k8s之使用secret獲取私有倉庫鏡像

一、前言

其實這次實踐算不上特別復雜，只是在實踐過程中遇到了一些坑，以及填坑的方法是非常值得在以后的學習過程中參考借鑒的

二、知識准備

1.harbor是一個企業級的鏡像倉庫，它比起docker registry提供了更多的功能
2.在私有倉庫中的鏡像是需要經過一系列的驗證才能夠被pull，比如insecure-registries等
3.本文主要描述通過k8s的secret來進行驗證

三、環境准備

組件	版本
OS	Ubuntu 18.04.1 LTS
docker	18.06.0-ce
k8s	1.10.1
harbor	v1.5.3

四、創建secret

根據官方文檔 https://v1-10.docs.kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

root@k8s-master:~# kubectl create secret docker-registry regcred \
> --docker-server=repo.mrvolleyball.com/library \ > --docker-username=admin \ > --docker-password='Harbor12345' \ > --docker-email=chaisd63@163.com secret "regcred" created 

root@k8s-master:~# kubectl apply -f <(echo 'apiVersion: v1
> kind: Pod > metadata: > name: private-reg > spec: > containers: > - name: private-reg-container > image: repo.mrvolleyball.com/library/busybox:latest > imagePullSecrets: > - name: regcred') pod "private-reg" created 

根本沒有難度啊，2條命令解決，當我滿懷欣喜的查看狀態的時候：

root@k8s-master:~# kubectl get pods private-reg NAME READY STATUS RESTARTS AGE private-reg 0/1 ImagePullBackOff 0 11s 

root@k8s-master:~# kubectl describe pods private-reg
...
Events:
  Type Reason Age From Message ---- ------ ---- ---- ------- Normal Scheduled 40s default-scheduler Successfully assigned private-reg to k8s-master Normal SuccessfulMountVolume 40s kubelet, k8s-master MountVolume.SetUp succeeded for volume "default-token-v9nkm" Normal SandboxChanged 38s kubelet, k8s-master Pod sandbox changed, it will be killed and re-created. Normal Pulling 22s (x2 over 39s) kubelet, k8s-master pulling image "repo.mrvolleyball.com/library/busybox:latest" Warning Failed 22s (x2 over 38s) kubelet, k8s-master Failed to pull image "repo.mrvolleyball.com/library/busybox:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for repo.mrvolleyball.com/library/busybox, repository does not exist or may require 'docker login' Warning Failed 22s (x2 over 38s) kubelet, k8s-master Error: ErrImagePull Normal BackOff 6s (x4 over 36s) kubelet, k8s-master Back-off pulling image "repo.mrvolleyball.com/library/busybox:latest" Warning Failed 6s (x4 over 36s) kubelet, k8s-master Error: ImagePullBackOff 

這簡直是給了當頭一棒啊，我反反復復的檢查之后，用戶名、密碼、倉庫地址，官網提供的命令，都沒問題啊，這TM到底是幾個意思！！

在我一遍又一遍的check中發現了蛛絲馬跡

root@k8s-master:~# kubectl get secret regcred  -o yaml
apiVersion: v1
data:
  .dockercfg: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
  creationTimestamp: 2018-10-29T09:33:40Z
  name: regcred
  namespace: default
  resourceVersion: "7670942"
  selfLink: /api/v1/namespaces/default/secrets/regcred
  uid: b82b7527-db5d-11e8-9e67-b2aca3e7fa90
type: kubernetes.io/dockercfg

官網提供的信息：

apiVersion: v1 data: .dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0= kind: Secret metadata: ...  name: regcred ... type: kubernetes.io/dockerconfigjson 

細心的朋友已經看出來了：
通過命令創建的data是.dockercfg，並且類型也不同：type: kubernetes.io/dockercfg
而官網提供的的data是.dockerconfigjson，類型是：type: kubernetes.io/dockerconfigjson

細微差別，千里之外啊，趕緊改了試一試：

root@k8s-master:~# kubectl get secret regcred -o yaml > secret.yaml 

修改之：

root@k8s-master:~# more secret.yaml apiVersion: v1 data: .dockerconfigjson: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19 kind: Secret metadata: name: regcred namespace: default selfLink: /api/v1/namespaces/default/secrets/regcred type: kubernetes.io/dockerconfigjson 

然后重建之：

root@k8s-master:~# kubectl delete secret regcred root@k8s-master:~# kubectl create -f secret.yaml root@k8s-master:~# kubectl delete -f <(echo 'apiVersion: v1 kind: Pod metadata: name: private-reg spec: containers: - name: private-reg-container image: repo.mrvolleyball.com/library/busybox:latest imagePullSecrets: - name: regcred') pod "private-reg" deleted root@k8s-master:~# kubectl apply -f <(echo 'apiVersion: v1 kind: Pod metadata: name: private-reg spec: containers: - name: private-reg-container image: repo.mrvolleyball.com/library/busybox:latest imagePullSecrets: - name: regcred') pod "private-reg" created 

root@k8s-master:~# kubectl get pods private-reg NAME READY STATUS RESTARTS AGE private-reg 1/1 Running 0 15s 

終於，達到了需要的效果

五、小結

● 再詳細的文檔也需要一步一步實踐，只有實踐了，才是自己的知識，否則就是人雲亦雲
● 看文檔一定要非常仔細，而且要對比對比在對比，如果你確定了和文檔的一樣沒問題，做出來的依然錯誤，就去提issue吧