將傳統的容器登錄升級Upgrade a Classic container registry

有好幾個服務層級 (也就是所謂的 SKU) 會提供 Azure Container Registry (ACR)。Azure Container Registry (ACR) is available in several service tiers, known as SKUs. 初始的 ACR 版本提供了單一 SKU (傳統),該 SKU 缺少基本、標準和進階 SKU (統稱為「受控」登錄) 固有的數種功能。The initial release of ACR offered a single SKU, Classic, that lacks several features inherent to the Basic, Standard, and Premium SKUs (collectively known as managed registries).

傳統 SKU 即將淘汰, 將在2019年4月後無法使用。The Classic SKU is being deprecated, and will be unavailable after April 2019. 本文將詳細說明如何將非受控的傳統登錄移轉至其中一個受控 SKU,以便利用其經過強化的功能集。This article details how to migrate your unmanaged Classic registry to one of the managed SKUs so that you can take advantage of their enhanced feature set.

為何要升級?Why upgrade?

傳統登錄 SKU 即將淘汰, 將在2019 年4月後無法使用。The Classic registry SKU is being deprecated, and will be unavailable after April 2019. 所有現有的傳統登錄都應該在2019年4月之前升級。All existing Classic registries should be upgraded prior to April 2019. 傳統登錄的入口網站管理功能將會被淘汰。建立新的傳統登錄將于2019年4月後停用。Portal management features of Classic registries will be phased out. Creation of new Classic registries will be disabled after April 2019.

基於傳統非受控登錄的已規劃淘汰和有限功能, 所有傳統登錄都應該升級為受控登錄 (Basic、Standard 或 Premium)。Because of the planned deprecation and limited capabilities of Classic unmanaged registries, all Classic registries should be upgraded to managed registries (Basic, Standard, or Premium). 這些較高層級的 SKU 會將登錄更深入整合到 Azure 功能。These higher-level SKUs more deeply integrate the registry into the capabilities of Azure. 如需不同服務層之價格和功能的詳細資訊, 請參閱Container Registry skuFor more information about the pricing and capabilities of the different service tiers, see Container Registry SKUs.

「傳統」登錄依賴您在建立登錄時,Azure 自動佈建在您 Azure 訂用帳戶中的儲存體帳戶。The Classic registry depends on the storage account that Azure automatically provisions in your Azure subscription when you create the registry. 相比之下,基本、標準和進階 SKU 會以透明的方式處理您的映像儲存體來利用 Azure 的進階儲存體功能By contrast, the Basic, Standard, and Premium SKUs take advantage of Azure's advanced storage features by transparently handling the storage of your images for you. 您自己的訂用帳戶中未建立個別儲存體帳戶。A separate storage account is not created in your own subscription.

受控登錄儲存體可提供下列優點:Managed registry storage provides the following benefits:

  • 容器映像是進行待用加密Container images are encrypted at rest.
  • 影像會使用異地多餘的儲存體儲存, 以確保您可以使用多重區域複寫來備份映射 (僅限 Premium SKU)。Images are stored using geo-redundant storage, assuring backup of your images with multi-region replication (Premium SKU only).
  • 自由地在 SKU 之間移動的能力,讓您在選擇較高層級的 SKU 時獲得較高的輸送量。Ability to freely move between SKUs, enabling higher throughput when you choose a higher-level SKU. 運用每個 SKU,ACR 即可在您的需求增加時滿足輸送量需求。With each SKU, ACR can meet your throughput requirements as your needs increase.
  • 適用於登錄和其儲存體的整合安全性模型能提供簡化的權限管理功能。Unified security model for the registry and its storage provides simplified rights management. 您只負責管理容器登錄的權限,而不必還要管理不同儲存體帳戶的權限。You manage permissions only for the container registry, without having to also manage permissions for a separate storage account.

如需 ACR 中映像儲存體的其他相關詳細資料,請參閱 Azure Container Registry 中的容器映像儲存體For additional details on image storage in ACR, see Container image storage in Azure Container Registry.

移轉考量Migration considerations

當您將傳統登錄升級為受控登錄時, Azure 必須將所有現有容器映射從您訂用帳戶中 ACR 建立的儲存體帳戶複製到 Azure 所管理的儲存體帳戶。When you upgrade a Classic registry to a managed registry, Azure must copy all existing container images from the ACR-created storage account in your subscription to a storage account managed by Azure. 視登錄大小而定,此程序所需時間從數分鐘到數小時不等。Depending on the size of your registry, this process can take a few minutes to several hours. 基於估計目的, 每分鐘預期大約 0.5 GiB 的遷移時間。For estimation purposes, expect a migration time of approximately 0.5 GiB per minute.

在轉換過程中, docker push作業會在前 10% 的遷移期間停用。During the conversion process, docker push operations are disabled during the last 10% of the migration. docker pull會繼續正常運作。docker pull continues to function normally.

在轉換過程中,請勿刪除或修改支援傳統登錄之儲存體帳戶的內容。Do not delete or modify the contents of the storage account backing your Classic registry during the conversion process. 如果您這麼做,可能會導致容器映像損毀。Doing so can result in the corruption of your container images.

完成遷移之後, Azure Container Registry 不會再使用您訂用帳戶中原本支援傳統登錄的儲存體帳戶。Once the migration is complete, the storage account in your subscription that originally backed your Classic registry is no longer used by Azure Container Registry. 在確認移轉成功之後,請考慮刪除該儲存體帳戶,以協助將成本降至最低。After you've verified that the migration was successful, consider deleting the storage account to help minimize cost.

