Container Registry:Pull images across accounts

Use RRSA

In the ACK cluster of Account A, configure a specific ServiceAccount to assume a RAM role of Account B that has the permissions to pull images without credentials. This allows the ACK cluster to access and pull private images from Account B.

1. In Account A, enable the RRSA feature for the ACK cluster and create a RAM role that has the permission to assume roles.

   1. Enable the RRSA feature for the ACK cluster.

      1. Log on to the ACK console. In the left navigation pane, click Clusters.

      2. On the Clusters page, find the target cluster and click its name. In the navigation pane on the left, click Cluster Information.

      3. In the Security and Auditing section of the Basic Information tab, click Enable next to RRSA OIDC.

      4. In the Enable RRSA dialog box, click Confirm.

         In the Basic Information section, if the cluster status changes from Updating to Running, the RRSA feature is enabled for the cluster.

      5. After the RRSA feature is enabled for the cluster, navigate to the Security and Auditing section under the Basic Information tab. If you hover your mouse over the Enabled label next to RRSA OIDC, the URL and Alibaba Cloud Resource Name (ARN) of the OIDC provider are displayed.

   2. Use the script editor to edit the trust policy and create a RAM role for an OIDC IdP.

      • Replace <oidc_issuer_url> in the example with the OIDC provider URL of the current cluster that you obtained in the preceding step.

      • Replace <oidc_provider_arn> in the example with the OIDC provider ARN of the current cluster that you obtained in the preceding step.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Condition": {
              "StringEquals": {
                "oidc:aud": "sts.aliyuncs.com",
                "oidc:iss": "<oidc_issuer_url>",
                "oidc:sub": "system:serviceaccount:kube-system:aliyun-acr-credential-helper"
              }
            },
            "Effect": "Allow",
            "Principal": {
              "Federated": [
                "<oidc_provider_arn>"
              ]
            }
          }
        ],
        "Version": "1"
      }

   3. Attach the AliyunSTSAssumeRoleAccess policy to the role to grant it the permission to assume roles, and then record its ARN. For more information, see Grant permissions to a RAM role.

      1. On the role details page, click the Permissions tab, and then click Grant Permission.

      2. In the Grant Permission panel, in the Access Policy section, select the AliyunSTSAssumeRoleAccess access policy, and then click OK.

      3. On the role details page, in the Basic Information section, view and record the ARN of the RAM role. For more information, see How do I view the ARN of a RAM role?

2. In Account B, create a RAM role, grant it the permissions to pull private images, and allow the RAM role of Account A to assume this role.

   1. Use the script editor to edit the trust policy and create a RAM role for a trusted Alibaba Cloud account to allow Account A to assume the role.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "RAM": [
                "<ARN of the role created in Account A>"
              ]
            }
          }
        ],
        "Version": "1"
      }

   2. Create a custom policy with the following content and grant the policy to the RAM role. This grants the role the permissions to obtain instance information and pull images.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "cr:GetAuthorizationToken",
                      "cr:ListInstanceEndpoint",
                      "cr:PullRepository"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   3. Set the maximum session duration for the RAM role to a value between 3,600 seconds and 43,200 seconds. The default value is 3,600 seconds.

      Ensure that this value is the same as the value of the expireDuration parameter that you configure later. The value of expireDuration must not exceed the maximum session duration.

   4. On the role details page, record the ARN of the RAM role from the Basic Information section.

3. In Account A, install the passwordless component for the ACK cluster and modify its configuration items.

   For more information about the differences between the components, see Comparison of passwordless components.

   aliyun-acr-credential-helper managed component

   1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

   2. On the Clusters page, find the cluster you want and click its name. In the left navigation pane, click Add-ons.

   3. On the Add-ons page, select the Security tab. Find the aliyun-acr-credential-helper (Managed) card and click Install.

   4. In the Aliyun-acr-credential-helper Parameter Settings dialog box, select the Is RRSA Enabled checkbox and click Add. Enter the following parameters and click OK.

