How to enable cross-service authorization for IAM users?--Container Registry-Volcengine

Docs

Docs Console

Container Registry

Document

Container Registry

Document

Container Registry (CR)

What's new

Release notes

Overview

What is Container Registry

Benefits

Features

Application scenarios

Terms

Server-launching Region

Limit

Billing

Billing Overview

Comparison of Instance Specifications

Billing item

Instance Costs

Proxy Cache Registry Cost

Origin Pull Traffic Cost

Traffic Cost

Storage Capacity fee

Namespace Quota

OCI Artifact Repository Quota Cost

VPC access quota

Bill Splitting by Projects

Bill Splitting by Tags

View Container Registry Instances by Tags

Switching from Pay-as-You-Go to Mixed Billing (Partial Subscription)

Arrears

Getting started

Pushing and Pulling Images Using Docker

Pushing and Pulling Images Using Nerdctl

Pushing and Pulling Helm Charts

Build images using a pipeline and push them to the Container Registry

User guide

Standard Edition instance

Authorization management

Authorize IAM users

Add a custom policy

Add project authorization

Authentication

Grant push and pull permissions for images in a specified namespace

Grant all management permissions to the specified namespace

Instance management

Creating a Standard Edition Instance

Initialize an instance

Standard Edition instance access credentials

Enable public network access

Add an allowlist for public network access

Connect this account's VPC

Connect cross-product VPCs

Connect cross-account VPCs

Image security scanning

Manage Standard Edition instances

Increase the instance quota

Configure resource capacity alerts

Destroy mixed billing instances pending payment

Namespace management

OCI artifact repository management

Create an OCI artifact repository

View OCI artifact repository

Modify an OCI artifact repository

Delete OCI artifact repository

OCI artifact management

Pulling and pushing images for Standard Edition instances

Pull and push Helm charts for Standard Edition instances

Bulk modify the public or private type of OCI artifacts

View image layer details

Domain name management

Create a custom domain name

Manage custom domain names

View TrafficRoute resolution records

Add resolution records for public network access

Set the default domain name

Registry replication

Synchronize images within the same region or across regions

Synchronize images to a custom repository

Synchronize external repositories to CR

Managing registry replication

P2P acceleration

Overview of P2P Acceleration

Volcengine Kubernetes Engine uses P2P acceleration

Volcengine Container Instance uses P2P acceleration

Image lazy loading

Creating Conversion Rules for Image Lazy Loading

Manage image lazy loading conversion rules

Manually convert an image to Nydus format

Tag retention rules management

Create tag retention rules

Manage version retention rules

View rule execution records

Event notification

Create image push notification rules

Manage notification rules

Tag immutability rule management

Create a tag immutability rule

Manage the tag immutability rule

Robot account management

Create a robot account

Manage robot accounts

Audit log management

Enable audit log

Manage audit logs

View the image instance log report

Using Container Registry with Terraform

Creating a Standard Edition Instance

Obtain a temporary key for a login instance

Obtain VPC endpoint information

Update VPC access points

Micro Edition instance

Authorization management

Authorize IAM users

Custom policies

Authentication

Instance management

Create a Micro Edition instance

Access credentials for Micro Edition instances

View the Micro Edition instances overview

Upgrade a Micro Edition instance to a Standard Edition instance

Destroy pending-payment mixed billing instances

Registry replication

Synchronize external repositories to Micro Edition instances

OCI artifact management

Use Micro Edition instances to push and pull images

Use Micro Edition instances to push and pull Helm Charts

Bulk modify OCI artifact visibility

Tag immutability rule management

Create a tag immutability rule

Manage the tag immutability rule

Version retention rules management

Namespace management

OCI artifact repository management

Proxy cache registry

Proxy cache registry management

Create a proxy cache registry (Docker Hub or GHCR type)

Create a proxy cache registry (Docker Registry type)

Initialize a proxy cache registry

Proxy cache registry access credentials

Enable public network access

Add a public network access allowlist

Connect this account's VPC

Connect cross-product VPCs

Cross-account VPC connectivity

Manage proxy cache registry

Pull the proxy cache registry via a dedicated line

Upgrade the Micro Edition proxy cache registry to the Standard Edition

Set a resource capacity alert

Namespace management

OCI artifact management

Pull images from the proxy cache registry

Pull Helm Chart from proxy cache registry

Batch modify the public/private type of OCI artifacts

View image layer details

OCI artifact repository management

Modify OCI artifact repository

Delete OCI artifact repository

Domain name management

Create a custom domain name

Manage custom domain names

View TrafficRoute resolution records

Add resolution records for public access

Set the default domain name

Tag retention rules management

Create version retention rules

Manage tag retention rules

View rule execution records

Robot account management

Create a robot account

Manage robot accounts

Audit log management

Enable the audit log

Manage audit logs

How to handle proxy cache registries in an abnormal proxy state?

