Scenario
This document describes how to pull container images in a Tencent Container Registry (TCR) Enterprise Edition instance in a Tencent Kubernetes Engine (TKE) Serverless cluster and to create workloads.
Preparations
Before using a private image hosted in TCR Enterprise Edition to deploy applications in TKE, complete the following operations:
You have purchased an Enterprise Edition instance.
You have created a TKE Serverless cluster.
If you are using a sub-account, the sub-account must have obtained operation permissions on the corresponding instance. For more information, see TCR Enterprise Authorization Management.
Instructions
Preparing a container image
Step 1: Creating a namespace
A new TCR Enterprise Edition instance does not have a default namespace, and a namespace cannot be automatically created through the pushed image. Therefore, you must manually create a namespace as needed. For more information, see Managing Namespaces.
We recommend that you name the namespace based on the project or team name. In this document,
docker is used as an example.Step 2: (Optional) Creating an image repository
Container images are hosted in specific image repositories. You can create an image repository as needed. For more information, see Creating an image repository. Set the image repository name to the name of the container image to be deployed. In this document,
getting-started is used as an example. Note
When using
docker cli or other image tools, such as Jenkins, to push images to an Enterprise Edition instance, the image repository will be automatically created if it does not exist, eliminating the need for manual creation in advance.Step 3: Pushing container images
1. You can use
docker cli or other image building tools (such as Jenkins) to push images to the specified image repository. This document uses docker cli as an example. In this step, you need to use a CVM or CPM instance with Docker installed and ensure that the target client is in the public or private network access allowlist defined in Configuring the Network Access Policy.2. Refer to Obtaining Instance Access Credentials to get the login command and perform Docker Login.
3. After logging in, you can create a container image on the local server or obtain a public image from Docker Hub for testing.
This document uses the official and latest Nginx image on Docker Hub as an example. In the command line tool, run the following commands sequentially to push this image. Replace demo-tcr, docker, and getting-started with the actual instance, namespace, and image repository names you have created.
docker tag getting-started:latest demo-tcr.tencentcloudcr.com/docker/getting-started:latest
docker push demo-tcr.tencentcloudcr.com/docker/getting-started:latest
4. After the image is pushed, you can go to the Image Repository page in the TCR console and click the name of a repository to view its details.
Configuring a TKE Serverless cluster to access a TCR instance
For your data security, TCR and TKE Serverless deny all public and private access requests by default. Therefore, you must configure the network access policies before deploying the TCR image to TKE Serverless.
TCR Enterprise Edition instances support network access control. You can select public network or private network access for a TKE Serverless cluster to access a specific instance and pull the container image based on the network configuration of the TKE Serverless cluster. If the TKE Serverless cluster and TCR instance are deployed in the same region, we recommend that the TKE Serverless cluster pulls the container image through the private network to accelerate pulling and reduce public network traffic costs.
This document describes how to access a TCR instance through the private network. For more information about how to access a TCR instance through the public network, see Accessing Internet through NAT Gateway.
Step 1: Associating the VPC where the cluster is located to the TCR instance
For your data security, the new TCR instance denies all external access requests by default. To allow the specified TKE Serverless cluster to access the TCR instance to pull the image, you must associate the VPC where the cluster resides to the TCR instance, and configure the corresponding private network domain parsing service.
Step 2: Obtaining a TCR instance access credential
Before pulling container images from a TCR instance, you need to log in to the instance with the credential. For more information, see Obtaining an Instance Access Credential. Keep the long-term access credential of this instance for later configuration and deployment of TCR images.
Using the container image in the TCR instance to create a workload
1. Log in to the TKE console.
2. In the Cluster List, click the ID of the target Serverless cluster to enter the cluster details page.
3. On the Cluster Details page, select Workloads > Deployment on the left side.
4. On the Deployment page, click Create.
5. On the New Deployment page, specify the following parameters to create a workload:
Namespace: Select a namespace in the cluster as needed.
Containers in the Pod:
Image: Click Select Image, select Tencent Container Registry - Enterprise in the pop-up window, and choose the region, instance, and image repository based on your requirements.
Image Version: After selecting the image, click Select Image Version. In the pop-up "Select Image Version" window, select a version of the image repository as needed. If not selected, the default is set to latest.
Image Access Credential: Click Add Image Access Credential, and select Use New Access Credential from the drop-down list.
Click Configure Access Credential Information, and enter the repository domain name, username, and password for the image in the pop-up window.
Repository Domain Name: Log in to the TCR console and click Image Repository in the left sidebar to get the repository address of the required image.
Username: Go to Account Info to get the account ID. The account ID is your username.
Password: The access credential obtained in Step 2 is the password.
Access Settings (Service): Users can deploy various containers in Kubernetes, some of which provide Layer 7 network services through HTTP and HTTPS protocols, while others provide Layer 4 network services through TCP and UDP protocols. Kubernetes-defined Service resources can be used to manage Layer 4 network service access within the cluster. Refer to the following key parameter information to complete the access settings.
Service: Select Enable.
Service Access: Select Via VPC.
6. Click Create Deployment and view the deployment progress.
After the workload is deployed, "Number of Running/Desired Pods" for the workload becomes "1/1" on the Deployment page.