Question

我在区域＆＃39; us-east-1＆＃39;中的AWS ECR中有一个docker注册表。在＆us-east-1＆＃39;中启动的EC2实例上，一切正常。但是当我在'eu-central-1＆＃39;中启动一个实例时并尝试运行

$（aws ecr get-login --region us-east-1）

我得到以下回复

来自守护程序的错误响应：获取https://acc-id.dkr.ecr.us-east-1.amazonaws.com/v2/：net / http：请求已取消（等待标头时超出了Client.Timeout）

如果我跑

aws ecr get-login --region us-east-1

我看到以下回复

docker login -u AWS -p xxxx -e none https://acc_id.dkr.ecr.us-east-1.amazonaws.com

Ec2实例对iam-role有以下策略：

＆＃34;效果＆＃34;：＆＃34;允许＆＃34;，＆＃34;行动＆＃34;：[ ＆＃34; ECR：GetAuthorizationToken＆＃34 ;, ＆＃34; ECR：BatchCheckLayerAvailability＆＃34 ;, ＆＃34; ECR：GetDownloadUrlForLayer＆＃34 ;, ＆＃34; ECR：GetRepositoryPolicy＆＃34 ;, ＆＃34; ECR：DescribeRepositories＆＃34 ;, ＆＃34; ECR：ListImages＆＃34 ;, ＆＃34; ECR：BatchGetImage＆＃34 ;, ＆＃34; ECR：InitiateLayerUpload＆＃34 ;, ＆＃34; ECR：UploadLayerPart＆＃34 ;, ＆＃34; ECR：CompleteLayerUpload＆＃34 ;, ＆＃34; ECR：PUTIMAGE＆＃34; ] ＆＃34;资源＆＃34;：＆＃34; *＆＃34; }

请告诉我如何才能获得跨区域的ECR可访问性。

Answer 1

以下过程可用于从ECR提取跨区域图像：

$(aws ecr get-login --no-include-email --region <region having repository> --registry-ids <id>)

docker pull <id>.dkr.ecr.us-west-1.amazonaws.com/<image_name>:<tag>

下面的示例显示了us-east-1地区的实例正在从us-west-1中托管的ECR中提取AWS深度学习容器映像

要从EC2实例元数据中获取区域，请执行以下操作：

curl --silent http://169.254.169.254/latest/dynamic/instance-identity/document | grep region
  "region" : "us-east-1"

ECR登录：

$(aws ecr get-login --no-include-email --region us-west-1 --registry-ids 763104351884)
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

Docker Pull：

docker pull 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04
1.13-cpu-py27-ubuntu16.04: Pulling from tensorflow-training
34667c7e4631: Already exists 
d18d76a881a4: Already exists 
119c7358fbfc: Already exists 
2aaf13f3eff0: Already exists 
7b890657bd19: Already exists 
f095a52e6583: Already exists 
182b3abfb706: Already exists 
89cc0ffab23c: Already exists 
7a24716f4857: Already exists 
Digest: sha256:65c7f58ac49ed39d5b6bde4f3800dbbf8d9f99b5316292b27315fb6a4b8be56b
Status: Downloaded newer image for 763104351884.dkr.ecr.us-west-1.amazonaws.com/tensorflow-training:1.13-cpu-py27-ubuntu16.04

如何制作＆＃39; aws ecr get-login＆＃39;跨地区？

1 个答案:

以下过程可用于从ECR提取跨区域图像：

下面的示例显示了us-east-1地区的实例正在从us-west-1中托管的ECR中提取AWS深度学习容器映像