重要

從傳統升級為其中一個受控 SKU 是單向程序Upgrading from Classic to one of the managed SKUs is a one-way process. 傳統登錄一旦轉換為基本、標準或進階,就無法還原為傳統。Once you've converted a Classic registry to Basic, Standard, or Premium, you cannot revert to Classic. 不過,您可以在容量足供登錄使用的受控 SKU 之間自由地移動。You can, however, freely move between managed SKUs with sufficient capacity for your registry.

如何升級How to upgrade

您可以透過數種方式將非受控的傳統登錄升級為其中一個受控 SKU。You can upgrade an unmanaged Classic registry to one of the managed SKUs in several ways. 在下列各節中, 我們將說明使用Azure CLIAzure 入口網站的程式。In the following sections, we describe the process for using the Azure CLI and the Azure portal.

在 Azure CLI 中升級Upgrade in Azure CLI

若要升級 Azure CLI 中的傳統登錄, 請執行az acr update命令並指定登錄的新 SKU。To upgrade a Classic registry in the Azure CLI, execute the az acr update command and specify the new SKU for the registry. 在下列範例中,名為 myclassicregistry 的傳統登錄會升級為進階 SKU:In the following example, a Classic registry named myclassicregistry is upgraded to the Premium SKU:

az acr update --name myclassicregistry --sku Premium

當移轉完成時,您應該會看到類似下面的輸出。When the migration is complete, you should see output similar to the following. 請注意, storageAccount null是 "Premium", 而是, 表示 Azure 現在會管理此登錄的sku映射儲存體。Notice that the sku is "Premium" and the storageAccount is null, indicating that Azure now manages the image storage for this registry.

{
  "adminUserEnabled": false,
  "creationDate": "2017-12-12T21:23:29.300547+00:00",
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myresourcegroup/providers/Microsoft.ContainerRegistry/registries/myregistry",
  "location": "eastus",
  "loginServer": "myregistry.azurecr.io",
  "name": "myregistry",
  "provisioningState": "Succeeded",
  "resourceGroup": "myresourcegroup",
  "sku": {
    "name": "Premium",
    "tier": "Premium"
  },
  "status": null,
  "storageAccount": null,
  "tags": {},
  "type": "Microsoft.ContainerRegistry/registries"
}

如果您指定之受控登錄 SKU 的最大容量小於傳統登錄的大小,您會收到類似下面的錯誤訊息。If you specify a managed registry SKU whose maximum capacity is less than the size of your Classic registry, you'll receive an error message similar to the following.

Cannot update the registry SKU due to reason: Registry size 12936251113 bytes exceeds the quota value 10737418240 bytes for SKU Basic. The suggested SKU is Standard.

如果您收到類似的錯誤, 請再次執行az acr update命令並指定建議的 sku, 這是可容納您映射的下一個最高層級 sku。If you receive a similar error, run the az acr update command again and specify the suggested SKU, which is the next-highest level SKU that can accommodate your images.

在 Azure 入口網站中升級Upgrade in Azure portal

當您使用 Azure 入口網站升級傳統登錄時, Azure 會自動選取 [標準] 或 [Premium] SKU, 視哪一個 SKU 可容納您的映射而定。When you upgrade a Classic registry by using the Azure portal, Azure automatically selects either the Standard or Premium SKU, depending on which SKU can accommodate your images. 例如, 如果您的登錄在映射中包含少於100的 GiB, Azure 就會自動選取並將傳統登錄轉換成標準 (100 GiB 最大值)。For example, if your registry contains less than 100 GiB in images, Azure automatically selects and converts the Classic registry to Standard (100 GiB maximum).

若要使用 Azure 入口網站來為傳統登錄升級,請瀏覽至容器登錄 [概觀],然後選取 [升級為受控登錄]。To upgrade your Classic registry by using the Azure portal, navigate to the container registry Overview and select Upgrade to managed registry.

Azure 入口網站 UI 中的傳統登錄升級按鈕

選取 [確定] 以確認您要升級為受控登錄。Select OK to confirm that you want to upgrade to a managed registry.

在移轉期間,入口網站會指出登錄的 [佈建狀態] 是 [更新中]。During migration, the portal indicates that the registry's Provisioning state is Updating. 如先前所述docker push , 作業會在前 10% 的遷移期間停用。As mentioned earlier, docker push operations are disabled during the last 10% of the migration. 當遷移進行中時, 請勿刪除或更新傳統登錄所使用的儲存體帳戶--這麼做可能會導致映射損毀。Do not delete or update the storage account used by the Classic registry while the migration is in progress--doing so can result in image corruption.

Azure 入口網站 UI 中的傳統登錄升級進度

當遷移完成時, 布建狀態會指出 [成功], 而且您可以使用登錄繼續正常操作。When the migration is complete, the Provisioning state indicates Succeeded, and you can resume normal operations with your registry.

Azure 入口網站 UI 中的傳統登錄升級完成狀態

後續步驟Next steps

將傳統登錄升級為受控登錄之後, Azure 就不再使用原本支援傳統登錄的儲存體帳戶。Once you've upgraded a Classic registry to a managed registry, Azure no longer uses the storage account that originally backed the Classic registry. 若要降低成本,請考慮刪除儲存體帳戶或帳戶內包含舊容器映像的 Blob 容器。To reduce cost, consider deleting the storage account or the Blob container within the account that contains your old container images.