Pull an image from a self-managed image repository to create a pod and an ImageCache - Elastic Container Instance

ECI pulls images over HTTPS by default. If your self-managed image repository uses HTTP or a self-signed certificate, image pulls fail with an ErrImagePull event. Add an annotation to the pod spec to tell ECI how to connect to your registry.

Network connectivity between ECI and your image repository must be established before following the steps in this topic.

How ECI handles non-standard registries

Two registry configurations cause ErrImagePull:

Scenario	Root cause	Fix
Registry uses HTTP	ECI defaults to HTTPS; the protocol mismatch blocks the pull	Set `k8s.aliyun.com/plain-http-registry` to your registry address
Registry uses HTTPS with a self-signed certificate	The untrusted certificate fails TLS verification	Set `k8s.aliyun.com/insecure-registry` to your registry address to skip certificate verification

Annotation reference

Annotation	Example value	Description
`k8s.aliyun.com/plain-http-registry`	`"harbor.pre.com,192.168.XX.XX:5000,reg.test.com:80"`	Registry address for HTTP registries. Tells ECI to connect over HTTP instead of HTTPS.
`k8s.aliyun.com/insecure-registry`	`"harbor.pre.com,192.168.XX.XX:5000,reg.test.com:80"`	Registry address for self-signed certificate registries. Skips TLS certificate verification.

Multiple registries: Separate addresses with commas. Example: harbor***.pre.com,192.168.XX.XX.

Port numbers: Include the port in the annotation value if your registry address uses one. For example, if your image is 192.168.XX.XX:5000/nginx:latest, set the annotation to 192.168.XX.XX:5000.

Important

Add annotations to the metadata section of the pod spec, not the top-level Deployment metadata. For Deployments, place annotations under spec.template.metadata. Annotations only take effect at pod creation time — modifying annotations on existing pods has no effect.

Create a pod

HTTP registry

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 4
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      annotations:
        k8s.aliyun.com/plain-http-registry: "192.168.XX.XX:5000"  # Pull from this registry over HTTP
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
    spec:
      containers:
      - name: nginx
        image: 192.168.XX.XX:5000/test/nginx:latest

Self-signed certificate registry

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx
  labels:
    app: nginx
spec:
  replicas: 4
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      name: nginx-test
      annotations:
        k8s.aliyun.com/insecure-registry: "harbor***.pre.com"  # Skip TLS verification for this registry
      labels:
        app: nginx
        alibabacloud.com/eci: "true"
    spec:
      containers:
      - name: nginx
        image: harbor***.pre.com/test/nginx:latest

Create an ImageCache

HTTP registry

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/plain-http-registry: "192.168.XX.XX:5000"  # Pull from this registry over HTTP
spec:
  images:
  - 192.168.XX.XX:5000/test/nginx:latest
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize: 25
  retentionDays: 7

Self-signed certificate registry

apiVersion: eci.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: imagecache-sample
  annotations:
    k8s.aliyun.com/insecure-registry: "harbor***.pre.com"  # Skip TLS verification for this registry
spec:
  images:
  - harbor***.pre.com/test/nginx:latest
  imagePullSecrets:
  - default:secret1
  - default:secret2
  - kube-system:secret3
  imageCacheSize: 25
  retentionDays: 7