK cluster

Use a worker RAM role

1. Log on to the ACK console. In the left navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. In the Cluster Resources section, copy the name of the worker RAM role and click the link to go to the Resource Access Management (RAM) console to grant permissions to the role.

   1. Create the following custom permission policy. For more information, see Create a custom permission policy.

      {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "cr:GetInstanceVpcEndpoint",
                      "cr:ListInstanceEndpoint"
                  ],
                  "Resource": "*"
              }
          ]
      }

   2. On the Roles page, find the worker RAM role and attach the custom permission policy that you created. For more information, see Grant permissions to a RAM role.

4. Log on to the ACK console. In the left navigation pane, click Marketplace > Marketplace.

5. On the App Catalog page, enter ack-acr-acceleration-p2p in the search box, find the component, and then click its card.

6. On the component details page, click Deploy in the upper-right corner.

7. In the Create panel, select a Cluster and namespace, specify a release name, and then click Next.

8. On the Parameters panel, select the latest chart version and set the acrInstances parameter to your ACR Enterprise Edition instance ID. If you have multiple instances, separate their IDs with commas (,).

   # The IDs of your ACR Enterprise Edition instances. To specify multiple IDs, separate them with commas (,). Example: "cri-xxx,cri-yyy"
   acrInstances: ""
   
   
   # The region of the ACR Enterprise Edition instance. The default value is the region of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center.
   region: ""
   
   # The VPC that is connected to the VPC of the ACR Enterprise Edition instance. The default value is the VPC of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center through a VPC.
   vpcId: ""
   
   
   p2p:
     # The port used by the P2P agent in the host network.
     port: 65001

   Note

   • By default, the agent uses port 65001 on nodes. If a port conflict occurs, change the port number.

   • If the ACK cluster and the ACR Enterprise Edition instance are in the same region, you can leave the region and vpcId parameters empty. If they are in different regions, you must set the region parameter to the region of the ACR Enterprise Edition instance and the vpcId parameter to the ID of the VPC associated with the instance.

   • If you use very large container images, such as those for large models, you must adjust the P2P data caching mode based on your node configuration:

     • Data disk-based caching mode (Default): Ensure that the data disk type on the node is AutoPL. Set p2p.v2.cache.mode to disk.

     • Memory-based caching mode: Ensure that the node has at least 8 GB of free memory, and then set the value of p2p.v2.cache.mode to memory.

Use a RAM user AccessKey pair

1. Create a RAM user. For more information, see Create a RAM user.

2. Grant the following permissions to the RAM user. Then, create an AccessKey pair and record the AccessKey ID and AccessKey Secret.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:GetInstanceVpcEndpoint",
                   "cr:ListInstanceEndpoint"
               ],
               "Resource": "*"
           }
       ]
   }

3. Log on to the ACK console. In the left navigation pane, click Marketplace > Marketplace.

4. On the App Catalog page, enter ack-acr-acceleration-p2p in the search box, find the component, and then click its card.

5. On the component details page, click Deploy in the upper-right corner.

6. In the Create panel, select a Cluster and namespace, specify a release name, and then click Next.

7. On the Parameters panel, select the latest chart version. Set the acrInstances parameter to your ACR Enterprise Edition instance ID. If you have multiple instances, separate their IDs with commas (,). Then, enter the AccessKey ID and AccessKey Secret that you recorded.

   # The IDs of your ACR Enterprise Edition instances. To specify multiple IDs, separate them with commas (,). Example: "cri-xxx,cri-yyy"
   acrInstances: ""
   
   
   # If your Kubernetes cluster is self-managed in a data center, you must specify the following parameters.
   accessKey: ""
   accessKeySecret: ""
   
   # The region of the ACR Enterprise Edition instance. The default value is the region of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center.
   region: ""
   
   # The VPC that is connected to the VPC of the ACR Enterprise Edition instance. The default value is the VPC of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center through a VPC.
   vpcId: ""
   
   
   p2p:
     # The port used by the P2P agent in the host network.
     port: 65001

   Note

   • By default, the agent uses port 65001 on nodes. If a port conflict occurs, change the port number.

