Obtaining a Long-Term Login or Image Push/Pull Command

1. Log in to the IAM console as an administrator.
2. Click in the upper left corner and select a region and a project.
3. In the user list, search for the user you want to grant programmatic access to.
4. Click the user to go to its details page. Click next to Access Type. Select Programmatic access. (You can also select both.)
   Figure 1 Changing the access type
   

Ensure that you have permission to access the IAM service. For details about the authorization, see Creating a User Group and Assigning Permissions.

1. Log in to the IAM console, hover the cursor over the username, and click My Credentials.
2. In the navigation pane, choose Access Keys and click Create Access Key.
3. Enter a description, and click OK.
4. In the displayed dialog box, click Download.
5. After the credential is downloaded, obtain the AK and SK from the credentials.csv file.

   Table 3 Example of credentials.csv

   Username	Access Key ID	Secret Access Key
   a*****	RVHVMX******	H3nPwzgZ******

   

   Each credential file can be downloaded only once. Keep it secure.

1. Log in to the IAM console.
2. Hover the cursor over the username in the upper right corner.
3. Choose My Credentials from the drop-down list.
4. In the project list, find the region and project your VM belongs to.
   Figure 2 Region and project
   

printf "$AK" | openssl dgst -binary -sha256 -hmac "$SK" | od -An -vtx1 | sed 's/[ \n]//g' | sed 'N;s/\n//'

Replace AK with the access key ID and SK with the secret access key in the credentials file obtained in 2.

Example:

printf "RVHVMX******" | openssl dgst -binary -sha256 -hmac "H3nPwzgZ******" | od -An -vtx1 | sed 's/[ \n]//g' | sed 'N;s/\n//'

After the command is executed, the following login key is obtained:

cab4ceab4a1545***************

The login key is an example only.

docker login -u [project-name]@[AK] -p [login-key] [image-registry-address]

The project name and registry address are obtained in 5, the AK in 2, and the login key in 6.

Example:

docker login -u ap-southeast-3@RVHVMX****** -p cab4ceab4a1545*************** swr.ap-southeast-3.myhuaweicloud.com

If "Login Succeeded" is displayed, the login is successful.

• The login key is encrypted and cannot be decrypted. So, other users cannot obtain your SK from -p.
• The login command can be executed on other Docker clients.

cd /root/.docker/
rm -f config.json

1. Log in to the IAM console as an administrator.
2. Click in the upper left corner and select a region and a project.
3. In the user list, search for the user you want to grant programmatic access to.
4. Click the user to go to its details page. Click next to Access Type. Select Programmatic access. (You can also select both.)
   Figure 3 Changing the access type
   

Ensure that you have permission to access the IAM service. For details about the authorization, see Creating a User Group and Assigning Permissions.

1. Log in to the IAM console, hover the cursor over the username, and click My Credentials.
2. In the navigation pane, choose Access Keys and click Create Access Key.
3. Enter a description, and click OK.
4. In the displayed dialog box, click Download.
5. After the credential is downloaded, obtain the AK and SK from the credentials.csv file.

   Table 4 Example of credentials.csv

   Username	Access Key ID	Secret Access Key
   a*****	RVHVMX******	H3nPwzgZ******

   

   Each credential file can be downloaded only once. Keep it secure.

1. Log in to the IAM console.
2. Hover the cursor over the username in the upper right corner.
3. Choose My Credentials from the drop-down list.
4. In the project list, find the region and project your VM belongs to.
   Figure 4 Region and project
   
5. Use the project information you obtained to generate an image registry address in the format of swr.project-name.myhuaweicloud.com.

   For example, if the VM of user a***** belongs to AP-Singapore, the image registry address will be swr.ap-southeast-3.myhuaweicloud.com.

printf "$AK" | openssl dgst -binary -sha256 -hmac "$SK" | od -An -vtx1 | sed 's/[ \n]//g' | sed 'N;s/\n//'

Replace AK with the access key ID and SK with the secret access key in the credentials.csv file in 2.

Example:

printf "RVHVMX******" | openssl dgst -binary -sha256 -hmac "H3nPwzgZ******" | od -An -vtx1 | sed 's/[ \n]//g' | sed 'N;s/\n//'

After the command is executed, the following login key is obtained:

cab4ceab4a1545***************

The login key is an example only.

1. Image pull command

ctr image pull --user [project-name]@[AK]:[login-key] [image-repository-address]/{organization-name}/{image-name}:{tag}

In the command, the project name and image registry address are obtained in 3, the AK is the Access Key Id field in the credentials.csv file obtained in 2, and the login key is the execution result in 4.

2. Image push command

ctr image push --user [project-name]@[AK]:[login-key] [image-repository-address]/{organization-name}/{image-name}:{tag}

In the command, the project name and image registry address are obtained in 3, the AK is the Access Key Id field in the credentials.csv file obtained in 2, and the login key is the execution result in 4.

• The login key is encrypted and cannot be decrypted into an SK.
• The commands can be executed on other servers running containerd to pull and push images.