      

      Configuration of the associated ACR Enterprise Edition instance:

      Parameter	Description	Example
      instanceId	The ID of the ACR instance. To specify multiple IDs, separate them with commas (,).	cri-XXXXX
      regionId	The region ID of the ACR instance.	cn-hangzhou
      domains	The domain names used by the ACR instance. Enter all endpoints (public and VPC) of the ACR instance. To specify individual domain names, separate them with commas (,).	XXXXX-registry.cn-hangzhou.cr.aliyuncs.com
      assumeRoleARN	The ARN of the RAM role of the ACR instance owner. Enter the ARN of the RAM role that you created in Account B.	acs:ram::100XXXXXXXX9630:role/XXXX
      expireDuration	The validity period of the temporary credentials in a cross-account scenario. Enter the maximum session duration of the RAM role that you created in Account B.	3600
      rrsaRoleARN	The ARN of the RAM role of the ACK cluster owner. Enter the ARN of the RAM role that you created in Account A.	acs:ram::128XXXXXXXXXX09011:role/XXXX
      rrsaOIDCProviderRoleARN	The ARN of the OIDC IdP of the ACK cluster. Enter the ARN of the RRSA OIDC IdP of the ACK cluster in Account A.	acs:ram::128XXXXXXXXXX09011:oidc-provider/ack-rrsa-c8864XXXXXXXXXXXXXXXXXX99356a636

      For more information about other parameters, see Component configuration.

   aliyun-acr-credential-helper component

   1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

   2. On the Clusters page, find the cluster you want and click its name. In the left navigation pane, click Add-ons.

   3. On the Applications page, click the Security tab. Locate the aliyun-acr-credential-helper component and click Install. In the dialog box that appears, set the tokenMode option to auto and click OK.

      

   4. Modify the ConfigMap of the passwordless component.

      1. In the navigation pane on the left, choose Configuration > ConfigMaps.

      2. At the top of the ConfigMaps page, select kube-system from the Namespace drop-down list. Then, click Edit YAML in the Actions column for acr-configuration and modify the configuration as shown in the following example.

         data:
           service-account: "default"
           watch-namespace: "all"
           expiring-threshold: "15m"
           notify-email: "c*@example.com"
           acr-registry-info: |
             - instanceId: "cri-xxx"                                   # The ID of the ACR instance.
               regionId: "cn-hangzhou"                                 # The region ID of the ACR instance.
               domains: "xxxxx-registry.cn-hangzhou.cr.aliyuncs.com"   # The endpoint of the ACR instance.
               rrsaRoleARN: "<ARN of the role created in Account A>"
               rrsaOIDCProviderRoleARN: "<The ARN of the OIDC IdP from the basic information page of the ACK cluster in the console for Account A.>"
               assumeRoleARN: "<ARN of the role created in Account B>"
               expireDuration: 3600                                    # The maximum session duration of the RAM role in Account B. The default value is 3600.             
           rrsa: |
             enable: true                                              # Enable the RRSA feature for the passwordless component. 

Use Worker RAM role assumption

In the ACK cluster of Account A, configure the default Worker RAM role of the cluster to assume a RAM role of Account B that has the permissions to pull images without credentials. This allows the ACK cluster to access and pull private images from Account B.

1. In Account A, view the Worker RAM role of the cluster and grant it the permission to assume roles.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the target cluster and click its name. In the navigation pane on the left, click Cluster Information.

   3. On the Cluster Information page, click the Basic Information tab. In the Cluster Resources area, click the link to the right of Worker RAM Role.

   4. Attach the AliyunSTSAssumeRoleAccess policy to the role to grant it the permission to assume roles, and then record its ARN. For more information, see Grant permissions to a RAM role.

      1. On the role details page, click the Permissions tab, and then click Grant Permission.

      2. In the Grant Permission panel, in the Access Policy section, select the AliyunSTSAssumeRoleAccess access policy, and then click OK.

      3. On the role details page, in the Basic Information section, view and record the ARN of the RAM role. For more information, see How do I view the ARN of a RAM role?

2. In Account B, create a RAM role, grant it the permissions to pull private images, and allow the Worker RAM role of the ACK cluster in Account A to assume this role.

