k8s之使用secret獲取私有倉庫映象

摘要： 前言 其實這次實踐算不上特別複雜，只是在實踐過程中遇到了一些坑，以及填坑的方法是非常值得在以後的學習過程中參考借鑑的 知識準備 1.harbor是一個企業級的映象倉庫，它比起docker registry提供了更多的功能 2.在私有倉庫中的映象是需要經過一系列的驗證才...

前言

其實這次實踐算不上特別複雜，只是在實踐過程中遇到了一些坑，以及填坑的方法是非常值得在以後的學習過程中參考借鑑的

知識準備

1.harbor是一個企業級的映象倉庫，它比起docker registry提供了更多的功能

2.在私有倉庫中的映象是需要經過一系列的驗證才能夠被pull，比如insecure-registries等

3.本文主要描述通過k8s的secret來進行驗證

環境準備

元件	版本
OS	Ubuntu 18.04.1 LTS
docker	18.06.0-ce
k8s	1.10.1
harbor	v1.5.3

建立secret

根據官方文件ofollow,noindex" target="_blank">https://v1-10.docs.kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

root@k8s-master:~# kubectl create secret docker-registry regcred \
>--docker-server=repo.mrvolleyball.com/library \
>--docker-username=admin \
>--docker-password='Harbor12345' \
>[email protected]
secret "regcred" created

root@k8s-master:~# kubectl apply -f <(echo 'apiVersion: v1
> kind: Pod
> metadata:
>name: private-reg
> spec:
>containers:
>- name: private-reg-container
>image: repo.mrvolleyball.com/library/busybox:latest
>imagePullSecrets:
>- name: regcred')
pod "private-reg" created

根本沒有難度啊，2條命令解決，當我滿懷欣喜的檢視狀態的時候：

root@k8s-master:~# kubectl get pods private-reg
NAMEREADYSTATUSRESTARTSAGE
private-reg0/1ImagePullBackOff011s

root@k8s-master:~# kubectl describe pods private-reg
...
Events:
TypeReasonAgeFromMessage
-------------------------
NormalScheduled40sdefault-schedulerSuccessfully assigned private-reg to k8s-master
NormalSuccessfulMountVolume40skubelet, k8s-masterMountVolume.SetUp succeeded for volume "default-token-v9nkm"
NormalSandboxChanged38skubelet, k8s-masterPod sandbox changed, it will be killed and re-created.
NormalPulling22s (x2 over 39s)kubelet, k8s-masterpulling image "repo.mrvolleyball.com/library/busybox:latest"
WarningFailed22s (x2 over 38s)kubelet, k8s-masterFailed to pull image "repo.mrvolleyball.com/library/busybox:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for repo.mrvolleyball.com/library/busybox, repository does not exist or may require 'docker login'
WarningFailed22s (x2 over 38s)kubelet, k8s-masterError: ErrImagePull
NormalBackOff6s (x4 over 36s)kubelet, k8s-masterBack-off pulling image "repo.mrvolleyball.com/library/busybox:latest"
WarningFailed6s (x4 over 36s)kubelet, k8s-masterError: ImagePullBackOff

這簡直是給了當頭一棒啊，我反反覆覆的檢查之後，使用者名稱、密碼、倉庫地址，官網提供的命令，都沒問題啊，這TM到底是幾個意思！！

在我一遍又一遍的check中發現了蛛絲馬跡

root@k8s-master:~# kubectl get secret regcred-o yaml
apiVersion: v1
data:
.dockercfg: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
creationTimestamp: 2018-10-29T09:33:40Z
name: regcred
namespace: default
resourceVersion: "7670942"
selfLink: /api/v1/namespaces/default/secrets/regcred
uid: b82b7527-db5d-11e8-9e67-b2aca3e7fa90
type: kubernetes.io/dockercfg

官網提供的資訊：

apiVersion: v1
data:
.dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
kind: Secret
metadata:
...
name: regcred
...
type: kubernetes.io/dockerconfigjson

細微差別，千里之外啊，趕緊改了試一試：

root@k8s-master:~# kubectl get secret regcred-o yaml > secret.yaml

修改之：

root@k8s-master:~# more secret.yaml
apiVersion: v1
data:
.dockerconfigjson: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
name: regcred
namespace: default
selfLink: /api/v1/namespaces/default/secrets/regcred
type: kubernetes.io/dockerconfigjson

然後重建之：

root@k8s-master:~# kubectl delete secret regcred
root@k8s-master:~# kubectl create -f secret.yaml
root@k8s-master:~# kubectl delete -f <(echo 'apiVersion: v1
kind: Pod
metadata:
name: private-reg
spec:
containers:
- name: private-reg-container
image: repo.mrvolleyball.com/library/busybox:latest
imagePullSecrets:
- name: regcred')
pod "private-reg" deleted
root@k8s-master:~# kubectl apply -f <(echo 'apiVersion: v1
kind: Pod
metadata:
name: private-reg
spec:
containers:
- name: private-reg-container
image: repo.mrvolleyball.com/library/busybox:latest
imagePullSecrets:
- name: regcred')
pod "private-reg" created

root@k8s-master:~# kubectl get pods private-reg
NAMEREADYSTATUSRESTARTSAGE
private-reg1/1Running015s

終於，達到了需要的效果

小結

● 再詳細的文件也需要一步一步實踐，只有實踐了，才是自己的知識，否則就是人云亦云

● 看文件一定要非常仔細，而且要對比對比在對比，如果你確定了和文件的一樣沒問題，做出來的依然錯誤，就去提issue吧

至此，本文結束

在下才疏學淺，有撒湯漏水的，請各位不吝賜教...