K8S部署应用时从harbor拉取镜像失败

问题描述

K8S部署服务拉取镜像失败：ImagePullBackOff
K8S拉取镜像提示：Failed to pull image “IP:PORT/zcy-project/nginx:1.16.1”: rpc error: code = Unknown desc = Error response from daemon: unauthorized: unauthorized to access repository: zcy-project/nginx, action: pull: unauthorized to access repository:
使用命令部署服务：

kubectl run nginx-deployment-6 --image=192.168.10.136:8080/zcy-project/nginx:1.16.2 --port=80 --replicas=2
kubectl get pod
kubectl describe pod nginx-deployment-6

查看部署结果：

这里的状态STATUS：ImagePullBackOff

可以看到错误提示：

Failed to pull image “IP:PORT/zcy-project/nginx:1.16.1”: rpc error: code = Unknown desc = Error response from daemon: unauthorized: unauthorized to access repository: zcy-project/nginx, action: pull: unauthorized to access repository:

问题排查：

1. 用docker login测试过账户、密码、Registry、镜像均无误

docker login 192.168.10.136:8080

2. 每个Node都用docker直接拉取：

docker pull 192.168.10.136:8080/zcy-project/nginx:1.16.1

3. 使用imagePullSecrets
   创建一个secrete资源对象。以下示例中 registry-harbor 为secret资源对象的名称。除了邮箱可以随便填，其它三个需要使用实际的harbor地址和账号。

kubectl create secret docker-registry registry-harbor \
    --docker-server=192.168.10.136 \
    --docker-username=admin \
    --docker-password='123.com' \
    --docker-email=foo@bar.com

4. 在pod的yaml定义文件中使用 imagePullSecrets 引用secret

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment-6
spec:
  replicas: 2
  selector:
    matchLabels:
      app: nginx
      env: uat
  template:
    metadata:
      labels:
      	app: nginx
        env: uat
    spec:
      containers:
      - name: nginx
        image: 192.168.10.136:8080/zcy-project/nginx:1.16.2
        ports:
        - containerPort: 80
      imagePullSecrets:
      - name: registry-harbor

5. 创建pod测试能否正常拉取
   kubectl create -f xxx.yaml