kubernetes之基於ServiceAccount拉取私有鏡像

• 2022 年 9 月 15 日
• 筆記
• Kubernetes

前面可以通過ImagPullPolicy和ImageullSecrets指定下載鏡像的策略，ServiceAccount也可以基於spec.imagePullSecret字段附帶一個由下載鏡像專用的Secret資源組成的列表，用於在容器創建時，從某個私有鏡像倉庫下載鏡像文件之前的服務認證。

1.創建Secrets資源

這裡根據自己的實際去定義即可；一定要是對的地址和認證信息；否則無法pull/push

root@ks-master01-10:~# kubectl create secret docker-registry \
> aliyun-haitang-registry \
> --docker-server=registry.cn-hangzhou.aliyuncs.com \
> --docker-username=xxxxxxx\
> --docker-password=xxxxxx
secret/aliyun-haitang-registry created

1.1查看Secrets

root@ks-master01-10:~#  kubectl describe secret aliyun-haitang
Name:         aliyun-haitang
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  140 bytes

2.創建ServiceAccount

2.1不設置任何策略，測試是否能拉取私有倉庫鏡像

此處不配置任何鏡像拉取策略，測試是否能拉取私有倉庫鏡像；

root@ks-master01-10:~#  cat pod-serviceaccount-secret.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: stree-serviceaccount
spec:
  containers:
  - name: stree
    image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest

2.2查看Pod，處於ErrImage

root@ks-master01-10:~# kubectl get pods
NAME                                      READY   STATUS         RESTARTS       AGE
stree-serviceaccount                      0/1     ErrImagePull   0              8s

2.3describe查看Events

可以看到事件，是Docker認證的問題；

root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
  Type     Reason     Age               From               Message
  ----     ------     ----              ----               -------
  Normal   Scheduled  20s               default-scheduler  Successfully assigned default/stree-serviceaccount to ks-node02-12
  Normal   BackOff    17s               kubelet            Back-off pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
  Warning  Failed     17s               kubelet            Error: ImagePullBackOff
  Normal   Pulling    2s (x2 over 19s)  kubelet            Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
  Warning  Failed     2s (x2 over 18s)  kubelet            Failed to pull image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for registry.cn-hangzhou.aliyuncs.com/lengyuye/stress, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
  Warning  Failed     2s (x2 over 18s)  kubelet            Error: ErrImagePull

2.4創建ServiceAccount

aliyun-haitang是docker-registry類型的Secrets對象，由用戶提前手動創建，它可以通過鍵值數據提供docker倉庫服務器的地址，接入服務器的用戶名，密碼及用戶的電子郵件信息等，認證通過後，引用ServiceAccount的Pod資源即可從指定的鏡像倉庫下載image。

root@ks-master01-10:~# cat serviceaccount-imagepullsecret.yaml 
apiVersion: v1
kind: ServiceAccount
metadata:
   name: imagepull-aliyun-sa
imagePullSecrets:
- name: aliyun-haitang
root@ks-master01-10:~# kubectl apply -f serviceaccount-imagepullsecret.yaml 
serviceaccount/imagepull-aliyun-sa created

2.5查看SA

root@ks-master01-10:~# kubectl get sa imagepull-aliyun-sa -o yaml
apiVersion: v1
imagePullSecrets:
- name: aliyun-haitang
kind: ServiceAccount
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","imagePullSecrets":[{"name":"aliyun-haitang"}],"kind":"ServiceAccount","metadata":{"annotations":{},"name":"imagepull-aliyun-sa","namespace":"default"}}
  creationTimestamp: "2022-09-07T02:31:05Z"
  name: imagepull-aliyun-sa
  namespace: default
  resourceVersion: "226300"
  uid: fabc93b1-572c-4703-a2dd-465d4e0915cb
secrets:
- name: imagepull-aliyun-sa-token-vf67z

2.6Pod引用ServiceAccount

root@ks-master01-10:~# cat pod-serviceaccount-secret.yaml 
apiVersion: v1
kind: Pod
metadata:
  name: stree-serviceaccount   
spec:
  serviceAccount: imagepull-aliyun-sa   # 這裡則是創建的sa的名稱
  containers:
  - name: stree
    image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest
root@ks-master01-10:~/rbac# kubectl apply -f pod-serviceaccount-secret.yaml 
pod/stree-serviceaccount created

3.創建Pod測試；

3.1查看Pod

root@ks-master01-10:~# kubectl get pods
NAME                                      READY   STATUS    RESTARTS       AGE
stree-serviceaccount                      1/1     Running   0              8s

3.2describe查看事件

root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
  Type    Reason     Age    From               Message
  ----    ------     ----   ----               -------
  Normal  Scheduled  3m36s  default-scheduler  Successfully assigned default/stree-serviceaccount to ks-node02-12
  Normal  Pulling    3m35s  kubelet            Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
  Normal  Pulled     3m33s  kubelet            Successfully pulled image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest" in 1.729555429s
  Normal  Created    3m33s  kubelet            Created container stree
  Normal  Started    3m33s  kubelet            Started container stree

3.3查看詳細信息

root@ks-master01-10:~# kubectl get pods stree-serviceaccount -o yaml
  imagePullSecrets:
  - name: aliyun-haitang
  nodeName: ks-node02-12
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: imagepull-aliyun-sa
  serviceAccountName: imagepull-aliyun-sa