Azure 容器服务：尝试拉取镜像但失败

Question

我正在尝试部署我的 k8s 集群。但是当我这样做时，它无法提取图像。这是我运行kubectl describe pods 时得到的结果：

  Type     Reason      Age               From                   Message
  ----     ------      ----              ----                   -------
  Normal   BackOff     47m               kubelet, dc9ebacs9000  Back-off pulling image "tlk8s.azurecr.io/devicecloudwebapi:v1"
  Warning  FailedSync  9m (x3 over 47m)  kubelet, dc9ebacs9000  Error syncing pod
  Warning  Failed      9m                kubelet, dc9ebacs9000  Failed to pull image "tlk8s.azurecr.io/devicecloudwebapi:v1": [rpc error: code = 2 desc = failed to register layer: re-exec error: exit status 1: output: remove \\?\C:\ProgramData\docker\windowsfilter\930af9d006462c904d9114da95523cc441206db8bb568769f4f0612d3a96da5b\Files\Windows\System32\LogFiles\Scm\SCM.EVM: The system cannot find the file specified., rpc error: code = 2 desc = failed to register layer: re-exec error: exit status 1: output: remove \\?\C:\ProgramData\docker\windowsfilter\e30d44f97c53edf7e91c69f246fe753a84e4cb40899f472f75aae6e6d74b5c45\Files\Windows\System32\LogFiles\Scm\SCM.EVM: The system cannot find the file specified.]
  Normal   Pulling     9m (x3 over 2h)   kubelet, dc9ebacs9000  pulling image "tlk8s.azurecr.io/devicecloudwebapi:v1"

这是我查看单个 pod 时得到的结果：

Error from server (BadRequest): container "tl-api" in pod "tl-api-3363368743-d7kjq" is waiting to start: image can't be pulled

这是我的 YAML 文件：

---
apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: tl-api
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: tl-api
    spec:
      containers:
      - name: tl-api
        image: tlk8s.azurecr.io/devicecloudwebapi:v1
        ports:
        - containerPort: 80
      imagePullSecrets:
      - name: acr-secret
      nodeSelector:
        beta.kubernetes.io/os: windows
---
apiVersion: v1
kind: Service
metadata:
  name: tl-api
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: tl-api

我的 docker 图像结果：

REPOSITORY                                   TAG                            IMAGE ID            CREATED             SIZE
devicecloudwebapi                            latest                         ee3d9c3e231d        8 days ago          7.85GB
tlk8s.azurecr.io/devicecloudwebapi           v1                             ee3d9c3e231d        8 days ago          7.85GB
devicecloudwebapi                            dev                            bb33ab221910        8 days ago          7.76GB

Answer 1

您必须在 kubectl 中为您的注册表创建一个秘密：

kubectl create secret docker-registry <secret-name> \
--namespace <namespace> \
--docker-server=<container-registry-name>.azurecr.io \
--docker-username=<service-principal-ID> \
--docker-password=<service-principal-password>

更多信息：https://docs.microsoft.com/pt-br/azure/container-registry/container-registry-auth-kubernetes

记得在你的规范中设置“imagePullSecrets”。

apiVersion: v1
kind: Pod
metadata: #informaçoes internas do container
    name: mongodb-pod
spec: #maneira com o pod tem que se comportar
    containers: # informações sobre os containeres que irão rodar no pod
        -   name: mongodb
            image: mongo
            ports:
            -   containerPort: 27017
    imagePullSecrets: 
        -   name: <secret-name>

Answer 2

首先，我会仔细检查您是否已通过 cli 在正确的注册表中登录到 docker。

类似docker login <REGISTRY_NAME> -u <CLIENT_ID>

---

您需要确保您已创建了一个 k8s 密钥并将其绑定到注册表。如果您还没有这样做，也许可以查看this post。我看到你的 yaml 指定了一个秘密，但是这也是在注册表中配置的吗？