Amazon ECRをAWSの外から使う / Docker Meetup Kansai #5 AmazonECR

5862ce660c5a25de9584b0c2e5497055?s=47 sasaki
November 22, 2019

Amazon ECRをAWSの外から使う / Docker Meetup Kansai #5 AmazonECR

5862ce660c5a25de9584b0c2e5497055?s=128

sasaki

November 22, 2019
Tweet

Transcript

  1. %PDLFS.FFUVQ,BOTBJ   "NB[PO&$3Λ"84ͷ֎͔Β࢖͏  ࠤʑ໦ਅ໵

  2. 8IP Shinya Sasaki Head of Infrastructure Engineering at AlpacaJapan Co.,

    Ltd. Osaka, Japan
  3. "NB[PO&MBTUJD$POUBJOFS3FHJTUSZ "NB[PO&$3 w "84͕ఏڙ͢ΔϓϥΠϕʔτίϯςφϨδετϦ w

  4. &$3ྉۚ w ετϨʔδ w 64%(# w σʔλసૹ *O  w

    ແྉ w σʔλసૹ 0VU  w ˠ w ಉҰϦʔδϣϯ಺ͷ&$ͱͷσʔλసૹ͸ແྉ ౦ژϦʔδϣϯɺݱࡏ https://aws.amazon.com/jp/ecr/pricing/
  5. ࢀߟ %PDLFS)VCͷྉۚ ݱࡏ https://hub.docker.com/pricing

  6. ࢀߟ %PDLFSVCͷྉۚ https://aws.amazon.com/jp/about-aws/whats-new/2019/10/announcing-image-scanning-for-amazon-ecr/

  7. Ұൠతͳ࿩

  8. ύϒϦοΫϨδετϦ͔Βͷ1VMM Public Repository docker pull (Image) Download

  9. ϓϥΠϕʔτϨδετϦ͔Βͷ1VMM Private Repository docker pull (Image) Download docker login -u

    (User) -p (Pass) (URL) Login Succeeded
  10. "NB[PO&$3͔Βͷ1VMM

  11. "84αʔϏε͔Β&$3Πϝʔδͷ1VMM ECR AWS Account docker pull (Image) Download EKS ECS

    IAM Role IAM Role ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ
  12. "84αʔϏε͔Βͷ1VMM ΫϩεΞΧ΢ϯτ ECR AWS Account A docker pull (Image) Download

    EKS ECS IAM Role IAM Role ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ AWS Account B ผΞΧ΢ϯτΛڐՄ͢ΔϙϦγʔ
  13. "84֎͔Βͷ&$3Πϝʔδͷ1VMM ECR AWS Account GetAuthorizationToken (aws ecr get-login) Token docker

    login -u AWS -p (Token) (ECR URL) Login Succeeded docker pull (Image) Download ECR͔ΒͷPull͕ڐՄ͞ΕͨϙϦγʔ
  14. "84֎ͷLT͔Βͷ1VMM ECR AWS Account aws ecr get-login Other k8s cluster

  15. "NB[PO&$3%PDLFS$SFEFOUJBM)FMQFS w BXTFDSHFUMPHJO͕ෆཁʹͳΔ w EPDLFSͷDSFEFOUJBMIFMQFSΛ࢖͏ w શϊʔυʹΫϨσϯγϟϧΛஔ͘ʁ https://github.com/awslabs/amazon-ecr-credential-helper

  16. *NBHF1VMM4FDSFUTΛ࢖͑͹͍͍Β͍͠ kubectl create secret docker-registry <name> \ --docker-server=DOCKER_REGISTRY_SERVER \ --docker-username=DOCKER_USER

    \ --docker-password=DOCKER_PASSWORD \ --docker-email=DOCKER_EMAIL
  17. https://docs.aws.amazon.com/ja_jp/AmazonECR/latest/userguide/ECR_AWSCLI.html This command provides an authorization token that is valid

    for the specified registry for 12 hours.
  18. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c

  19. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c aws ecr get-login ͯ͠ɺ imagePullSecret Λ࡞Γ௚͢jobΛ ͓͖̒࣌ؒʹ࣮ߦ(cronjob)ͤ͞Δ

  20. https://medium.com/@damitj07/how-to-configure-and-use-aws-ecr-with-kubernetes-rancher2-0-6144c626d42c - /bin/sh - -c - |- ACCOUNT=1234567890 REGION=my-region-1 SECRET_NAME=${REGION}-ecr-registry

    EMAIL=anymail.doesnt.matter@email.com TOKEN=`aws ecr get-login --region ${REGION} --registry-ids ${ACCOUNT} | cut -d' ' -f6` kubectl delete secret --ignore-not-found $SECRET_NAME kubectl create secret docker-registry $SECRET_NAME \ --docker-server=https://${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com \ --docker-username=AWS \ --docker-password="${TOKEN}" \ --docker-email="${EMAIL}" echo "Secret created by name. $SECRET_NAME" kubectl patch serviceaccount default -p '{"imagePullSecrets":[{"name":"'$SECRET_NAME'"}]}'
  21. ·ͱΊ w &$3ʹϩάΠϯ͢ΔͨΊʹ͸5PLFOͷऔಘ͕ඞཁ w 5PLFOͷ༗ޮظݶ͸࣌ؒͳͷͰ"84Ҏ֎ͷLT͔Β࢖͏ ৔߹͸ߋ৽͢Δ࢓૊Έ͕ඞཁ w ΋ͬͱ͍͍ํ๏͕͋Ε͹ڭ͑ͯԼ͍͞

  22. 5IBOLZPV