前言

其實這次實踐算不上特別複雜，只是在實踐過程中遇到了一些坑，以及填坑的方法是非常值得在以後的學習過程中參考借鑑的

知識準備

1.harbor是一個企業級的映象倉庫，它比起docker registry提供了更多的功能 2.在私有倉庫中的映象是需要經過一系列的驗證才能夠被pull，比如insecure-registries等 3.本文主要描述通過k8s的secret來進行驗證

環境準備

建立secret

[email protected]
 
:~# kubectl create secret docker-registry regcred \
>         --docker-server=repo.mrvolleyball.com/library \
>         --docker-username=admin \
>         --docker-password='Harbor12345' \
>         [email protected]
secret "regcred" created

[email protected]:~# kubectl apply -f <(echo 'apiVersion: v1
> kind: Pod
> metadata:
>   name: private-reg
> spec:
>   containers:
>   - name: private-reg-container
>     image: repo.mrvolleyball.com/library/busybox:latest
>   imagePullSecrets:
>   - name: regcred')
pod "private-reg" created
 

根本沒有難度啊，2條命令解決，當我滿懷欣喜的檢視狀態的時候：

[email protected]:~# kubectl get pods private-reg
NAME          READY     STATUS             RESTARTS   AGE
private-reg   0/1       ImagePullBackOff   0          11s

[email protected]:~# kubectl describe pods private-reg
...
Events:
  Type     Reason                 Age                From                 Message
  ----     ------                 ----               ----                 -------
  Normal   Scheduled              40s                default-scheduler    Successfully assigned private-reg to k8s-master
  Normal   SuccessfulMountVolume  40s                kubelet, k8s-master  MountVolume.SetUp succeeded for volume "default-token-v9nkm"
  Normal   SandboxChanged         38s                kubelet, k8s-master  Pod sandbox changed, it will be killed and re-created.
  Normal   Pulling                22s (x2 over 39s)  kubelet, k8s-master  pulling image "repo.mrvolleyball.com/library/busybox:latest"
  Warning  Failed                 22s (x2 over 38s)  kubelet, k8s-master  Failed to pull image "repo.mrvolleyball.com/library/busybox:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for repo.mrvolleyball.com/library/busybox, repository does not exist or may require 'docker login'
  Warning  Failed                 22s (x2 over 38s)  kubelet, k8s-master  Error: ErrImagePull
  Normal   BackOff                6s (x4 over 36s)   kubelet, k8s-master  Back-off pulling image "repo.mrvolleyball.com/library/busybox:latest"
  Warning  Failed                 6s (x4 over 36s)   kubelet, k8s-master  Error: ImagePullBackOff
 

這簡直是給了當頭一棒啊，我反反覆覆的檢查之後，使用者名稱、密碼、倉庫地址，官網提供的命令，都沒問題啊，這TM到底是幾個意思！！

在我一遍又一遍的check中發現了蛛絲馬跡

[email protected]:~# kubectl get secret regcred  -o yaml
apiVersion: v1
data:
  .dockercfg: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
  creationTimestamp: 2018-10-29T09:33:40Z
  name: regcred
  namespace: default
  resourceVersion: "7670942"
  selfLink: /api/v1/namespaces/default/secrets/regcred
  uid: b82b7527-db5d-11e8-9e67-b2aca3e7fa90
type: kubernetes.io/dockercfg

官網提供的資訊：

apiVersion: v1
data:
  .dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
kind: Secret
metadata:
  ...
  name: regcred
  ...
type: kubernetes.io/dockerconfigjson

細心的朋友已經看出來了： 通過命令建立的data是.dockercfg，並且型別也不同：type: kubernetes.io/dockercfg 而官網提供的的data是.dockerconfigjson，型別是：type: kubernetes.io/dockerconfigjson

細微差別，千里之外啊，趕緊改了試一試：

[email protected]:~# kubectl get secret regcred  -o yaml > secret.yaml

修改之：

[email protected]:~# more secret.yaml
apiVersion: v1
data:
  .dockerconfigjson: eyJhdXRocyI6eyJqZC1yZXBvLmludC5hbmtlcmppZWRpYW4uY29tIjp7InVzZXJuYW1lIjoiYWRtaW4iLCJwYXNzd29yZCI6IkhhcmJvcjEyMzQ1IiwiZW1haWwiOiJ5dXhpYW9jQGp1bWVpLmNvbSIsImF1dGgiOiJZV1J0YVc0NlNHRnlZbTl5TVRJek5EVT0ifX19
kind: Secret
metadata:
  name: regcred
  namespace: default
  selfLink: /api/v1/namespaces/default/secrets/regcred
type: kubernetes.io/dockerconfigjson

然後重建之：

[email protected]:~# kubectl delete secret regcred
[email protected]:~# kubectl create -f secret.yaml
[email protected]:~# kubectl delete -f <(echo 'apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: repo.mrvolleyball.com/library/busybox:latest
  imagePullSecrets:
  - name: regcred')
pod "private-reg" deleted
[email protected]:~# kubectl apply -f <(echo 'apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: repo.mrvolleyball.com/library/busybox:latest
  imagePullSecrets:
  - name: regcred')
pod "private-reg" created

[email protected]:~# kubectl get pods private-reg
NAME          READY     STATUS    RESTARTS   AGE
private-reg   1/1       Running   0          15s

終於，達到了需要的效果

小結

● 再詳細的文件也需要一步一步實踐，只有實踐了，才是自己的知識，否則就是人云亦云 ● 看文件一定要非常仔細，而且要對比對比在對比，如果你確定了和文件的一樣沒問題，做出來的依然錯誤，就去提issue吧

至此，本文結束 在下才疏學淺，有撒湯漏水的，請各位不吝賜教...