   • If the ACK cluster and the ACR Enterprise Edition instance are in the same region, you can leave the region and vpcId parameters empty. If they are in different regions, you must set the region parameter to the region of the ACR Enterprise Edition instance and the vpcId parameter to the ID of the VPC associated with the instance.

   • If you use very large container images, such as those for large models, you must adjust the P2P data caching mode based on your node configuration:

     • Data disk-based caching mode (Default): Ensure that the data disk type on the node is AutoPL. Set p2p.v2.cache.mode to disk.

     • Memory-based caching mode: Ensure that the node has at least 8 GB of free memory, and then set the value of p2p.v2.cache.mode to memory.

Use RRSA

The RAM Roles for Service Accounts (RRSA) feature allows you to enforce fine-grained permission control at the Pod level.

The RRSA feature is supported only in clusters that run Kubernetes 1.22 or later.

1. Enable the RRSA feature for your cluster. For more information, see Associate a RAM role with a service account to implement fine-grained, Pod-level permission management by using RRSA.

2. Configure the RAM role to access Container Registry resources.

   • Scenario 1: The ACK cluster and ACR Enterprise Edition instance are in the same account.

     Assume Account A owns both the ACK cluster and the ACR Enterprise Edition instance. Create a RAM role in Account A. For more information, see Create a RAM role for a trusted Alibaba Cloud account. Then, attach the following permission policy to the role.

     {
         "Version": "1",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                     "cr:GetInstanceVpcEndpoint",
                     "cr:ListInstanceEndpoint"
                 ],
                 "Resource": "*"
             }
         ]
     }

     Note

     • Replace <oidc_issuer_url> with the URL of the OIDC provider for your cluster. You can find this URL on the Basic Information tab of the cluster details page in the ACK console.

     • Replace <oidc_provider_arn> with the ARN of the OIDC provider for your cluster. You can find this ARN on the Basic Information tab of the cluster details page in the ACK console.

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Condition": {
             "StringEquals": {
               "oidc:aud": [
                 "sts.aliyuncs.com"
               ],
               "oidc:iss": "<oidc_issuer_url>",
               "oidc:sub": [
                 "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-job-sa",
                 "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-sa"
               ]
             }
           },
           "Effect": "Allow",
           "Principal": {
             "Federated": [
               "<oidc_provider_arn>"
             ]
           }
         }
       ],
       "Version": "1"
     }

   • Scenario 2: The ACK cluster and ACR Enterprise Edition instance are in different accounts.

     Assume Account A owns the ACK cluster, and Account B owns the ACR Enterprise Edition instance. You need to grant the ACK cluster in Account A permission to access the Container Registry resources in Account B.

     In Account A, create a RAM role. For more information, see Create a RAM role for a trusted Alibaba Cloud account. Attach the AliyunSTSAssumeRoleAccess permission policy to grant the role permission to assume other roles. Then, modify its trust policy.

     Note

     • Replace <oidc_issuer_url> with the URL of the OIDC provider for your cluster. You can find this URL on the Basic Information tab of the cluster details page in the ACK console.

     • Replace <oidc_provider_arn> with the ARN of the OIDC provider for your cluster. You can find this ARN on the Basic Information tab of the cluster details page in the ACK console.

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Condition": {
             "StringEquals": {
               "oidc:aud": [
                 "sts.aliyuncs.com"
               ],
               "oidc:iss": "<oidc_issuer_url>",
               "oidc:sub": [
                 "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-job-sa",
                 "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-sa"
               ]
             }
           },
           "Effect": "Allow",
           "Principal": {
             "Federated": [
               "<oidc_provider_arn>"
             ]
           }
         }
       ],
       "Version": "1"
     }

     In Account B, create a RAM role for ACR permissions. On the trust policy tab, add the ARN of the role from Account A. Attach the following permission policy to the role in Account B.

