kubernetes第一次启动容器时，STATUS一直显示ContainerCreating

kubernetes第一次启动容器时，STATUS一直显示ContainerCreating

具体信息显示：image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request. details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)

• mysql-rc.yaml配置文件

apiVersion: v1
kind: ReplicationController
metadata: 
  name: mysql
spec:
  replicas: 1
  selector:
    app: mysql
  template:
    metadata:
      labels:
        app: mysql
    spec:
      containers:
      - name: mysql
        igame: mysql
        ports:
        - containerPort: 3306
        env:
        - name: MYSQL_ROOT_PASSWORD
          value: "123456"

• 启动后，查看容器状态一直显示创建中…

[root@localhost ~]# kubectl create -f mysql-rc.yaml 
replicationcontroller "mysql" created
[root@localhost ~]# kubectl get rc
NAME      DESIRED   CURRENT   READY     AGE
mysql     1         1         0         10s
[root@localhost ~]# kubectl get pods
NAME          READY     STATUS              RESTARTS   AGE
mysql-9456c   0/1       ContainerCreating   0          17s

• 查看具体信息

[root@localhost ~]# kubectl describe pod mysql-9456c
Name:           mysql-9456c
Namespace:      default
Node:           127.0.0.1/127.0.0.1
Start Time:     Mon, 04 Mar 2019 15:14:07 +0800
Labels:         app=mysql
Status:         Pending
IP:
Controllers:    ReplicationController/mysql
Containers:
  mysql:
    Container ID:
    Image:              mysql
    Image ID:
    Port:               3306/TCP
    State:              Waiting
      Reason:           ContainerCreating
    Ready:              False
    Restart Count:      0
    Volume Mounts:      <none>
    Environment Variables:
      MYSQL_ROOT_PASSWORD:      123456
Conditions:
  Type          Status
  Initialized   True 
  Ready         False 
  PodScheduled  True 
No volumes.
QoS Class:      BestEffort
Tolerations:    <none>
Events:
  FirstSeen     LastSeen        Count   From                    SubObjectPath   Type            Reason          Message
  ---------     --------        -----   ----                    -------------   --------        ------          -------
  3m            3m              1       {default-scheduler }                    Normal          Scheduled       Successfully assigned mysql-9456c to 127.0.0.1
  3m            48s             5       {kubelet 127.0.0.1}                     Warning         FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ErrImagePull: "image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)"

  3m    7s      13      {kubelet 127.0.0.1}             Warning FailedSync      Error syncing pod, skipping: failed to "StartContainer" for "POD" with ImagePullBackOff: "Back-off pulling image \"registry.access.redhat.com/rhel7/pod-infrastructure:latest\""

• 找到了报错信息,翻译一下意思是，拉镜像的时候需要证书，但是本地没有

image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)

• 系统上找一下，发现是软连接，实际没有对应的文件
  
• yum装一下试试
  
• 提示和另外的包冲突了
  
• 这里有一个大坑要注意了！卸载现有rhsm包后重新安装，以得到redhat-uep.pem证书文件。但是注意，连带docker与kubernetes相关部分组件也会被删除！
• 最好的办法是从rpm安装包里导出来证书文件,完美解决！

[root@localhost ca]# wget https://mirrors.aliyun.com/centos/7.6.1810/os/x86_64/Packages/python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm
[root@localhost ca]# ls
python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm
[root@localhost ca]# rpm2cpio python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm |cpio -iv --to-stdout ./etc/rhsm/ca/redhat-uep.pem > redhat-uep.pem
[root@localhost ca]# ls
python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm  redhat-uep.pem
root@localhost ca]# ls -lh /etc/docker/certs.d/registry.access.redhat.com
total 0
lrwxrwxrwx 1 root root 27 Mar  4 15:00 redhat-ca.crt -> /etc/rhsm/ca/redhat-uep.pem