k8s集群使用私有镜像仓库

本次演示，使用的是百度智能云“容器引擎CCE”和“容器镜像服务CCR产品”

可参考官方文档：从私有仓库拉取镜像 | Kubernetes

创建凭证 Secret

在通过yaml创建容器时拉取私有镜像仓库镜像，需要在镜像仓库上进行身份验证，可以通过两个方式实现：

方法1：创建一个基于现有凭证的 Secret

     通过docker login登录镜像仓库

[root@wzx-master ~]# docker login --username=bfaa7a3****4645b94f80e3a9b27480 registry.baidubce.com
Password: 
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

Kubernetes 集群使用 kubernetes.io/dockerconfigjson 类型的 Secret 来通过镜像仓库的身份验证，进而提取私有镜像。

如果你已经在机器上运行了 docker login 命令，你可以复制该镜像仓库的凭证到 Kubernetes:

[root@wzx-master ~]# kubectl create secret generic wzx-my-secret \
>    --from-file=.dockerconfigjson=/root/.docker/config.json \
>    --type=kubernetes.io/dockerconfigjson
secret/wzx-my-secret created

需要注意：需要将/root/.docker/config.json替换为你实际使用的Docker配置文件路径

可以通过get secret查看已创建的secret

[root@wzx-master ~]# kubectl get secret 
NAME                  TYPE                                  DATA   AGE
default-token-z9b8v   kubernetes.io/service-account-token   3      33d
my-auth-secret        kubernetes.io/dockerconfigjson        1      20h
wzx-my-secret         kubernetes.io/dockerconfigjson        1      2m26s

通过describe查看secret详细配置

[root@wzx-master ~]# kubectl describe secret wzx-my-secret
Name:         wzx-my-secret
Namespace:    default
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  121 bytes

可以看到secret是有Namespace限制的

如创建时没有指定Namespace，会在默认的default空间创建，如果需要指定Namespace，可以追加 -n my-namespace来指定Namespace

方法2：在命令行上提供凭证来创建 Secret

[root@wzx-master ~]# kubectl create secret docker-registry regcred \
>   --docker-server=registry.baidubce.com \
>   --docker-username=bfaa7a30ed*******b94f80e3a9b27480 \
>   --docker-password=****** \
>   -n kube-system
secret/regcred created

注释：

• --docker-server 是你的私有 Docker 仓库全限定域名（FQDN）； DockerHub 使用 https://index.docker.io/v1/
• --docker-username 是你的 Docker 用户名
• --docker-password 是你的 Docker 密码
• -n指定Namespace

查看创建的secret

[root@wzx-master ~]# kubectl get secret -n kube-system
regcred                                                kubernetes.io/dockerconfigjson        1      118s

describe查看

[root@wzx-master ~]# kubectl describe secret regcred -n kube-system
Name:         regcred
Namespace:    kube-system
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  171 bytes

创建一个使用你的 Secret 的 Pod

[root@wzx-master ~]# vim nginx-wzx.yaml 

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  containers:
  - name: my-app-container
    image: registry.baidubce.com/wzx/nginx # 镜像名称，其中 registry.example.com 是私有镜像仓库的地址
    ports:
    - containerPort: 80
  imagePullSecrets: # 指定镜像仓库的认证信息
  - name: wzx-auth-secret # 上述命令中创建的 Secret 的名称

创建pod

[root@wzx-master ~]# kubectl create -f nginx-wzx.yaml 
pod/my-app created

查看pod

[root@wzx-master ~]# kubectl get pod my-app -n default
NAME     READY   STATUS    RESTARTS   AGE
my-app   1/1     Running   0          7s

 describe查看pod详情

[root@wzx-master ~]# kubectl describe pod my-app -n default
Name:         my-app
Namespace:    default
Priority:     0
Node:         172.17.1.13/172.17.1.13
Start Time:   Tue, 25 Apr 2023 14:26:16 +0800
Labels:       <none>
Annotations:  <none>
Status:       Running
IP:           172.16.3.20
IPs:
  IP:  172.16.3.20
Containers:
  my-app-container:
    Container ID:   docker://ffe96f98c638ccfaf9f9394e6ba8b2b7f1302fcfb5b25f2cee7465a935701546
    Image:          registry.baidubce.com/wzx/nginx
    Image ID:       docker-pullable://registry.baidubce.com/wzx/nginx@sha256:f2fee5c7194cbbfb9d2711fa5de094c797a42a51aa42b0c8ee8ca31547c872b1
    Port:           80/TCP
    Host Port:      0/TCP
    State:          Running
      Started:      Tue, 25 Apr 2023 14:26:17 +0800
    Ready:          True
    Restart Count:  0
    Environment:    <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-bxvb5 (ro)
Conditions:
  Type              Status
  Initialized       True 
  Ready             True 
  ContainersReady   True 
  PodScheduled      True 
Volumes:
  kube-api-access-bxvb5:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type    Reason     Age   From               Message
  ----    ------     ----  ----               -------
  Normal  Scheduled  55s   default-scheduler  Successfully assigned default/my-app to 172.17.1.13
  Normal  Pulling    54s   kubelet            Pulling image "registry.baidubce.com/wzx/nginx"
  Normal  Pulled     54s   kubelet            Successfully pulled image "registry.baidubce.com/wzx/nginx" in 304.333941ms
  Normal  Created    54s   kubelet            Created container my-app-container
  Normal  Started    54s   kubelet            Started container my-app-container