amazon-web-services - 'aws ecr get-login'如何跨区域？

Question

我在区域“us-east-1”的 AWS ECR 中有一个 docker 注册表。在“us-east-1”中启动的 EC2 实例上一切正常。但是当我在“eu-central-1”中启动一个实例并尝试运行

$(aws ecr get-login --region us-east-1)

我得到以下响应

Error response from daemon: Get https://acc-id.dkr.ecr.us-east-1.amazonaws.com/v2/: net/http: request canceled (Client.Timeout exceeded while awaiting headers)

如果我跑

aws ecr get-login --region us-east-1

我确实看到了以下响应

docker login -u AWS -p xxxx -e none https://acc_id.dkr.ecr.us-east-1.amazonaws.com

EC2 实例具有以下 iam 角色策略:

"Effect": "Allow", "Action": [ "ecr:GetAuthorizationToken", "ecr:BatchCheckLayerAvailability", "ecr:GetDownloadUrlForLayer", "ecr:GetRepositoryPolicy", "ecr:DescribeRepositories", "ecr:ListImages", "ecr:BatchGetImage", "ecr:InitiateLayerUpload", "ecr:UploadLayerPart", "ecr:CompleteLayerUpload", "ecr:PutImage" ], "Resource": "*" }

请告诉我如何才能拥有这种跨区域 ECR 可访问性。

Answer 1

以下过程可用于从 ECR 中提取跨区域图像:

$(aws ecr get-login --no-include-email --region <region having repository> --registry-ids <id>)

docker pull <id>.dkr.ecr.us-west-1.amazonaws.com/<image_name>:<tag>

以下示例显示 us-east-1 区域中的实例正在从 us-west-1 中托管的 ECR 中提取 AWS 深度学习容器镜像

从 EC2 实例元数据中获取区域:

curl --silent http://169.254.169.254/latest/dynamic/instance-identity/document | grep region
  "region" : "us-east-1"

ECR 登录:

$(aws ecr get-login --no-include-email --region us-west-1 --registry-ids 763104351884)
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

docker 拉动:

docker pull 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04
1.13-cpu-py27-ubuntu16.04: Pulling from tensorflow-training
34667c7e4631: Already exists 
d18d76a881a4: Already exists 
119c7358fbfc: Already exists 
2aaf13f3eff0: Already exists 
7b890657bd19: Already exists 
f095a52e6583: Already exists 
182b3abfb706: Already exists 
89cc0ffab23c: Already exists 
7a24716f4857: Already exists 
Digest: sha256:65c7f58ac49ed39d5b6bde4f3800dbbf8d9f99b5316292b27315fb6a4b8be56b
Status: Downloaded newer image for 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04