从 gcr.to 拉取图像失败答案

【问题标题】：Pulling a image from gcr.to fails从 gcr.to 拉取图像失败
【发布时间】：2021-01-26 14:04:38
【问题描述】：

我能够创建一个 kubernetes 集群，并按照步骤从 GCR 存储库中提取私有映像。 https://cloud.google.com/container-registry/docs/advanced-authentication https://cloud.google.com/container-registry/docs/access-control

我无法从 GCR 中提取图像。我使用了以下命令 gcloud 身份验证登录我已经验证了服务帐户。本地机器和gcr之间的连接也是如此。

下面是错误

$ kubectl describe pod test-service-55cc8f947d-5frkl
Name:         test-service-55cc8f947d-5frkl
Namespace:    default
Priority:     0
Node:         gke-test-gke-clus-test-node-poo-c97a8611-91g2/10.128.0.7
Start Time:   Mon, 12 Oct 2020 10:01:55 +0530
Labels:       app=test-service
              pod-template-hash=55cc8f947d
              tier=test-service
Annotations:  kubernetes.io/limit-ranger: LimitRanger plugin set: cpu request for container test-service
Status:       Pending
IP:           10.48.0.33
IPs:
  IP:           10.48.0.33
Controlled By:  ReplicaSet/test-service-55cc8f947d
Containers:
  test-service:
    Container ID:   
    Image:          gcr.io/test-256004/test-service:v2
    Image ID:       
    Port:           8080/TCP
    Host Port:      0/TCP
    State:          Waiting
      Reason:       ErrImagePull
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:  100m
    Environment:
      test_SERVICE_BUCKET:   test-pt-prod
      COPY_FILES_DOCKER_IMAGE:  gcr.io/test-256004/test-gcs-copy:latest
      test_GCP_PROJECT:      test-256004
      PIXALATE_GCS_DATASET:     test_pixalate
      PIXALATE_BQ_TABLE:        pixalate
      APP_ADS_TXT_GCS_DATASET:  test_appadstxt
      APP_ADS_TXT_BQ_TABLE:     appadstxt
    Mounts:
      /test/output from test-volume (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-6g7nl (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             False 
  ContainersReady   False 
  PodScheduled      True 
Volumes:
  test-volume:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  test-pvc
    ReadOnly:   false
  default-token-6g7nl:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-6g7nl
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                 node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason                  Age                From                                                          Message
  ----     ------                  ----               ----                                                          -------
  Normal   Scheduled               42s                default-scheduler                                             Successfully assigned default/test-service-55cc8f947d-5frkl to gke-test-gke-clus-test-node-poo-c97a8611-91g2
  Normal   SuccessfulAttachVolume  38s                attachdetach-controller                                       AttachVolume.Attach succeeded for volume "pvc-25025b4c-2e89-4400-8e0e-335298632e74"
  Normal   SandboxChanged          31s                kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Pod sandbox changed, it will be killed and re-created.
  Normal   Pulling                 15s (x2 over 32s)  kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Pulling image "gcr.io/test-256004/test-service:v2"
  Warning  Failed                  15s (x2 over 32s)  kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Failed to pull image "gcr.io/test-256004/test-service:v2": rpc error: code = Unknown desc = Error response from daemon: pull access denied for gcr.io/test-256004/test-service, repository does not exist or may require 'docker login': denied: Permission denied for "v2" from request "/v2/test-256004/test-service/manifests/v2".
  Warning  Failed                  15s (x2 over 32s)  kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Error: ErrImagePull
  Normal   BackOff                 3s (x4 over 29s)   kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Back-off pulling image "gcr.io/test-256004/test-service:v2"
  Warning  Failed                  3s (x4 over 29s)   kubelet, gke-test-gke-clus-test-node-poo-c97a8611-91g2  Error: ImagePullBackOff

【问题讨论】：

您好，您是否尝试从与您的 GKE 集群所在的同一项目中提取图像？
@DawidKruk 是的，我从同一个项目中提取它
你的计算引擎的服务账号有什么权限？计算引擎允许的作用域是什么？
@guillaumeblaquiere 谢谢！我将服务帐户更改为默认服务帐户，它可以工作
@DawidKruk，我试图扩大我的答案而不是简单的评论；）

标签： kubernetes google-cloud-platform google-kubernetes-engine google-container-registry

【解决方案1】：

如果您不使用工作负载身份，则您的 pod 的默认服务帐户是其中一个节点，并且节点默认使用 Compute Engine 服务帐户。

确保授予其访问 GCR 的正确权限。

如果您使用其他服务帐号，请授予它存储对象读取者角色（当您拉取图像时，您会读取存储在 Cloud Storage 中的 blob（至少是相同的权限））。

注意：即使它是默认服务帐号，我也不建议使用角色发生任何变化的 Compute Engine 服务帐号。确实是项目编辑，责任重大。

【讨论】：