docker - kubernetes 无法拉取镜像 docker 私有(private)注册表

Question

我试图在 kubernetes 中部署“部署”，这是从私有(private)注册表中提取 docker 镜像(我不知道是谁进行了此设置)，但是在通过 kubernetes 进行“docker pull images”期间，我遇到了以下错误

node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  85s                default-scheduler  Successfully assigned default/trusted-enc-assettag1-deployment-8467b74958-6fbp7 to k8s-node
  Normal   BackOff    24s (x2 over 61s)  kubelet, k8s-node  Back-off pulling image "10.105.168.81:5000/simplehttpserverenc:enc_v1"
  Warning  Failed     24s (x2 over 61s)  kubelet, k8s-node  Error: ImagePullBackOff
  Normal   Pulling    12s (x3 over 82s)  kubelet, k8s-node  Pulling image "10.105.168.81:5000/simplehttpserverenc:enc_v1"
  Warning  Failed     0s (x3 over 62s)   kubelet, k8s-node  Failed to pull image "10.105.168.81:5000/simplehttpserverenc:enc_v1": rpc error: code = Unknown desc = Error response from daemon: Get https://10.105.168.81:5000/v2/: net/http: TLS handshake timeout
  Warning  Failed     0s (x3 over 62s)   kubelet, k8s-node  Error: ErrImagePull
[root@k8s-master ~]# docker pull 10.105.168.81:5000/simplehttpserverenc:enc_v1

ImagePullBackOff 和 net/http:TLS 握手超时错误。
最初，在 docker pull 中也会观察到这个“net/http:TLS 握手超时”错误。我引用了一些答案和

configured certificate(/etc/docker/certs.d//ca.crt ) andproxy (/etc/systemd/system/docker.service.d/proxy.conf)

之后能够从私有(private)图像执行 docker pull。

[root@k8s-master ~]# docker pull 10.105.168.81:5000/simplehttpserverenc:enc_v1
enc_v1: Pulling from simplehttpserverenc
54fec2fa59d0: Pull complete
cd3f35d84cab: Pull complete
a0afc8e92ef0: Pull complete
9691f23efdb7: Pull complete
6512e60b314b: Pull complete
a8ac6632d329: Pull complete
68f4c4e0aa8c: Pull complete
Digest: sha256:0358708cd11e96f6cf6f22b29d46a8eec50d7107597b866e1616a73a198fe797
Status: Downloaded newer image for 10.105.168.81:5000/simplehttpserverenc:enc_v1
10.105.168.81:5000/simplehttpserverenc:enc_v1
[root@k8s-master ~]#

但仍然无法通过 kubernetes 执行此 docker pull。如何解决这个问题？

Answer 1

如果您在 k8s 中使用 docker 作为容器引擎，AFAIK 与 Understand the configuration 相同.因为镜像拉取是由容器引擎进行的，它依赖于证书的每个私有(private)配置。在你的 k8s 的工作节点上拉取相同的图像怎么样？是否可以毫无错误地拉出一个？