You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-registry/container-registry-transfer-images.md
+31-34Lines changed: 31 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,62 +2,59 @@
2
2
title: Transfer images
3
3
description: Transfer images in bulk from one container registry to another registry by creating a transfer pipeline using Azure storage accounts
4
4
ms.topic: article
5
-
ms.date: 03/31/2020
5
+
ms.date: 04/03/2020
6
6
ms.custom:
7
7
---
8
8
9
9
# Transfer images to another registry
10
10
11
-
This article shows how to transfer images or other registry artifacts in bulk from one Azure container registry to another registry. The source and target registries can be in the same or different subscriptions, or potentially in different Active Directory tenants or Azure clouds.
11
+
This article shows how to transfer images or other registry artifacts in bulk from one Azure container registry to another registry. The source and target registries can be in the same or different subscriptions, or potentially different Active Directory tenants or Azure clouds.
12
12
13
13
To transfer images, you create a transfer *pipeline*:
14
14
15
15
* Create source and target storage resources, and store storage access secrets in Azure key vaults
16
-
* Create and run a registry resource to export images to the source storage account
16
+
* Create and run a resource that exports images to the source storage account
17
17
* Copy images from the source storage account to the target storage account
18
-
* Create a registry resource to import images to the target registry. You can set up the import pipeline to trigger whenever images are in the source storage account
18
+
* Create a resource that imports images to the target registry. You can set up the import pipeline to trigger whenever images are in the source storage account
19
19
20
-
Transferring registry images offers a more general, scalable alternative to [importing images](container-registry-import-images.md) from one container registry to another.
20
+
Transferring registry images is a more general, scalable alternative to [importing images](container-registry-import-images.md) from one container registry to another.
21
21
22
22
In this article, you use the Azure CLI and Azure Resource Manager templates to create the resources and transfer pipeline. If you'd like to use the Azure CLI locally, you must have Azure CLI version **XXX** or later installed and logged in with [az login][az-login]. Run `az --version` to find the version. If you need to install or upgrade the CLI, see [Install Azure CLI][azure-cli].
23
23
24
24
This feature is available in the **Premium** container registry service tier. For information about registry service tiers and limits, see [Azure Container Registry SKUs](container-registry-skus.md).
25
25
26
-
27
26
## Prerequisites
28
27
29
-
***Container registries** - For this scenario you need an existing source registry with images to transfer, and a target registry. The source and target registry can be in the same or a different Azure subscription. For the steps in article, the registries must be in the same Active Directory tenant. If you need to create a registry, see [Quickstart: Create a private container registry using the Azure CLI](container-registry-get-started-cli.md).
30
-
***Storage accounts** - Create source and target storage accounts in the same Azure subscriptions as your source and target registries. If needed, create the storage accounts with the [Azure CLI](../storage/common/storage-account-create.md?tabs=azure-cli) or other tools.
31
-
32
-
[TODO: Needed to create source and target blob containers??]
33
-
34
-
***Key vaults** Create key vaults to store secrets in the same Azure subscriptions as your source and target registries. If needed, create source and target key vaults with the [Azure CLI](../key-vault/quick-create-cli.md) or other tools.
28
+
***Container registries** - For this scenario you need an existing source registry with images to transfer, and a target registry. The source and target registries can be in the same or a different Azure subscription. The steps in this article assume that the registries are in the same Active Directory tenant. If you need to create a registry, see [Quickstart: Create a private container registry using the Azure CLI](container-registry-get-started-cli.md).
29
+
***Storage accounts** - Create source and target storage accounts in the same Azure subscription or subscriptions as your source and target registries. If needed, create the storage accounts with the [Azure CLI](../storage/common/storage-account-create.md?tabs=azure-cli) or other tools. In each account, create a blob container for image transfer. For example, create a container named *transfer*
30
+
***Key vaults** Create key vaults to store secrets in the same Azure subscription or subscriptions as your source and target registries. If needed, create source and target key vaults with the [Azure CLI](../key-vault/quick-create-cli.md) or other tools.
35
31
36
32
## Scenario overview
37
33
38
-
You create the following three resources for ACR Transfer. All are created using PUT operations.
34
+
You create the following three resources for ACR Transfer. All are created using PUT operations. These resources operate on two storage accounts:
39
35
40
-
***ExportPipeline** - Long-lasting resource that contains high level target information, such as storage blob container URI and the key vault secret URI of the target storage SAS token.
41
-
***ImportPipeline** - Long lasting resource that contains high level source info, such as storage blob container URI and the KV secret URI of the source storage SAS token. Source trigger is enabled by default so the pipeline will run automatically when artifacts land in the source storage container.
36
+
* A *source* storage account, where images from the source registry get exported
37
+
* A *target* storage account, from which images are imported to the target registry
38
+
39
+
***ExportPipeline** - Long-lasting resource that contains high-level information about the the *source* storage account. This information includes the storage blob container URI and the key vault secret URI of the storage SAS token.
40
+
***ImportPipeline** - Long-lasting resource that contains high-level information about the *target* storage account. This information includes the storage blob container URI and the key vault secret URI of the storage SAS token. An import trigger is enabled by default, so the pipeline runs automatically when artifacts land in the target storage container.
