Access an Enterprise Edition instance across regions or from a data center

Use cases

Example

This example accesses an Enterprise Edition instance in China (Hangzhou) from China (Shanghai) under the same Alibaba Cloud account. Environment details:

• VPC1

  • Region: China (Hangzhou)

  • IPv4 CIDR block: 10.0.0.0/16

  • vSwitch 1, located in Zone J, with CIDR block 10.0.0.0/24

  • vSwitch 2, located in Zone K, with CIDR block 10.0.1.0/24 (multi-zone deployment for disaster recovery)

  • ECS1 IP address: 10.0.0.1 (used to verify connectivity)

• VPC2

  • Region: China (Shanghai)

  • IPv4 CIDR block: 172.16.0.0/16

  • vSwitch 1, located in Zone M, with CIDR block 172.16.0.0/24

  • vSwitch 2, located in Zone N, with CIDR block 172.16.1.0/24

  • ECS2 IP address: 172.16.0.1

Workflow:

1. Establish a cross-region connection: Connect VPC1 and VPC2 through CEN. Connect VPCs across regions.

2. In China (Hangzhou), get the information for these three domains:

   Note

   ECS instances in the same region as the Enterprise Edition instance must access it over the internal network. Configure access control for a VPC.

   • The Enterprise Edition instance domain, used for API access to push and pull images.

   • The authentication service domain, used for identity verification.

   • The associated OSS bucket domain, used for image storage and access.

3. Configure route tables: Add the obtained IP addresses or CIDR blocks to the source network's route tables for cross-region access through CEN.

4. From China (Shanghai), verify access to the Enterprise Edition instance in China (Hangzhou).

Step 1: Establish a cross-region connection

Use CEN to connect VPC1 in China (Hangzhou) and VPC2 in China (Shanghai). Connect VPCs across regions.

Step 2: Get domain information

1. Log on to ECS1 in China (Hangzhou) and obtain the VPC IP addresses for the Enterprise Edition instance, the authentication service, and the OSS bucket.

   • Get the VPC access IP address of the Enterprise Edition instance.

     1. Log on to the Container Registry console.

     2. In the top navigation bar, select a region.

     3. In the left-side navigation pane, click Instances.

     4. On the Instances page, click the Enterprise Edition instance that you want to manage.

     5. In the navigation pane on the left of the instance management page, choose Repository > Access Control.

     6. On the VPC tab, copy the VPC access domain name of the Enterprise Edition instance. Then, run ping on the domain name from the ECS instance to obtain its IP address.

   • Get the VPC IP address of the authentication service.

     Note

     You can skip this step by enabling the instance to take over the authentication domain.

     1. Run the following command to get the VPC domain name of the authentication service. Replace InstanceName with your Enterprise Edition instance name and RegionId with its region ID.

        curl -vv https://${InstanceName}-registry-vpc.${RegionId}.cr.aliyuncs.com/v2/

        The command returns output similar to the following. The www-authenticate response header contains the Bearer realm value, which is the VPC domain name of the authentication service, for example, https://dockerauth-vpc.cn-hangzhou.aliyuncs.com/auth.

        * successfully set certificate verify locations:
        *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
          CApath: none
        * TLSv1.3 (OUT), TLS handshake, Client hello (1):
        * TLSv1.3 (IN), TLS handshake, Server hello (2):
        * TLSv1.2 (IN), TLS handshake, Certificate (11):
        * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
        * TLSv1.2 (IN), TLS handshake, Server finished (14):
        * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
        * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
        * TLSv1.2 (OUT), TLS handshake, Finished (20):
        * TLSv1.2 (IN), TLS handshake, Finished (20):
        * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256
        * ALPN, server accepted to use h2
        * Server certificate:
        *   subject: C=CN; ST=ZheJiang; L=HangZhou; O=Alibaba (China) Technology Co., Ltd.; CN=*.cr.aliyuncs.com
        *   start date: Dec 23 03:51:02 2024 GMT
        *   expire date: Jan 24 03:51:01 2026 GMT
        *   subjectAltName: host "xxx-registry-vpc.cn-hangzhou.cr.aliyuncs.com" matched cert's "*.cn-hangzhou.cr.aliyuncs.com"
        *   issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign GCC R3 OV TLS CA 2024
        *   SSL certificate verify ok.
        * Using HTTP2, server supports multi-use
        * Connection state changed (HTTP/2 confirmed)
        * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
        * Using Stream ID: 1 (easy handle 0x560b1b3ce6f0)
        > GET /v2/ HTTP/2
        > Host: xxx-registry-vpc.cn-hangzhou.cr.aliyuncs.com
        > User-Agent: curl/7.61.1
        > Accept: */*
        >
        * Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
        < HTTP/2 401
        < date: Thu, 13 Mar 2025 04:05:48 GMT
        < content-type: application/json; charset=utf-8
        < content-length: 87
        < docker-distribution-api-version: registry/2.0
        < www-authenticate: Bearer realm="https://dockerauth-vpc.cn-hangzhou.aliyuncs.com/auth",service="registry.aliyuncs.com:cn-hangzhou:china:cri-xxx:2a"

     2. Run ping to get the corresponding IP address.

        ping dockerauth-vpc.cn-hangzhou.aliyuncs.com  

   • Get the VPC IP address of the OSS bucket.

