无法访问 azure kubernetes 的服务

Question

我正在尝试配置 azure kubernetes 集群并在 portal.dockerized .net 核心 webapi 项目上创建了一个，并将图像发布到 azure 容器寄存器。应用清单文件后，我收到创建服务的消息以及外部 IP。但是，当我确实获得 pods 时，我一直获得状态 "Pending"

  NAME                           READY     STATUS    RESTARTS   AGE
  kubdemo1api-6c67bf759f-6slh2   0/1       Pending   0          6h

这是我的 yaml 清单文件，有人可以指出这里有什么问题吗？

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: kubdemo1api
labels:
  name: kubdemo1api
spec:
  replicas: 1
strategy:
  rollingUpdate:
  maxSurge: 1
  maxUnavailable: 1
type: RollingUpdate
 minReadySeconds: 30
selector:
matchLabels:
  app: kubdemo1api
template:
metadata:
  labels:
    app: kubdemo1api
    version: "1.0"
    tier: backend
spec:
  containers:
  - name: kubdemo1api
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 30
      timeoutSeconds: 10
    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 30
      timeoutSeconds: 10
    image: my container registry image address
    resources:
      requests:
        cpu: 100m
        memory: 100Mi
    ports:
    - containerPort: 80
    livenessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 30
      timeoutSeconds: 10
    readinessProbe:
      httpGet:
        path: /
        port: 80
      initialDelaySeconds: 30
      timeoutSeconds: 10
--- 
apiVersion: v1
kind: Service
metadata: 
  name: azkubdemoapi1
spec: 
  ports: 
- 
  port: 80
selector: 
  app: kubdemo1api
  type: LoadBalancer

编辑：输出 kubectl describe pods is this

就在这里

Normal   Scheduled  2m                default-scheduler                  Successfully assigned default/kubdemo1api-697d5655c-64fnj to aks-agentpool-87689508-0
  Normal   Pulling    37s (x4 over 2m)  kubelet, aks-agentpool-87689508-0  pulling image "myacrurl/azkubdemo:v2"
  Warning  Failed     37s (x4 over 2m)  kubelet, aks-agentpool-87689508-0  Failed to pull image "my acr url": [rpc error: code = Unknown desc = Error response from daemon: Get https://myacrurl/v2/azkubdemo/manifests/v2: unauthorized: authentication required, rpc error: code = Unknown desc = Error response from daemon: Get https://myacrurl/v2/azkubdemo/manifests/v2: unauthorized: authentication required]
  Warning  Failed     37s (x4 over 2m)  kubelet, aks-agentpool-87689508-0  Error: ErrImagePull
  Normal   BackOff    23s (x6 over 2m)  kubelet, aks-agentpool-87689508-0  Back-off pulling image "myacrlurl/azkubdemo:v2"
  Warning  Failed     11s (x7 over 2m)  kubelet, aks-agentpool-87689508-0  Error: ImagePullBackOff

Answer 1

这个yaml是错误的你能提供正确的yaml吗，意图是错误的。试试下面的 YAML

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: kubdemo1api
  labels:
    name: kubdemo1api
spec:
  replicas: 1
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
    type: RollingUpdate
  minReadySeconds: 30
  selector:
    matchLabels:
      app: kubdemo1api
  template:
    metadata:
      labels:
        app: kubdemo1api
        version: "1.0"
        tier: backend
    spec:
      containers:
      - name: kubdemo1api
        image: nginx
        resources:
          requests:
            cpu: 100m
            memory: 100Mi
        ports:
        - containerPort: 80
        livenessProbe:
          httpGet:
            path: /
            port: 80
        readinessProbe:
          httpGet:
            path: /
            port: 80
          initialDelaySeconds: 30
          timeoutSeconds: 10
---
apiVersion: v1
kind: Service
metadata: 
  name: azkubdemoapi1
spec: 
  ports: 
  - port: 80
  selector: 
    app: kubdemo1api
  type: LoadBalancer

Answer 2

对于您提供的错误，它表明您必须进行身份验证才能从 Azure 容器注册表中提取映像。

其实拉取镜像只需要权限，acrpull角色就足够了。有两种实现方式。

一种是只授予 AKS 访问 Azure 容器注册表的权限。我这边最简单。只需为 AKS 使用的服务主体创建角色分配。完整步骤请参阅 Grant AKS access to ACR。

另一种是使用Kubernetes secret。它比第一个复杂一点。您需要创建一个不同于使用的 AKS 的新服务主体并授予对其的访问权限，然后使用该服务主体创建 kubernetes secret。完整步骤请参阅 Access with Kubernetes secret。

无法访问 azure kubernetes 的服务

Services with azure kubernetes not reachable

azure

kubernetes

azure-aks