k8s ImagePullBackOff的原因

kubernetes如果遇到ImagePullBackOff该如何排查呢？

状态

$ kubectl get pods
NAME               READY   STATUS             RESTARTS       AGE
sentry-web         0/1     ImagePullBackOff   0              4m55s

ImagePullBackOff代表拉取镜像时被阻塞，最常见的原因是镜像不存在。

原因

使用 kubectl describe pod sentry-web 查看启动细节：

$ kubectl describe pod sentry-web
Name:         sentry-web
Namespace:    default
...省略
Events:
  Type     Reason     Age                    From               Message
  ----     ------     ----                   ----               -------
  Normal   Scheduled  4m50s                  default-scheduler  Successfully assigned default/sentry-web to kind-control-plane
  Normal   Pulling    3m14s (x4 over 4m51s)  kubelet            Pulling image "sentry-self-hosted-local"
  Warning  Failed     3m10s (x4 over 4m44s)  kubelet            Failed to pull image "sentry-self-hosted-local": rpc error: code = Unknown desc = failed to pull and unpack image "docker.io/library/sentry-self-hosted-local:latest": failed to resolve reference "docker.io/library/sentry-self-hosted-local:latest": pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed
  Warning  Failed     3m10s (x4 over 4m44s)  kubelet            Error: ErrImagePull
  Warning  Failed     2m44s (x6 over 4m43s)  kubelet            Error: ImagePullBackOff
  Normal   BackOff    2m29s (x7 over 4m43s)  kubelet            Back-off pulling image "sentry-self-hosted-local"

发现原因是

failed to pull and unpack image "docker.io/library/sentry-self-hosted-local:latest"

结合细节

看我的配置文件：

kind: Pod
apiVersion: v1
metadata:
  name: sentry-web
  labels:
    app: sentry
spec:
  hostNetwork: true
  containers:
    - name: sentry-web
      image: sentry-self-hosted-local

这个镜像只有我本地有，但是他还是去拉远程，原因是我没写tag.

为了让错误更明显，改为只使用本地：

spec:
  hostNetwork: true
  containers:
    - name: sentry-web
      image: sentry-self-hosted-local:latest
      imagePullPolicy: Never  # or IfNotPresent