42
41
***PipelineRun** Resource used to invoke either an ExportPipeline or ImportPipeline resource.
43
42
44
-
An ExportPipeline must be run manually by creating a PipelineRun resource. When you run the ExportPipeline, you specify the artifacts to be exported.
43
+
You run the ExportPipeline manually by creating a PipelineRun resource. When you run the ExportPipeline, you specify the artifacts to be exported.
45
44
46
-
If a source trigger is enabled, an ImportPipeline runs automatically. It can also be run manually using a PipelineRun.
45
+
If an import trigger is enabled, an ImportPipeline runs automatically. It can also be run manually using a PipelineRun.
47
46
48
-
### Alternate scenarios
49
-
* The ImportPipeline and ExportPipeline may be located in different tenants. In this case, you need separate managed identities and key vaults for the export and import resources.
47
+
### Things to know
48
+
* The ImportPipeline and ExportPipeline may be located in different Active Directory tenants, or different Azure clouds. If run in different tenants or clouds, you need separate managed identities and key vaults for the export and import resources.
50
49
* ExportPipelines and ImportPipelines also support system-assigned identities. In this case, assign the identity permissions to your key vault after the export resource is created and before running.
51
50
52
51
## Create and store SAS tokens
53
52
54
-
Transfer uses shared access signature (SAS) tokens to export to and import from storage accounts. The properties required to create SAS tokens are detailed below.
55
-
56
-
[TODO: Create containers, generate tokens at container level?]
53
+
Transfer uses shared access signature (SAS) tokens to export to and import from the designated storage accounts. The properties required to create SAS tokens are detailed below.
57
54
58
55
### SAS token for export
59
56
60
-
Generate a SAS token for export in the source storage account.
57
+
Generate a SAS token for export to the source storage account.
61
58
62
59
SAS properties:
63
60
***Allowed services** - Blob
@@ -85,7 +82,7 @@ az keyvault secret set \
85
82
86
83
### SAS token for import
87
84
88
-
Generate a SAS token for import in the target storage account.
85
+
Generate a SAS token for import from the target storage account.
89
86
90
87
SAS properties:
91
88
***Allowed services** - Blob
@@ -101,7 +98,7 @@ Copy the generated SAS token and use it to set the IMPORT_SAS environment variab
101
98
```console
102
99
IMPORT_SAS='?sv=2019-02-02&...'
103
100
104
-
Store the SAS token in your target Azure key vault using [az keyvault secret set][az-keyvault-secret-set]:
101
+
Store the SAS token in your target Azure key vault using [az keyvault secret set][az-keyvault-secret-set] command:
105
102
106
103
```azurecli
107
104
az keyvault secret set \
@@ -149,7 +146,7 @@ targetResourceID=$(az identity show \
149
146
150
147
## Grant each identity access to key vault
151
148
152
-
Run the [az keyvault set-policy][az-keyvault-set-policy] command to grant each identity access to the respective key vault:
149
+
Run the [az keyvault set-policy][az-keyvault-set-policy] command to grant the source and target identities access to their respective key vaults:
153
150
154
151
```azurecli
155
152
# Source key vault
@@ -169,7 +166,7 @@ az keyvault set-policy --name targetkeyvault \
169
166
170
167
### Create the ExportPipeline resource
171
168
172
-
Create an ExportPipeline resource in your source container registry using Azure Resource Manager template deployment. The ExportPipeline resource is provisioned with the user-assigned identity you created previously.
169
+
Create an ExportPipeline resource for your source container registry using Azure Resource Manager template deployment. The ExportPipeline resource is provisioned with the source user-assigned identity you created previously.
173
170
174
171
Copy ExportPipeline Resource Manager template files from [here](add link - TBD).
@@ -200,24 +197,24 @@ az group deployment create \
200
197
201
198
## Transfer blob (optional)
202
199
203
-
Copy the blob to the target storage account using the AzCopy command. See [Copy blobs between storage accounts](/storage/common/storage-use-azcopy-blobs.md#copy-blobs-between-storage-accounts).
200
+
Use the AzCopy command to copy the blob from the source storage account to the target storage account. See [Copy blobs between storage accounts](/storage/common/storage-use-azcopy-blobs.md#copy-blobs-between-storage-accounts).
204
201
205
202
[TODO: What does the AzCopy command look like? Is it the `azcopy sync` shown below?]
206
203
207
-
Synchronize the source and target storage containers:
204
+
The following `azcopy sync` command ynchronizes the transfer containers in the source and target storage accounts:
Create an ImportPipeline resource in your target container registry using Azure Resource Manager template deployment. The ImportPipeline resource is provisioned with the user-assigned identity you created previously.
217
+
Create an ImportPipeline resource in your target container registry using Azure Resource Manager template deployment. The ImportPipeline resource is provisioned with the target user-assigned identity you created previously. By default, the pipeline is triggered to import automatically when the target storage account has images.
221
218
222
219
Copy ImportPipeline Resource Manager template files from [here](add link - TBD).
0 commit comments