Kubernetes 无法从 docker 拉取私有镜像

Question

我希望有人能帮助我。我想拉一个私人码头工人的形象，但没有成功。我已经尝试了一些我找到的解决办法，但都没有成功。

Docker, Gitlab, Gitlab- runner, Kubernetes都运行在同一台服务器上

不安全的注册表

$ sudo cat /etc/docker/daemon.json
{ "insecure-registries":["10.0.10.20:5555"]}

json

$ cat .docker/config.json
{
"auths": {
"10.0.10.20:5555": {
"auth": "NDUwNjkwNDcwODoxMjM0NTZzIQ=="
},
"https://index.docker.io/v1/": {
"auth": "NDUwNjkwNDcwODpGcGZHMXQyMDIyQCE="
}
}
}

秘密

$ kubectl create secret generic regcred 
--from-file=.dockerconfigjson=~/.docker/config.json 
--type=kubernetes.io/dockerconfigjson

我正在尝试从私有docker映像创建Kubernetes pod。但是，我得到以下错误:

Name:         private-reg
Namespace:    default
Priority:     0
Node:         10.0.10.20
Start Time:   Thu, 12 May 2022 12:44:22 -0400
Labels:       <none>
Annotations:  <none>
Status:       Pending
IP:           10.244.0.61
IPs:
IP:  10.244.0.61
Containers:
private-reg-container:
Container ID:
Image:          10.0.10.20:5555/development/app-image-base:latest
Image ID:
Port:           <none>
Host Port:      <none>
State:          Waiting
Reason:       ErrImagePull
Ready:          False
Restart Count:  0
Environment:    <none>
Mounts:
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-stjn4 (ro)
Conditions:
Type              Status
Initialized       True
Ready             False
ContainersReady   False
PodScheduled      True
Volumes:
kube-api-access-stjn4:
Type:                    Projected (a volume that contains injected data from multiple sources)
TokenExpirationSeconds:  3607
ConfigMapName:           kube-root-ca.crt
ConfigMapOptional:       <nil>
DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type     Reason   Age                    From     Message
----     ------   ----                   ----     -------
Normal   BackOff  2m7s (x465 over 107m)  kubelet  Back-off pulling image "10.0.10.20:5555/development/expedicao-api-image-base:latest"
Normal   Pulling  17s (x3 over 53s)      kubelet  Pulling image "10.0.10.20:5555/development/expedicao-api-image-base:latest"
Warning  Failed   17s (x3 over 53s)      kubelet  Failed to pull image "10.0.10.20:5555/development/expedicao-api-image-base:latest": rpc error: code = Unknown desc = failed to pull and unpack image "10.0.10.20:5555/development/app-image-base:latest": failed to resolve reference "10.0.10.20:5555/development/app-image-base:latest": failed to do request: Head "https://10.0.10.20:5555/v2/development/app-image-base/manifests/latest": http: server gave HTTP response to HTTPS client
Warning  Failed   17s (x3 over 53s)      kubelet  Error: ErrImagePull
Normal   BackOff  3s (x2 over 29s)       kubelet  Back-off pulling image "10.0.10.20:5555/development/expedicao-api-image-base:latest"
Warning  Failed   3s (x2 over 29s)       kubelet  Error: ImagePullBackOff

当我直接在docker中提取图像时，即使使用secret

也不会出现问题。拉形象

$ docker login 10.0.10.20:5555
Username: 4506904708
Password:
WARNING! Your password will be stored unencrypted in ~/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded
$ docker pull 10.0.10.20:5555/development/app-image-base:latest
latest: Pulling from development/app-image-base
Digest: sha256:1385a8aa2bc7bac1a8d3e92ead66fdf5db3d6625b736d908d1fec61ba59b6bdc
Status: Image is up to date for 10.0.10.20:5555/development/app-image-base:latest
10.0.10.20:5555/development/app-image-base:latest

有人能帮帮我吗?

Answer 1

首先，您需要在/etc/containerd/config.toml

中创建一个文件

# Config file is parsed as version 1 by default.
# To use the long form of plugin names set "version = 2"
[plugins.cri.registry.mirrors]
[plugins.cri.registry.mirrors."10.0.10.20:5555"]
endpoint = ["http://10.0.10.20:5555"]

第二，重启包含

$ systemctl restart containerd