Automate image cache creation with image-cache-operator-Container Compute Service(ACS)-阿里云帮助中心

Prerequisites

or create an ACS cluster.
Connect to a cluster by using kubectl.
Install the image-cache-operator component from the Add-ons page.

We recommend that you set rbac.secret to true. This allows the component to automatically read the imagePullSecrets referenced by Pods and use them for authentication when pulling images.

Limitations

Image caches that are automatically created from a Pod are not updated to the new version if you push a new image with the same tag to the container registry.
The status of an ImageCache CR in a cluster may not reflect the actual status of the corresponding image cache. For example, if you delete an image cache in the console, the status of the ImageCache CR remains unchanged and the CR is not deleted.
When you create an image cache by creating an ImageCache CR, you can specify the image.alibabacloud.com/cascade-delete-image-cache=true annotation to enable cascade delete for the remote image cache when the CR is deleted. If you enable this feature, deleting the CR forcibly deletes the remote image cache. This may cause Pods that are using the image cache to fail to pull images.
If the number of ImageCache CRs in the cluster exceeds the configured limit, the operator periodically cleans them up but does not delete the remote image caches. For more information, see Operator configuration.
After you modify the ConfigMap for the operator configuration, you must restart the operator to apply the changes.
This component requires cluster-wide read permissions for Secrets in its RBAC configuration to fetch imagePullSecrets.
When an image cache is created automatically, each creation task consumes an IP address from the same vSwitch as the associated Pod. If not enough IP addresses are available, the creation of new Pods or image caches may fail.
ImageCache CRs in the Failed state are retried. You must promptly clean up these CRs and troubleshoot the failures to avoid consuming build quotas, which can slow down the overall creation speed of image caches.

Usage

Method 1: Create an image cache from a pod

Add the image.alibabacloud.com/auto-image-cache: controller annotation to a Pod to automatically create an image cache for all its containers.

Step 1: Create sample resources

(Optional) Create the imagePullSecret for the container image.
```
kubectl create secret docker-registry pull-secret --docker-server=<acrurl> --docker-username=<username> --docker-password=<password>
```
Replace the placeholders in the command with your actual values.
1. <acrurl>: The URL of your container registry, such as ***-***-registry.cn-hangzhou.cr.aliyuncs.com.
2. <username>: Your username for the container registry.
3. <password>: Your password for the container registry.

Save the following content as imc-pod.yaml and run kubectl apply -f imc-pod.yaml to create the sample Pod.

apiVersion: v1
kind: Pod
metadata:
  labels:
    alibabacloud.com/compute-class: performance
    alibabacloud.com/compute-qos: default
    alibabacloud.com/acs: 'true'
  annotations:
    image.alibabacloud.com/auto-image-cache: controller # Specifies that an image cache is automatically created.
  name: image-cache-01
  namespace: default
spec:
  imagePullSecrets:
  - name: pull-secret
  containers:
  - image: registry.openanolis.cn/openanolis/nginx:1.14.1-8.6
    name: main
    resources:
      limits:
        cpu: "4"
        memory: 8Gi
      requests:
        cpu: "4"
        memory: 8Gi

Step 2: Verify the results

Check the ImageCache status.
```
kubectl get imagecaches.image.alibabacloud.com
```
In the expected output, if Phase is Ready, the image cache is successfully created. If the phase is Failed, run the kubectl describe imagecaches.image.alibabacloud.com <image-cache-name> command to view the detailed error message in the Status field.
```
NAME                           PHASE   IMAGECACHEID               SIZE   AGE
image-cache-4612197a7706****   Ready   imc-bp11oilzhe191fve****   1      119m
```
You can also view the automatically created image cache in the Image Cache console.

Method 2: Create with an ImageCache CR

An ImageCache CR is a cluster-scoped resource. This method differs from automatic creation: the image cache is recreated if you push a new image to the same tag and reapply the CR.

Step 1: Create the ImageCache CR

(Optional) Create the imagePullSecret for the container image.
```
kubectl create secret docker-registry pull-secret --docker-server=<acrurl> --docker-username=<username> --docker-password=<password>
```
Replace the placeholders in the command with your actual values.
1. <acrurl>: The URL of your container registry, such as ***-***-registry.cn-hangzhou.cr.aliyuncs.com.
2. <username>: Your username for the container registry.
3. <password>: Your password for the container registry.

Save the following content as imc-crd.yaml and run kubectl apply -f imc-crd.yaml to create the ImageCache resource.

apiVersion: image.alibabacloud.com/v1
kind: ImageCache
metadata:
  name: image-cache-01
  annotations: 
    image.alibabacloud.com/cascade-delete-image-cache: "false" # Specifies whether to delete the image cache when this CR is deleted.
spec:
  imagePullCredentials:
  - secretName: pull-secret
    secretNamespace: default
  images:
  - registry.cn-hangzhou.aliyuncs.com/eci_open/nginx:latest
  networkConfig:
    securityGroupId: sg-bp1hfv5fwpyx4ry0****
    vSwitchIds:
    - vsw-bp169dodwplgfpc86****

Key parameters:

Parameter	Description
`spec.imagePullCredentials`	The Secrets required to create the image cache. These are used to pull the image.
`spec.images`	The image associated with the image cache. This field supports only one image.
`spec.networkConfig`	securityGroupId: The security group required to create the image cache. vSwitchIds: The vSwitches required to create the image cache. You can specify multiple vSwitches. By default, the operator uses the vSwitch and security group associated with the cluster.
`image.alibabacloud.com/cascade-delete-image-cache` annotation	Specifies whether to delete the image cache after the ImageCache CR is deleted. `true`: Deletes the image cache when the CR is deleted. `false`: The image cache is not deleted when the CR is deleted. You must delete the cache manually in the Image Cache console or by calling the OpenAPI.

Step 2: Verify the results

Check the status of the ImageCache.
```
kubectl get imagecaches.image.alibabacloud.com image-cache-01
```
In the expected output, if Phase is Ready, the image cache is successfully created. If the phase is Failed, run the kubectl describe imagecaches.image.alibabacloud.com image-cache-01 command to view the detailed error message in the Status field.
```
NAME             PHASE   IMAGECACHEID               SIZE   AGE
image-cache-01   Ready   imc-bp1anzjc0v90h8jm****   1      6m39s
```
Go to the Image Cache console to view the recreated image cache with the same tag.

Operator configuration

If the number of ImageCache CRs in the cluster exceeds the configured limit, image-cache-operator periodically cleans up the automatically created CRs. For details, see ImageCacheGCConfig in the ConfigMap.

apiVersion: v1
kind: ConfigMap
metadata:
  name: image-cache-config
  namespace: kube-system
data:
  operator-config: |
    {
      "NetworkConfig": {
        "vSwitchIds": ["vSwitch1", "vSwitch2"],
        "securityGroupId": "XXX"
      },
      "IgnoreAutoCacheImages": ["image-1", "image-2"],
      "ImageCacheGCConfig": {
        "threshold": 1000,
        "period": 1
      }
    }

Key parameters:

Parameter	Description
`NetworkConfig`	If the scheduler cannot schedule a Pod for an extended period, the operator uses the network configuration from this parameter to create the image cache.
`IgnoreAutoCacheImages`	Excludes the specified images from automatic image cache creation.
`ImageCacheGCConfig.threshold`	If the number of automatically created ImageCache CRs exceeds the `threshold`, the excess CRs that are in the Ready state are deleted.
`ImageCacheGCConfig.period`	The garbage collection (GC) interval in minutes.