Pull an image from a self-managed image repository to create a pod and an ImageCache - Elastic Container Instance

By default, Elastic Container Instance (ECI) pulls images over HTTPS. If your self-managed image repository uses HTTP or a self-signed certificate, image pulls fail with an ErrImagePull event. Add the appropriate annotation to your pod or ImageCache to fix this.

Prerequisites

Before you begin, make sure that:

ECI can reach your self-managed image repository over the network

Failure scenarios

The following table maps each failure scenario to its cause and solution.

Scenario	Cause	Solution
Self-managed repository uses HTTP	ECI defaults to HTTPS. The protocol mismatch causes the pull to fail.	Add the `k8s.aliyun.com/plain-http-registry` annotation to switch ECI to HTTP for that repository.
Self-managed repository uses HTTPS with a self-signed certificate	The self-signed certificate fails authentication.	Add the `k8s.aliyun.com/insecure-registry` annotation to skip certificate verification.

Annotations

Use the following annotations to configure ECI's image pull behavior. Add them to the metadata section of your pod spec or ImageCache manifest.

Important

Annotations take effect only when a pod is created. Adding or updating annotations on an existing pod has no effect.

Annotation	Value format	Description
`k8s.aliyun.com/plain-http-registry`	One or more repository addresses, separated by commas. Include the port if the address has one. Example: `"harbor*.pre.com,192.168.XX.XX:5000,reg*.test.com:80"`	Instructs ECI to pull from the specified repository over HTTP instead of HTTPS.
`k8s.aliyun.com/insecure-registry`	One or more repository addresses, separated by commas. Include the port if the address has one. Example: `"harbor*.pre.com,192.168.XX.XX:5000,reg*.test.com:80"`	Instructs ECI to skip certificate verification when pulling from the specified repository.

Examples

Create a pod

For a Deployment, add annotations under spec.template.metadata, not under the top-level metadata.

HTTP repository

ECI uses the k8s.aliyun.com/plain-http-registry annotation to pull over HTTP from the specified address.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 4
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      annotations:
        k8s.aliyun.com/plain-http-registry: "192.168.XX.XX:5000"
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
    spec:
      containers:
      - name: nginx
        image: 192.168.XX.XX:5000/test/nginx:latest

Self-signed certificate repository

ECI uses the k8s.aliyun.com/insecure-registry annotation to skip certificate verification when pulling from the specified address.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 4
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      annotations:
        k8s.aliyun.com/insecure-registry: "harbor***.pre.com"
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
    spec:
      containers:
      - name: nginx
        image: harbor***.pre.com/test/nginx:latest

Create an ImageCache

Add annotations directly under the top-level metadata of the ImageCache manifest.

HTTP repository

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/plain-http-registry: "192.168.XX.XX:5000"
spec:
  images:
  - 192.168.XX.XX:5000/test/nginx:latest
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize:
   25
  retentionDays:
   7

Self-signed certificate repository

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/insecure-registry: "harbor***.pre.com"
spec:
  images:
  - harbor***.pre.com/test/nginx:latest
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize:
   25
  retentionDays:
   7