   1. Create a RAM role for a trusted Alibaba Cloud account.

   2. Create a custom policy with the following content, and grant the policy to the RAM role. This grants the role the permissions to obtain instance information and pull images.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "cr:GetAuthorizationToken",
                      "cr:ListInstanceEndpoint",
                      "cr:PullRepository"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   3. On the basic information page of the RAM role, click the Trust Policy tab and click Edit Trust Policy. Update the policy with the following content to allow the Worker RAM role of the ACK cluster in Account A to assume the RAM role of Account B.

      {
        "Statement": [
          {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
              "RAM": [
                "<ARN of the role created in Account A>"
              ]
            }
          }
        ],
        "Version": "1"
      }

   4. On the role details page, in the Basic Information section, view and record the ARN of the RAM role. For more information, see How do I view the ARN of a RAM role?

3. In Account A, install the passwordless component for the ACK cluster and modify its configuration items.

   1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

   2. On the Clusters page, find the cluster you want and click its name. In the left navigation pane, click Add-ons.

   3. On the Applications page, click the Security tab. Find the aliyun-acr-credential-helper component and click Install. In the dialog box that appears, set tokenMode to workerRole and click OK.

      

   4. Modify the ConfigMap of the passwordless component.

      1. In the navigation pane on the left, choose Configuration > ConfigMaps.

      2. At the top of the ConfigMaps page, select kube-system from the Namespace drop-down list. Then, click Edit YAML in the Actions column for acr-configuration and modify the configuration as shown in the following example.

         data:
             service-account: "default"
             watch-namespace: "all"
             expiring-threshold: "15m"
             notify-email: "c*@example.com"
             acr-registry-info: |
               - instanceId: "cri-xxx"                                    # The ID of the ACR Enterprise Edition instance.
                 regionId: "cn-hangzhou"                                  # The region ID of the ACR Enterprise Edition instance.
                 domains: "xxxxx-registry.cn-hangzhou.cr.aliyuncs.com"    # The endpoint of the ACR Enterprise Edition instance.
                 assumeRoleARN: "<ARN of the role created in Account B>"
                 expireDuration: 3600                                     # The maximum session duration of the RAM role in Account B. The default value is 3600.

Use the AccessKey pair of a RAM user

In the ACK cluster of Account A, the passwordless component uses the AccessKey ID and AccessKey secret of a RAM user from Account B to pull private images from Account B. Although this method is simple to configure, the AccessKey ID and AccessKey secret are stored in plaintext, which poses a security risk.

1. In Account B, create a RAM user and grant the RAM user the cr.* permissions.

   1. Create a RAM user.

   2. Create a custom policy with the following content and grant the policy to the RAM user. This grants the RAM user the permissions to obtain instance information and pull images.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "cr:GetAuthorizationToken",
                      "cr:ListInstanceEndpoint",
                      "cr:PullRepository"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

   3. Create an AccessKey pair and record the AccessKey ID and AccessKey secret.

In Account A, install the passwordless component for the ACK cluster and modify its configuration items.

1. Log on to the ACK console. In the navigation pane on the left, click Clusters.

2. On the Clusters page, find the cluster you want and click its name. In the left navigation pane, click Cluster Information.

3. On the ACK Clusters page, click the name of the target cluster. In the left navigation pane, click Add-ons.

4. On the Applications page, click the Security tab. Locate the aliyun-acr-credential-helper component and click Install. In the dialog box that appears, set the tokenMode option to auto and click OK.

   

5. Modify the ConfigMap of the passwordless component.

   1. In the navigation pane on the left, choose Configuration > ConfigMaps.

   2. At the top of the ConfigMaps page, select kube-system from the Namespace drop-down list. Then, click Edit YAML in the Actions column for acr-configuration and modify the configuration as shown in the following example.

   data:
       service-account: "default"
       watch-namespace: "all"
       expiring-threshold: "15m"
       notify-email: "c*@example.com"
       acr-registry-info: |
         - instanceId: ""                        # The ID of the ACR Enterprise Edition instance.             
           regionId: "cn-hangzhou"               # The region ID of the ACR Enterprise Edition instance.    
           customAccessKey: "xxxxx"              # The AccessKey ID of the RAM user in Account B.
           customAccessKeySecret: "xxxxxx"       # The AccessKey secret of the RAM user in Account B.