K8S连接harbor仓库，pull镜像报错

原创已于 2023-01-09 16:23:23 修改 · 882 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#kubernetes #运维 #容器

于 2023-01-09 16:22:29 首次发布

K8S 专栏收录该内容

3 篇文章

订阅专栏

在K8S环境中，从Harbor仓库pull镜像时遇到错误，即使在worker节点使用docker login也无法解决问题。但通过创建K8S secret并将其添加到deployment中，可以成功解决这个问题，使镜像正常拉取。

K8S链接harbor仓库，pull镜像时报错，预先在各个worker节点上docker login也没用，但是直接运行docker pull是可以拉取的，排除用户名密码的问题。

报错如下：

Events:
Type     Reason     Age                From               Message
--------------------------------------------------------------------------------
Normal   Scheduled  30s                default-scheduler  Successfully assigned dev/tomcat-deploy-765c94dfdb-p9tzc to k8s-worker02
Normal   BackOff    27s (x2 over 29s)  kubelet            Back-off pulling image "192.168.1.151:80/dev/asia-tomcat:V1.1"
Warning  Failed     27s (x2 over 29s)  kubelet            Error: ImagePullBackOff
Normal   Pulling    14s (x2 over 30s)  kubelet            Pulling image "192.168.1.151:80/dev/asia-tomcat:V1.1"
Warning  Failed     13s (x2 over 29s)  kubelet            Failed to pull image "192.168.1.151:80/dev/asia-tomcat:V1.1": rpc error: code = Unknown desc = Error response from daemon: pull access denied for 192.168.1.151:80/dev/asia-tomcat, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Warning  Failed     13s (x2 over 29s)  kubelet            Error: ErrImagePull

解决方案：

新建k8s secret

kubectl create secret docker-registry registry-harbor --namespace=dev 
--docker-server=192.168.1.151:80 --docker-username=admin 
--docker-password=Harbor12345 --docker-email=it@asia.com

在deployment中加入刚建的secret

apiVersion: apps/v1
kind: Deployment
metadata:
  name: tomcat-deploy
  namespace: dev
  labels:
    app: first-deploy-tomcat
spec:
  replicas: 2
  selector: 
    matchLabels:
      app: tomcat-xunyunbbs
  minReadySeconds: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: tomcat-xunyunbbs
    spec:
      containers:
      - name: asia-tomcat
        image: 192.168.1.151:80/dev/asia-tomcat:V1.1
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
      imagePullSecrets:             #添加secret
      - name: registry-harbor       # 刚建的secret的名字

重新运行，可正常拉取镜像。