tcr-assistant-oidc 跨账号动态免密拉取配置

{
    "version": "2.0",
    "statement": [
        {
            "action": [
                "tcr:DescribeInstances"
            ],
            "effect": "allow",
            "resource": [
                "qcs::tcr:::instance/tcr-5jm4cabc"
            ]
        },
        {
            "action": [
                "tcr:PullRepository",
                "tcr:PushRepository",
                "tcr:CreateRepository"
            ],
            "effect": "allow",
            "resource": [
                "qcs::tcr:::repository/tcr-5jm4cabc/production-backend/*"
            ]
        }
    ]
}

echo -n '{
 "roleArn": "qcs::cam::uin/100000000000:roleName/your-role-name",
 "registries": ["your-tcr-registry"]
}' | base64

{
    "roleArn": "qcs::cam::uin/100001113387:roleName/tcr-assistant-odic-read-harbor",
    "registries": ["your-tcr-registry"],
    "customDomains": ["docker.mycompany.com"],
    "tokenExpiration": 3600,
    "namespaces": "*",
    "serviceAccounts": "*"
}

resource "tencentcloud_kubernetes_addon" "tcr_assistant_oidc" {
  cluster_id = "cls-xxxxxxxx"  # 替换为您的 TKE 集群 ID
  addon_name = "tcr-assistant-oidc"

  raw_values = jsonencode({
    # CAM 角色 ARN（必填）
    # 格式: qcs::cam::uin/{UIN}:roleName/{ROLE_NAME}
    roleArn = "qcs::cam::uin/100000000000:roleName/your-role-name"

    # TCR 镜像仓库名称列表（必填）
    registries = ["your-tcr-registry"]

    # 目标 namespace（"*" 表示所有，或 "ns1,ns2,ns3"）
    namespaces = "*"

    # 目标 ServiceAccount（"*" 表示所有，或 "sa1,sa2"）
    serviceAccounts = "*"

    # 自定义域名（选填）
    customDomains = ["docker.mycompany.com"]
  })
}

# 确认 Controller Pod 正常运行
kubectl get pods -n tcr-assistant-system
# 预期：Pod 为 Running 状态

# 检查 CR 状态，确认已成功从 A 账号获取临时密钥
kubectl get oips tcr-oidc-public -o yaml
# 关注 status.credentialStatus 应为 Ready

# 确认 imagePullSecret 已分发到目标命名空间
kubectl get secret tcr.ips.tcr-oidc-public -n default \\
  -o jsonpath='{.data.\\.dockerconfigjson}' | base64 -d | jq '.auths | keys'

[
  "your-tcr-registry.tencentcloudcr.com",
  "docker.mycompany.com"
]

kubectl run nginx --image=docker.mycompany.com/my-namespace/nginx:latest

helm install tcr-assistant-oidc ./tcr-assistant-oidc \\
  --namespace tcr-assistant-system --create-namespace \\
  --set roleArn="qcs::cam::uin/100000000000:roleName/your-role-name" \\
  --set "registries={your-tcr-registry}" \\
  --set namespaces="production,staging" \\
  --set serviceAccounts="default,app-sa"

# 检查 Pod 状态和镜像版本
kubectl get pods -n tcr-assistant-system -o wide

# 检查 CR 状态
kubectl get oips tcr-oidc-public -o jsonpath='{.status.credentialStatus}'
# 预期输出：Ready

# 获取凭证
SECRET_JSON=$(kubectl get secret tcr.ips.tcr-oidc-public -n default \\
  -o jsonpath='{.data.\\.dockerconfigjson}' | base64 -d)

# 提取用户名和密码，your-tcr-registry.tencentcloudcr.com 要替换成实际的访问域名
USERNAME=$(echo $SECRET_JSON | jq -r '.auths["your-tcr-registry.tencentcloudcr.com"].username')
PASSWORD=$(echo $SECRET_JSON | jq -r '.auths["your-tcr-registry.tencentcloudcr.com"].password')

# 手动登录 A 账号的 TCR 实例，your-tcr-registry.tencentcloudcr.com 要替换成实际的访问域名。注意访问的客户端机器需要能够正常访问TCR域名。
docker login your-tcr-registry.tencentcloudcr.com --username "$USERNAME" --password "$PASSWORD"