Container Compute Service:Automatically create image caches on ACR Enterprise Edition pushes

How it works

Three services form an event-driven pipeline:

1. ACR Enterprise Edition detects an image push and emits a cr:Artifact:PushCompleted event.

2. EventBridge receives the event on the default event bus and invokes the ACS CreateImageCache API with parameters extracted from the event payload.

3. ACS creates an image cache from the pushed image for fast pod startup.

Each push triggers one CreateImageCache call. Frequent pushes increase image cache storage costs and EventBridge fees.

Prerequisites

Prepare the following resources:

Step 1: Configure the ACR instance

1. Log on to the Container Registry console.

2. In the left-side navigation pane, click Instances.

3. On the Instances page, click the Enterprise Edition instance that you want to manage.

4. In the left-side navigation pane, choose Repository > Access Control. On the VPC tab, click Add VPC and add the VPC that you prepared.

5. In the left-side navigation pane, choose Instances > Event Notification. Click Create Rule, and configure the following settings:

   • Event Type: Select cr:Artifact:PushCompleted.

   • Effective Scope: Select the repositories to monitor, or select all.

   • Event Notification: Select DingTalk, HTTP, or HTTPS.

     The notification endpoint does not need to be functional. This step only generates an event for EventBridge to capture.

Step 2: Create a RAM policy

Create a custom policy that allows calling the ACS CreateImageCache API.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Permissions > Policies.

3. On the Policies page, click Create Policy.

4. On the Create Policy page, click JSON Editor.

5. Paste the following policy, then click OK:

   {
     "Version": "1",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "acc:CreateImageCache",
         "Resource": "*"
       },
       {
         "Effect": "Allow",
         "Action": "ram:CreateServiceLinkedRole",
         "Resource": "*",
         "Condition": {
           "StringEquals": {
             "ram:ServiceName": "imc.acc.aliyuncs.com"
           }
         }
       }
     ]
   }

6. Enter a policy name and optional description, then click OK.

Step 3: Configure EventBridge

Step 1 created an event rule in the default event bus. Edit this rule to add a target that calls the ACS CreateImageCache API.

1. Log on to the EventBridge console.

2. In the top navigation bar, select the same region as your VPC.

3. In the left-side navigation pane, click Event Buses.

4. In the default event bus row, click Event Rules in the Actions column. Find the event rule created in Step 1, click Edit Targets, then click Add Target.

   Parameter	Value
   Service Type	acs.openapi.acc
   API Type	CreateImageCache
   RegionId	Select Template: Variables: { "InstanceName": "$.data.InstanceName", "RegionId": "$.data.RegionId", "RepoName": "$.data.RepoName", "RepoNamespaceName": "$.data.RepoNamespaceName", "Tag": "$.data.Tag" } Template: ${RegionId}
   ImageCacheName	Select Template: Variables: { "InstanceName": "$.data.InstanceName", "RegionId": "$.data.RegionId", "RepoName": "$.data.RepoName", "RepoNamespaceName": "$.data.RepoNamespaceName", "Tag": "$.data.Tag" } Template: ${RepoNamespaceName}-${RepoName}-${Tag}
   Images	Select Template: Variables: { "InstanceName": "$.data.InstanceName", "RegionId": "$.data.RegionId", "RepoName": "$.data.RepoName", "RepoNamespaceName": "$.data.RepoNamespaceName", "Tag": "$.data.Tag" } Template: ${InstanceName}-registry-vpc.${RegionId}.cr.aliyuncs.com/${RepoNamespaceName}/${RepoName}:${Tag}
   NetworkConfig	VSwitchIds: Enter the vSwitch ID that you prepared. SecurityGroupId: Enter the security group ID that you prepared.
   Role	Click Authorization, EventBridge creates a role named AliyunEventBridgeOpenApi-******. Log on to the RAM console as a RAM administrator, find this role, and attach the policy from Step 2.
   Retry Policy and Dead-letter Queue	Select Exponential Decay Retry and Fault Tolerance Allowed.

Step 4: Verify the result

Push an image to the ACR Enterprise Edition instance. Log on to the ACS console, click Image Cache in the left-side navigation pane. Verify that a new image cache appears with a name in the format <namespace>-<repo>-<tag>.

References

• Billing overview of EventBridge

• Accelerate ACS pod startup with ImageCache