     Note

     Skip this step if you access OSS resources over a private network by using PrivateLink and point the OSS domain name to the PrivateLink endpoint with a CNAME record.

     Run ping to get the corresponding IP address.

     1. Get the VPC domain name for the OSS bucket in China (Hangzhou). Access OSS by using an endpoint and a bucket domain name.

     2. Run the ping command to get the IP address.

        ping oss-cn-hangzhou-internal.aliyuncs.com

     Note

     If you use a custom OSS bucket, the domain name is ${OSSBucketName}.oss-${RegionId}-internal.aliyuncs.com.

   Sample IP addresses for the Enterprise Edition instance domains in China (Hangzhou):

   Service	Domain name	IP address
   Enterprise Edition instance	xxxxxx-registry-vpc.cn-hangzhou.cr.aliyuncs.com	10.94.205.198
   Authentication service	dockerauth-vpc.cn-hangzhou.aliyuncs.com	100.103.7.181/32
   OSS bucket	oss-cn-hangzhou-internal.aliyuncs.com	100.118.28.43/32

Step 3: Configure route tables

• In VPC2 in China (Shanghai), add the authentication service and OSS bucket IP addresses to the route table.

  1. Log on to the VPC console.

  2. In the left-side navigation pane, click Route Tables.

  3. On the Route Tables page, find the target custom route table and click its ID.

  4. On the details page of the custom route table, choose Route Entry List > Custom Route, and then click Add Route Entry.

  5. In the Add Route Entry panel, configure the route entry as follows, and then click Confirm.

     Parameter	Description	Actions
     Destination CIDR Block	Enter the destination CIDR block for forwarding. For IPv4 CIDR, enter 100.103.7.181/32 and 100.118.28.43/32. Add each IP address as a separate entry.	Select Transit Router for Next Hop Type, then select the corresponding transit router instance for Transit Router.
     Next Hop Type	Select the next hop type. Select Transit Router. Traffic to the destination CIDR block routes through the selected transit router. Then, select the Transit Router created in Step 1: Establish a cross-region connection.

• Add a route entry for 100.0.0.0/8 (covering the authentication service and OSS bucket IPs) to the transit router route table in China (Shanghai).

  1. Log on to the CEN console.

  2. On the CEN Instance page, click the ID of the CEN instance that you want to manage.

  3. On the Basic Settings > Transit Router tab, find the transit router instance in China (Shanghai) and click its ID.

  4. On the details page of the transit router, click the Route Table tab.

  5. In the section on the left, click the target route table ID. On the details page of the route table, click the Route tab, and then click Create Route Entry.

  6. In the Add Route Entry dialog box, configure the route entry, and then click Confirm.

     Parameter	Description	Actions
     Destination CIDR	Enter the destination CIDR block. For IPV4, enter 100.0.0.0/8 (covers authentication service and OSS IPs).	Set Blackhole Route to No, and for Next Hop, select the cross-region attachment of type TR (for example, sh-hz-attach).
     Blackhole Route	Blackhole Route: No
     Next Hop	Next Hop: Set the attachment type to TR and select the CEN instance from Step 1: Establish a cross-region connection.

• Add a route entry for 100.0.0.0/8 (covering the authentication service and OSS bucket IPs) to the transit router route table in China (Hangzhou).

  1. On the Basic Settings > Transit Router tab, find the transit router instance in China (Hangzhou) and click its ID.

  2. On the details page of the transit router, click the Route Table tab.

  3. In the section on the left, click the target route table ID. On the details page of the route table, click the Route tab, and then click Create Route Entry.

  4. In the Add Route Entry dialog box, configure the route entry, and then click Confirm.

     Parameter	Description	Actions
     Destination CIDR	Enter the destination CIDR block. For IPV4, enter 100.0.0.0/8 (covers authentication service and OSS IPs).	Set Blackhole Route to No, and for Next Hop, select the VPC attachment instance.
     Blackhole Route	Blackhole Route: No
     Next Hop	Next Hop: Set the attachment type to VPC and select the VPC instance ID for China (Hangzhou).

Step 4: Verify access