来自本地注册表的 Kubernetes 镜像

Question

我想使用已推送到私有注册表的 Docker 映像部署一个 pod。

到目前为止，我已使用以下命令安装注册表并推送映像：

# Build the DockerImage file
DOCKER_IMAGE="truc/tf-http-server:0.1"
cd docker
docker build -t $DOCKER_IMAGE .
cd ..

# Install Registry V2
docker run -d -p 5000:5000 --restart=always --name registry registry:2

# Push image
docker tag $DOCKER_IMAGE localhost:5000/$DOCKER_IMAGE
docker push localhost:5000/$DOCKER_IMAGE

# Add to known repository
sudo bash -c 'cat << EOF > /etc/docker/daemon.json
{
  "insecure-registries" : [ "192.168.1.37:5000" ]
}
EOF'
sudo systemctl daemon-reload
sudo systemctl restart docker

直接从 Docker:

中拉取镜像

$ sudo docker pull 192.168.1.37:5000/truc/tf-http-server:0.1
0.1: Pulling from truc/tf-http-server
Digest: sha256:b09c10375f1e90346f9b0c4bfb2bdfc7df919a4c89aaebfb433f2d845b37a960
Status: Downloaded newer image for 192.168.1.37:5000/truc/tf-http-server:0.1
192.168.1.37:5000/truc/tf-http-server:0.1

当我想从 Kubernetes 部署镜像时，出现以下错误：

Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  29s                default-scheduler  Successfully assigned default/tf-http-server-nvl9v to worker01
  Normal   Pulling    16s (x2 over 29s)  kubelet            Pulling image "192.168.1.37:5000/truc/tf-http-server:0.1"
  Warning  Failed     16s (x2 over 29s)  kubelet            Failed to pull image "192.168.1.37:5000/truc/tf-http-server:0.1": rpc error: code = Unknown desc = failed to pull and unpack image "192.168.1.37:5000/truc/tf-http-server:0.1": failed to resolve reference "192.168.1.37:5000/truc/tf-http-server:0.1": failed to do request: Head "https://192.168.1.37:5000/v2/truc/tf-http-server/manifests/0.1": http: server gave HTTP response to HTTPS client
  Warning  Failed     16s (x2 over 29s)  kubelet            Error: ErrImagePull
  Normal   BackOff    3s (x2 over 28s)   kubelet            Back-off pulling image "192.168.1.37:5000/truc/tf-http-server:0.1"
  Warning  Failed     3s (x2 over 28s)   kubelet            Error: ImagePullBackOff

好像存储库访问被禁止了。有没有办法让它可以从 Kubernetes 访问？

编辑：要安装 Docker registy，运行以下命令并遵循已检查的答案。

mkdir registry && cd registry && mkdir certs && cd certs
openssl genrsa 1024 > domain.key
chmod 400 domain.key
openssl req -new -x509 -nodes -sha1 -days 365 -key domain.key -out domain.crt -subj "/C=FR/ST=France/L=Lannion/O=TGI/CN=OrangeFactoryBox"
cd .. && mkdir auth
sudo apt-get install apache2-utils -y
htpasswd -Bbn username password > auth/htpasswd
cd ..
docker run -d \
  --restart=always \
  --name registry \
  -v `pwd`/auth:/auth \
  -v `pwd`/certs:/certs \
  -v `pwd`/certs:/certs \
  -e REGISTRY_AUTH=htpasswd \
  -e REGISTRY_AUTH_HTPASSWD_REALM="Registry Realm" \
  -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd \
  -e REGISTRY_HTTP_ADDR=0.0.0.0:5000 \
  -e REGISTRY_HTTP_TLS_CERTIFICATE=/certs/domain.crt \
  -e REGISTRY_HTTP_TLS_KEY=/certs/domain.key \
  -p 5000:5000 \
  registry:2
sudo docker login -u username -p password localhost:5000

Answer 1

Assumption: The docker server where you tested it and the kubernetes nodes are on the same private subnet 192.168.1.0/24

http: server gave HTTP response to HTTPS client

所以，显然您的私有 docker 注册表是 HTTP 而不是 HTTPS。 Kuberentes 更喜欢注册表使用有效的 SSL 证书。在 kubernetes 集群中的每个节点上，您需要明确告诉 docker 将此注册表视为不安全的注册表。进行此更改后，您还必须重新启动 docker 服务。

Kubernetes：拉取镜像失败。服务器向 HTTPS 客户端提供 HTTP 响应。

{ "insecure-registries":["192.168.1.37:5000"] }
to the daemon.json file at /etc/docker.

您还需要在您的命名空间中定义 imagePullSecrets 并在您的 deployment/pod 规范中使用它

首先从您的创建秘密：

kubectl create secret generic regcred \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson

然后在你的pod yaml中引用这个secret

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: <your-private-image>
  imagePullSecrets:
  - name: regcred

参考：https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/

来自本地注册表的 Kubernetes 镜像

Kubernetes image from local registry

kubernetes

docker-registry

docker-image