0

我有一个带有K3s的 Kubernetes 集群设置，我想从位于 hub.docker.com 的注册表中提取。尝试拉公共图像时这没有问题，但是当我尝试从 hub.docker.com 拉私有图像时。它找不到它们。

regcred我已经尝试使用我的 Docker 登录信息（请参阅此处）创建一个秘密，并将其添加到imagePullSecrets. 但这似乎不起作用。

如何告诉我的 K3s 集群使用 hub.docker.com 的私有部分进行身份验证，从而允许我在部署中提取私有图像？

谢谢

这是我的完整清单：

apiVersion: v1
kind: Namespace
metadata:
  name: example
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: example
  namespace: example
spec:
  replicas: 2
  selector:
    matchLabels:
      app: example
  template:
    metadata:
      labels:
        app: example
    spec:
      containers:
        - name: example
          image: example/example:latest
          ports:
            - containerPort: 80
          imagePullPolicy: Always
      imagePullSecrets:
        - name: regcred
---
apiVersion: v1
kind: Service
metadata:
  name: example
  namespace: example
spec:
  ports:
    - port: 80
      targetPort: 80
      name: tcp
  selector:
    app: example
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: example
  namespace: example
  annotations:
    kubernetes.io/ingress.class: "traefik"
    kubernetes.io/tls-acme: "true"
    ingress.kubernetes.io/ssl-redirect: "true"
    ingress.kubernetes.io/ssl-temporary-redirect: "true"
    ingress.kubernetes.io/ssl-host: "example.com"
    traefik.frontend.rule.type: PathPrefixStrip
    traefik.ingress.kubernetes.io/redirect-regex: "^https://example.com(.*)"
    traefik.ingress.kubernetes.io/redirect-replacement: "https://www.example.com/$1"
spec:
  rules:
    - host: "example.com"
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: example
                port:
                  number: 80
    - host: "www.example.com"
      http:
        paths:
          - path: /
            pathType: ImplementationSpecific
            backend:
              service:
                name: example
                port:
                  number: 80

Regcred 看起来像这样：

{"auths":{"https://index.docker.io/v1/":{"username":"example","password":"secret","email":"test@example.com","auth":"dm...g5"}}}%

吊舱状态：

NAME                        READY   STATUS             RESTARTS   AGE
example-688b97d5d7-q9ngl    0/1     ImagePullBackOff   0          101s

运行命令时kubectl describe pod example-688b97d5d7-q9ngl给我：

Failed to pull image "example/example:latest": rpc error: code = Unknown desc = failed to pull and unpack image "docker.io/example/example:latest": failed to resolve reference "docker.io/example/example:latest": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
4

1 回答 1

1

谢谢各位的帮助。问题是我没有regcred为特定的命名空间创建秘密。当我这样做时，一切都立即生效。

于 2021-01-13T09:25:01.277 回答