Amazon ECRをAWSの外から使う / Docker Meetup Kansai #5 AmazonECR

Transcript

1. %PDLFS
   .FFUVQ
   ,BOTBJ
   
   
   "NB[PO
   &$3Λ"84ͷ֎͔Β࢖͏ 
   ࠤʑ໦ਅ໵

2. 8IP Shinya Sasaki Head of Infrastructure Engineering at AlpacaJapan Co.,

   Ltd. Osaka, Japan

3. "NB[PO
   &MBTUJD
   $POUBJOFS
   3FHJTUSZ
   "NB[PO
   &$3 w "84͕ఏڙ͢ΔϓϥΠϕʔτίϯςφϨδετϦ
   w

4. &$3
   ྉۚ w ετϨʔδ
   w
   64%(#
   w σʔλసૹ *O
   w

   ແྉ
   w σʔλసૹ 0VU
   w ˠ
   w ಉҰϦʔδϣϯ಺ͷ&$ͱͷσʔλసૹ͸ແྉ ౦ژϦʔδϣϯɺݱࡏ https://aws.amazon.com/jp/ecr/pricing/

5. ࢀߟ %PDLFS
   )VCͷྉۚ ݱࡏ https://hub.docker.com/pricing

6. ࢀߟ %PDLFS
   VCͷྉۚ https://aws.amazon.com/jp/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr/

7. Ұൠతͳ࿩

8. ύϒϦοΫϨδετϦ͔Βͷ1VMM Public Repository docker pull (Image) Download

9. ϓϥΠϕʔτϨδετϦ͔Βͷ1VMM Private Repository docker pull (Image) Download docker login -u

   (User) -p (Pass) (URL) Login Succeeded

10. "NB[PO
    &$3͔Βͷ1VMM

11. "84αʔϏε͔Β&$3Πϝʔδͷ1VMM ECR AWS Account docker pull (Image) Download EKS ECS

    IAM Role IAM Role ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ

12. "84αʔϏε͔Βͷ1VMM
    ΫϩεΞΧ΢ϯτ ECR AWS Account A docker pull (Image) Download

    EKS ECS IAM Role IAM Role ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ AWS Account B ผΞΧ΢ϯτΛڐՄ͢ΔϙϦγʔ

13. "84֎͔Βͷ&$3Πϝʔδͷ1VMM ECR AWS Account GetAuthorizationToken (aws ecr get-login) Token docker

    login -u AWS -p (Token) (ECR URL) Login Succeeded docker pull (Image) Download ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ

14. "84֎ͷLT͔Βͷ1VMM ECR AWS Account aws ecr get-login Other k8s cluster

15. "NB[PO
    &$3
    %PDLFS
    $SFEFOUJBM
    )FMQFS w BXT
    FDS
    HFUMPHJO͕ෆཁʹͳΔ
    w EPDLFSͷDSFEFOUJBMIFMQFSΛ࢖͏
    w શϊʔυʹΫϨσϯγϟϧΛஔ͘ʁ https://github.com/awslabs/amazon-ecr-credential-helper

16. *NBHF1VMM4FDSFUTΛ࢖͑͹͍͍Β͍͠ kubectl create secret docker-registry <name> \ --docker-server=DOCKER_REGISTRY_SERVER \ --docker-username=DOCKER_USER

    \ --docker-password=DOCKER_PASSWORD \ --docker-email=DOCKER_EMAIL

17. https://docs.aws.amazon.com/ja_jp/AmazonECR/latest/userguide/ECR_AWSCLI.html This command provides an authorization token that is valid

    for the specified registry for 12 hours.

18. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c

19. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c aws ecr get-login ͯ͠ɺ imagePullSecret Λ࡞Γ௚͢jobΛ ͓͖̒࣌ؒʹ࣮ߦ(cronjob)ͤ͞Δ

20. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c - /bin/sh - -c - |- ACCOUNT=1234567890 REGION=my-region-1 SECRET_NAME=${REGION}-ecr-registry

    EMAIL=anymail.doesnt.matter@email.com TOKEN=`aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6` kubectl delete secret --ignore-not-found $SECRET_NAME kubectl create secret docker-registry $SECRET_NAME \ --docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \ --docker-username=AWS \ --docker-password="${TOKEN}" \ --docker-email="${EMAIL}" echo "Secret created by name. $SECRET_NAME" kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}'

21. ·ͱΊ w &$3ʹϩάΠϯ͢ΔͨΊʹ͸5PLFOͷऔಘ͕ඞཁ
    w 5PLFOͷ༗ޮظݶ͸࣌ؒͳͷͰ"84Ҏ֎ͷLT͔Β࢖͏ ৔߹͸ߋ৽͢Δ࢓૊Έ͕ඞཁ
    w ΋ͬͱ͍͍ํ๏͕͋Ε͹ڭ͑ͯԼ͍͞

22. 5IBOL
    ZPV