docker - 从私有(private)注册表部署应用程序时的 Kubernetes/docker ErrImagePull

Question

尝试从托管在我的私有(private) helm docker 注册表上的镜像创建部署时，我收到 ErrImagePull。基于“服务器向 HTTPS 客户端提供 HTTP 响应”错误，我尝试在 systemd 插件中添加 --insecure-registry 选项以及所有工作节点和主节点上的 daemon.json 文件，但它仍然无法正常工作。我还应该尝试解决什么问题？

编辑:也许是因为 docker 使用了 containerd？

    $ sudo systemctl status docker
    ● docker.service - Docker Application Container Engine
       Loaded: loaded (/lib/systemd/system/docker.service; enabled; vendor preset: enabled)
      Drop-In: /etc/systemd/system/docker.service.d
               └─docker.conf
       Active: active (running) since Fri 2020-02-07 10:00:25 UTC; 4min 44s ago
         Docs: https://docs.docker.com
     Main PID: 27700 (dockerd)
        Tasks: 14
       Memory: 41.8M
       CGroup: /system.slice/docker.service
               └─27700 /usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

    $ cat /etc/systemd/system/docker.service.d/docker.conf
    DOCKER_OPTS="--insecure-registry 10.10.30.200:5000"

    $ cat /etc/docker/daemon.json

    {
      "exec-opts": ["native.cgroupdriver=systemd"],
      "log-driver": "json-file",
      "log-opts": {
        "max-size": "100m"
      },
      "storage-driver": "overlay2",
      "insecure-registries": ["10.10.30.200:5000"]
    }    

    $ curl 10.10.30.200:5000/v2/mybuild/tags/list
        {"name":"mybuild","tags":["v1"]}

    $ kubectl describe pod myweb-769d57d99-lz6xs
    ...
    Normal   Pulling    1s (x2 over 13s)   kubelet, k8s-node2  Pulling image "10.10.30.200:5000/mybuild:v1"
    Warning  Failed     1s (x2 over 13s)   kubelet, k8s-node2  Failed to pull image "10.10.30.200:5000/mybuild:v1": rpc error: code = Unknown desc = failed to resolve image "10.10.30.200:5000/mybuild:v1": no available registry endpoint: failed to do request: Head https://10.10.30.200:5000/v2/mybuild/manifests/v1: http: server gave HTTP response to HTTPS client
    Warning  Failed     1s (x2 over 13s)   kubelet, k8s-node2  Error: ErrImagePull

    $ cat deployment.yaml

    ---
    apiVersion: apps/v1
    kind: Deployment                                                                                                                                         metadata:
      labels:
        app: myweb
      name: myweb
    spec:
      replicas: 1
      selector:
        matchLabels:
          app: myweb
      template:
        metadata:
          labels:
            app: myweb
        spec:
          containers:
          - image: 10.10.30.200:5000/mybuild:v1
            imagePullPolicy: Always
            name: myweb

    ---
    apiVersion: v1
    kind: Service
    metadata:
      labels:
        app: myweb
      name: myweb
    spec:
      ports:
      - nodePort: 32223
        port: 80
        protocol: TCP
        targetPort: 80
      selector:
        app: myweb
      type: NodePort

Answer 1

我重现了你的问题，解决方案是添加

{
  "insecure-registry" : ["10.10.30.200:5000"]
}

在集群中/etc/docker/daemon.json 中的每个节点(worker 和master) 并重新启动docker sudo systemctl restart docker 加载新配置。

可以关注this guide关于如何使用 helm 设置不安全的私有(private) docker 注册表。

成功安装图表后，在每个节点上的 daemon.json 中添加条目并重新启动 docker。之后，您可以标记图像并将其推送到存储库。

要检查图像是否已成功推送到您的注册表，您可以运行:

curl -X GET http://10.10.30.200:5000/v2/_catalog

输出应该是这样的:

{"repositories":["ubuntu/myimage"]}