The AI artifact repository supports mounting TOS to achieve storage acceleration for AI artifacts. This document explains how to implement AI repository mounting.

Prerequisites

Have registered a Volcano Engine root user and activated the artifact repository Service.

A repository instance has been created. For details, refer to Creating basic edition instances.

An AI-format artifact repository has been created. For details, please refer to Creating AI repositories.

An IAM user has been created, and TOS product authorization has been completed. For details, please refer to User management and Permission configuration.

Procedure

Step 1: Configure IAM permissions

Before mounting the AI artifact repository, IAM sub-user authorization must first be completed. You can authorize all package permissions in the repository for a specified IAM user or authorize permissions for specific repositories or packages.

Grant permissions for all packages to an IAM user

Log in to the IAM Access Console.

In the left navigation bar, select Identity Management > Users.

In the user list, select the target IAM user, and click Manage in the Actions column.

In the User Management interface, select Permissions > Global Permissions tab, click Add Permission, and then select the artifact repository permissions as needed.

Click Confirm.

Grant permissions for specific repositories/artifacts to an IAM user

Log in to the IAM Access Console.

In the left navigation bar, select Policy Management, choose the Custom Policy tab, and click Create Custom Policy to configure a custom policy for the artifact repository.

In the left navigation bar, select Identity Management > Users.

In the user list, select the target IAM user, and click Manage in the Actions column.

In the User Management interface, select Permissions > Global Permissions tab, click Add Permission, and then select the artifact repository permissions as needed.

Select the JSON Editor tab, and edit the policy according to the following descriptions and examples.

Configure Actions.

Module	action	Description
/	artifact:*	Allows all actions.
Read	artifacts:Get*	Allows viewing package information on the artifact repository web page. (Required permission; without this permission, the artifact repository cannot function properly).
			artifacts:List*
		artifacts:pull	Allows downloading packages. (Required permission. Without it, packages cannot be downloaded).
Write	artifacts:push	Allows uploading packages.
Delete	artifacts:delete	Allows deleting packages via curl/SDK.
		artifacts:Delete*	Allows all deletion actions on the artifact repository web page.
		artifacts:DeleteAsset	Allows deleting packages on the artifact repository web page.
		artifacts:DeleteComponent	Allow deleting package add-ons on the artifact repository web page.
		artifacts:DeleteDirectory	Allows deleting directories on the artifact repository web page.
Access control	artifacts:*Credential	Allows reading/creating/modifying/deleting access credentials.
Access control		artifacts:*MountPolicy	Allow reading/creating/modifying/deleting repository mounting configurations.
Repository Management	artifacts:*Repository	Allows all registry management operations.
		artifacts:CreateRepository	Allows creating repositories.
		artifacts:DeleteRepository	Allows deleting repositories.
Instance management	artifacts:*Instance	Allows all instance management operations.
		artifacts:CreateBasicInstance	Allows creating Basic Edition instances.
		artifacts:DestroyInstance	Allows deleting instances.

Configure Resources.

The resource definition formula and description in the artifact repository are as follows:

"trn:artifact::{AccountID}:component/{instance}/{repository}/{path}"

Example 1: Grant full permissions for all packages in the artifacts-basic instance.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"artifact:*"
],
"Resource": [
"trn:artifact::21000***:component/artifacts-basic/*/*"
]
}
]
}

Example 2: Grant ReadOnly permissions for all packages in the ai-test repository.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"artifacts:Get*",
"artifacts:List*",
"artifacts:pull",
"artifacts:*Credential"
],
"Resource": [
"trn:artifact::21000***:component/*/ai-test/*"
]
}
]
}

Example 3: Grant full permissions for content under the models/ns1 path in the ai-test repository.

{
"Statement": [
{
"Effect": "Allow",
"Action": [
"artifact:*"
],
"Resource": [
"trn:artifact::21000***:component/*/ai-test/models/ns1/*"
]
}
]
}

In the left navigation bar, select Identity Management > Users.

In the user list, select the target IAM user, and click Manage in the Actions column.

In the User Management interface, select Permissions > Global Permissions tab, click Add Permission, and then check the custom permission.

Click Confirm.

Step 2: Configure mounting permissions

Log in to the Artifact repository console.

In the left navigation bar, select Instances. In the Instances area on the right page, click to enter the artifact repository instance.

At the top of the left navigation bar, select the AI package format from the drop-down menu, and then in the menu bar, choose Access Settings.

Select the Repository Mounting Configuration tab, click Add Repository Mounting Configuration, and proceed to configure the repository mounting.

Parameter	Description
Repository	Configures the artifact repository that requires mounting.
IAM User	Configure the IAM user to which mount permissions are granted. Multiple IAM users can be selected.
Permissions	The default permission is Read-nly and cannot be modified.
Description	Provides descriptive information for the mounting rules.

Click Confirm.

Step 3: Mount TOS storage bucket

After the AI repository finishes mounting TOS, you can mount the TOS storage bucket on Windows/Linux systems. The procedure is as follows:

Obtain the AK and SK of the IAM user with mounting permissions.

From the View Results section, obtain the TOS bucket and S3 Endpoint associated with the AI artifact repository. For information on how to obtain the S3 Endpoint, please refer to Regions and Access Domain Name (Endpoints).

Mount the TOS bucket on Windows/Linux system.

For Linux systems, please refer to Mounting a TOS bucket on a Linux system.

For Windows systems, please refer to Mounting a TOS bucket on a Windows system.

View results

After the repository mounting configuration is complete, select the package management tab in the left navigation bar. Select the target repository and click TOS Information to view the TOS mounting information of the AI repository.

Container Registry