aliyun-acr-credential-helper - Container Service for Kubernetes

You can use the aliyun-acr-credential-helper component to pull private images without a password from instances of Container Registry Enterprise Edition and Personal Edition. This topic describes the features, usage notes, and release notes for aliyun-acr-credential-helper.

Introduction

aliyun-acr-credential-helper retrieves the required information from the acr-configuration ConfigMap that is created in the kube-system namespace and then pulls private images. The following features are supported:

The password-free component currently only supports Container Registry Enterprise Edition and Container Registry Personal Edition instances created on or before September 8, 2024.
You can use aliyun-acr-credential-helper to pull private images from your Container Registry instances. You can also pull private images from other accounts after authorization or using an AccessKey ID and the corresponding AccessKey secret.
You can use aliyun-acr-credential-helper to pull private images from Container Registry instances that are deployed in different regions.

Usage notes

For more information, see Use the aliyun-acr-credential-helper component to pull images without using a secret or Use the aliyun-acr-credential-helper component to pull images without using a password.

Change Log

July 2025

Version	Modification Time	Description	Impact
v25.07.21.1-67f1f51-aliyun	2025-07-21	aliyun-acr-credential-helper: Support for ECS metadata hardening mode only.	This update has no negative impact on workloads.

September 2024

Version	Change Time	Description	Impact
v24.09.05.1-e65351a-aliyun	2024-09-05	aliyun-acr-credential-helper: The issue with the invalid Secret that occasionally occurs in v24.08.01.1-1aa1880-aliyun is fixed.	This update has no negative impact on workloads.

August 2024

Version	Change Time	Description	Impact
v24.08.01.1-1aa1880-aliyun	2024-08-26	Client-side password-free component: Consolidates Secret permissions.	This update has no negative impact on workloads.

May 2024

Version	Modification Time	Description	Impact
v24.01.29.1-5318af4-aliyun	2024-05-10	managed-aliyun-acr-credential-helper: The error handling for failed API calls is fixed.	This update has no negative impact on workloads.

January 2024

Version	Change Time	Description	Impact
v24.01.16.1-aeea43b-aliyun	2024-01-22	aliyun-acr-credential-helper: The error handling for failed API calls is fixed.	This update has no negative impact on workloads.

April 2023

Version	Modification Time	Description	Impact
v23.02.06.2-74e2172-aliyun	2023-04-04	The component do not need to rely on the worker role and can rely on the worker role or managed role.	This update has a negative impact on the usage of the component. For more information, see [Product Changes] Revoke the permissions on which aliyun-acr-credential-helper relies.

March 2023

Version	Change Time	Description	Impact
v23.02.06.1-74e2172-aliyun	2023-03-15	Some known issues are fixed. The RAM Roles for Service Accounts (RRSA) feature is supported for permission management. Service accounts are ready for use after creation when Helm charts are used to install the component. The Intelligent O&M feature can be used to diagnose the aliyun-acr-credential-helper component.	This update has no negative impact on workloads.

March 2022

Version	Change Time	Description	Impact
v22.03.25.1-efe240e-aliyun	2022-03-25	The version conflict that occurs when multiple controllers update a Secret at the same time is fixed. Auto scaling is supported by default node pools.	This update has no negative impact on workloads.

January 2022

Version	Modification Time	Description	Impact
v22.01.04.0-f637776-aliyun	2022-01-04	The Advanced RISC Machine (ARM) architecture is supported. aliyun-acr-credential-helper is no longer automatically installed when you create a cluster. You must manually install aliyun-acr-credential-helper after you create a cluster. The performance of aliyun-acr-credential-helper is improved.	This update has no negative impact on workloads.

November 2021

Version	Modification Time	Description	Impact
v21.11.15.0-19d8bc1-aliyun	2021-11-15	The API version of ClusterRoles is updated.	This update has no negative impact on workloads.

September 2021

Version	Modification Time	Description	Impact
v21.09.22.0-450db22-aliyun	2021-09-22	A cluster event is generated when an error occurs on the component.	This update has no negative impact on workloads.

January 2021

Version	Modification Time	Description	Impact
v21.01.26.0-9ac7d9b-aliyun	2021-01-26	The authentication methods are optimized.	This update has no negative impact on workloads.

August 2020

Version	Release date	Description	Impact
v20.08.20.0-c2da10b-aliyun	2020-08-24	The issue that private images fail to be pulled because the token is expired is fixed.	This update has no negative impact on workloads.

July 2020

Version

Change Time

Description

Impact

v20.07.13.0-2866ccd-aliyun

2020-07-13

New features:

API operations can be called over internal networks.
Images can be pulled using a Secret that contains an AccessKey ID and an AccessKey secret.

Optimization: The required number of API calls to pull an image is reduced.

This update has no negative impact on workloads.

March 2020

Version	Change Time	Description	Impact
v20.03.16.0-36d5d7e-aliyun	2020-03-16	New features: Private images can be pulled from a different account.	This update has no negative impact on workloads.