Best practices

Optimize the Dockerfile

Clean up image tags

Image push and pull

Pull Docker Hub official images via proxy cache registry domain name

Pull non-official Docker images from Docker Hub via the proxy cache registry domain name

Pull an official Docker Hub image via the Docker Hub domain name

Pull unofficial Docker images via the Docker Hub domain name

Pull an instance of the CR Standard Edition image in a local environment

Use the VKE component to pull images over the internal network without a password

Push and pull images using Nerdctl

Push images in the Flannel network cluster

Push images across borders to the Volcano Engine Container Registry

Image migration and synchronization

Migrate images in batches using cr-image-syncer

Synchronization of Image Data Across Multiple Platforms

Migration plan for Container Registry Trial Edition to Standard Edition

Push images from Harbor to Volcano Engine Container Registry (Harbor 2.11 and later)

Push images from Harbor to Volcano Engine Container Registry (Harbor versions below 2.11)

Pull images into Harbor from the Volcano Engine Container Registry

DevOps delivery

Cloud-Native DevOps Based on Continuous Delivery

Image distribution acceleration

Accelerate image push to overseas locations

Container Image Distribution and Startup Acceleration Based on Zstd Compression Algorithm

FAQ

Authorization

How to enable cross-service authorization for IAM users?

How to handle an AccessDenied Code:403 issue?

VPC

How can I view the private domain name and the network interface automatically created when creating a private network VPC?

How to delete private domain names and network interfaces that are created when you create a private network VPC?

Image push and pull

How to upgrade a Trial Edition instance to a Standard Edition instance

How to handle image pull failures?

How to handle a failed image push?

How to address slow image push to the public network caused by proxy settings

What should you do when the image tag (Tag) limit is exceeded?

Limits

How can I expand the quota?

How to handle the "pull QPS exceeded" error reported after Pod startup?

How to apply to use the beta feature?

Registry replication

How do I handle the TOOMANYREQUESTS error during registry replication in Docker Hub?

How to restore the registry replication rule after deleting the source instance namespace?

How to handle the error when the quota of ReplicationRule is exceeded?

P2P acceleration

After enabling P2P acceleration and disabling VPC Identity and Access Management, what should I do if image pull fails?

Access control

How to handle Docker login failures?

Why does domain name resolution fail for a Container Registry Instance?

How can I troubleshoot being unable to access the Container Registry from the public network?

Billing

API

Calling Method

Instance Management

User Management

Namespace Management

OCI Artifact Repository Management

OCI Artifact Version Management

ListTags

DeleteTags

Domain Management

ListDomains

Access Endpoint Management

CreateEndpointAclPolicies

DeleteEndpointAclPolicies

Temporary Access Key

GetAuthorizationToken

Robot Account Management

CreateRobotAccount

ListRobotAccounts

UpdateRobotAccount

UpdateRobotAccountPassword

DeleteRobotAccount

General Data Structure

Request data structure

Response data structure

SDK

Artifact repository AR

What's new

Release notes

Product announcement

[Product alteration] Product sale adjustment announcement

Product overview

What is an artifact repository

Benefits

Application scenarios

Getting started

Upload and download Maven-format packages

Upload and download generic format packages

Upload and download PyPI packages

Upload and download NPM packages

Upload and download packages in AI format

User guide

Instance management

Creating a Basic Edition instance

Managing repository instances

Repository Management

Repository overview

Creating a repository

Creating a Maven repository

Creating a Generic repository

Creating a PyPI repository

Creating an NPM repository

Creating AI repository

Managing repositories

Access control

Permanent access credentials

Configuring permanent access credentials

Managing permanent access credentials

Temporary access credentials

Configuring temporary access credentials

Managing temporary access credentials

Maven package management

Configuring local credentials

Uploading packages

Uploading packages (console)

Upload packages (command line)

Downloading packages

Download packages (console)

Downloading packages (command line)

Managing packages

Searching for packages

Package recommendations

Generic package management

Uploading packages

Uploading packages (console)

Upload packages (command line)

Downloading packages

Download packages (console)

Downloading packages (command line)

Managing packages

Searching for packages

PyPI package management

Uploading packages

Uploading packages (console)

Upload packages (command line)

Downloading packages

Download packages (console)

Downloading packages (command line)

Managing packages

Searching for packages

NPM package management

Uploading packages

Upload packages (command line)

Downloading packages

Download packages (console)

Downloading packages (command line)

Managing packages

Searching for packages

AI package management

Uploading packages

Uploading packages (console)

Upload packages (command line)

Downloading packages

Download packages (console)

Downloading packages (command line)

Managing packages

Searching for packages

AI repository mounting and storage acceleration

Permission management

Permission overview

System-preset Policies

API Reference

call method

Repository Management

CreateArtifactRegistry

ListArtifactRegistries

DeleteArtifactRegistry

Package management

Version Management

File Management

User management

Temporary Key Management

GetAuthorizationToken

General Data Structure

Request data structure

Response data structure

FAQ

How to resolve the "PKIX path building failed" error?

Maven repository cannot fetch packages

Terms

Service-Specific Terms for Container Registry

Service Level Agreement for the Container Registry

Documentation

Container Registry

Container Registry (CR)

FAQ

Authorization

How to enable cross-service authorization for IAM users?

Copy page

Download PDF

Authorization

How to enable cross-service authorization for IAM users?

Copy page

Download PDF

How to enable cross-service authorization for IAM users?

Last updated: 2025.08.29 11:40:43

Public security network record in Beijing: No. 11010802032137