kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #816 from abkaplan07/patch-1 

Clarify AWS ECR Instructions
pull/288/merge
Kelsey Hightower 2016-07-28 12:41:05 -07:00 committed by GitHub
parent 25c9c6b4f0 aa43a90b0d
commit 8e7ce01ded
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
docs/user-guide/images.md
View File

@ -32,6 +32,9 @@ Credentials can be provided in several ways:
- Per-cluster - Per-cluster
- automatically configured on Google Compute Engine or Google Container Engine - automatically configured on Google Compute Engine or Google Container Engine
- all pods can read the project's private registry - all pods can read the project's private registry
- Using AWS EC2 Container Registry (ECR)
- use IAM roles and policies to control access to ECR repositories
- automatically refreshes ECR login credentials
- Configuring Nodes to Authenticate to a Private Registry - Configuring Nodes to Authenticate to a Private Registry
- all pods can read any configured private registries - all pods can read any configured private registries
- requires node configuration by cluster administrator - requires node configuration by cluster administrator
@ -60,7 +63,7 @@ so it can pull from the project's GCR, but not push.
### Using AWS EC2 Container Registry ### Using AWS EC2 Container Registry
Kubernetes has native support for the [AWS EC2 Container Kubernetes has native support for the [AWS EC2 Container
Registry](https://aws.amazon.com/ecr/), when nodes are AWS instances. Registry](https://aws.amazon.com/ecr/), when nodes are AWS EC2 instances.
Simply use the full image name (e.g. `ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag`) Simply use the full image name (e.g. `ACCOUNT.dkr.ecr.REGION.amazonaws.com/imagename:tag`)
in the Pod definition. in the Pod definition.
@ -83,6 +86,9 @@ The kubelet will fetch and periodically refresh ECR credentials. It needs the f
**Note:** if you are running on Google Container Engine (GKE), there will already be a `.dockercfg` on each node **Note:** if you are running on Google Container Engine (GKE), there will already be a `.dockercfg` on each node
with credentials for Google Container Registry. You cannot use this approach. with credentials for Google Container Registry. You cannot use this approach.
**Note:** if you are running on AWS EC2 and are using the EC2 Container Registry (ECR), the kubelet on each node will
manage and update the ECR login credentials. You cannot use this approach.
**Note:** this approach is suitable if you can control node configuration. It **Note:** this approach is suitable if you can control node configuration. It
will not work reliably on GCE, and any other cloud provider that does automatic will not work reliably on GCE, and any other cloud provider that does automatic
node replacement. node replacement.