     {
         "Version": "1",
         "Statement": [
             {
                 "Effect": "Allow",
                 "Action": [
                     "cr:GetInstanceVpcEndpoint",
                     "cr:ListInstanceEndpoint"
                 ],
                 "Resource": "*"
             }
         ]
     }

     Note

     You can set the Maximum Session Duration for this RAM role, with a valid range of 3,600 to 43,200 seconds. The session duration, configured by the expireDuration parameter in the next step, must be less than or equal to the maximum session duration. We recommend that you set expireDuration to the same value as the Maximum Session Duration.

3. Log on to the ACK console. In the left navigation pane, click Marketplace > Marketplace.

4. On the App Catalog page, enter ack-acr-acceleration-p2p in the search box, find the component, and then click its card.

5. On the component details page, click Deploy in the upper-right corner.

6. In the Create panel, select a Cluster and namespace, specify a release name, and then click Next.

7. On the Parameters panel, select the latest chart version. Set the acrInstances parameter to your ACR Enterprise Edition instance ID. If you have multiple instances, separate their IDs with commas (,). Configure the RRSA parameters as described in the following table.

   Parameter	Description	Value
   rrsa.enable	Specifies whether to enable RRSA.	true
   rrsa.rrsaRoleARN	The ARN of the RAM role created in Account A.	Example: acs:ram::aaa
   rrsa.rrsaOIDCProviderRoleARN	The ARN of the OIDC provider for the cluster in Account A.	Example: acs:ram::bbb
   rrsa.assumeRoleARN	The ARN of the RAM role created in Account B. This parameter is not required for same-account scenarios.	Example: acs:ram::ccc
   rrsa.expireDuration	The session duration for the role created in Account B. This determines the validity period of the temporary credentials generated by the agent. This parameter is not required for same-account scenarios. Important The value of expireDuration cannot be greater than the Maximum Session Duration of the role created in Account B.	The default value is 3600. The value must be between 3600 and 43200. Unit: seconds. You also need to set the Maximum Session Duration for the role in Account B to 43200.

   For information about other parameters, see Appendix.

   Note

   • By default, the agent uses port 65001 on nodes. If a port conflict occurs, change the port number.

   • If the ACK cluster and the ACR Enterprise Edition instance are in the same region, you can leave the region and vpcId parameters empty. If they are in different regions, you must set the region parameter to the region of the ACR Enterprise Edition instance and the vpcId parameter to the ID of the VPC associated with the instance.

   • If you use very large container images, such as those for large models, you must adjust the P2P data caching mode based on your node configuration:

     • Data disk-based caching mode (Default): Ensure that the data disk type on the node is AutoPL. Set p2p.v2.cache.mode to disk.

     • Memory-based caching mode: Ensure that the node has at least 8 GB of free memory, and then set the value of p2p.v2.cache.mode to memory.

   # The IDs of your ACR Enterprise Edition instances. To specify multiple IDs, separate them with commas (,). Example: "cri-xxx,cri-yyy"
   acrInstances: ""
   
   rrsa:
     enable: true
     rrsaRoleARN: ""
     rrsaOIDCProviderRoleARN: ""
     assumeRoleARN: ""
     expireDuration: 3600
   
   # The region of the ACR Enterprise Edition instance. The default value is the region of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center.
   region: ""
   
   # The VPC that is connected to the VPC of the ACR Enterprise Edition instance. The default value is the VPC of the cluster.
   # You must set this parameter if the cluster and the instance are in different regions, or if you access the instance from a self-managed cluster in a data center through a VPC.
   vpcId: ""
   
   
   p2p:
     # The port used by the P2P agent in the host network.
     port: 65001

Appendix

The following table describes some of the parameters for the ack-acr-acceleration-p2p component.