我尝试使用秘密从ACR中提取图像,但我无法做到.
我使用azure cli命令创建了资源：
az login
az provider register -n Microsoft.Network
az provider register -n Microsoft.Storage
az provider register -n Microsoft.Compute
az provider register -n Microsoft.ContainerService
az group create --name aksGroup --location westeurope
az aks create --resource-group aksGroup --name aksCluster --node-count 1 --generate-ssh-keys -k 1.9.2
az aks get-credentials --resource-group aksGroup --name aksCluster
az acr create --resource-group aksGroup --name aksClusterRegistry --sku Basic --admin-enabled true
之后我登录并成功将图像推送到本地机器创建的ACR.
docker login aksclusterregistry.azurecr.io
docker tag jetty aksclusterregistry.azurecr.io/jetty
docker push aksclusterregistry.azurecr.io/jetty
下一步是创建一个秘密：
kubectl create secret docker-registry secret --docker-server=aksclusterregistry.azurecr.io --docker-username=aksClusterRegistry --docker-password=
最后我尝试使用ACR中的图像创建pod：
#pod.yml
apiVersion: v1
kind: Pod
metadata:
name: jetty
spec:
containers:
- name: jetty
image: aksclusterregistry.azurecr.io/jetty
imagePullSecrets:
- name: secret
kubectl create -f pod.yml
结果我有一个状态为ImagePullBackOff的pod：
>kubectl get pods
NAME READY STATUS RESTARTS AGE
jetty 0/1 ImagePullBackOff 0 1m
> kubectl describe pod jetty
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 2m default-scheduler Successfully assigned jetty to aks-nodepool1-62963605-0
Normal SuccessfulMountVolume 2m kubelet,aks-nodepool1-62963605-0 MountVolume.SetUp succeeded for volume "default-token-w8png"
Normal Pulling 2m (x2 over 2m) kubelet,aks-nodepool1-62963605-0 pulling image "aksclusterregistry.azurecr.io/jetty"
Warning Failed 2m (x2 over 2m) kubelet,aks-nodepool1-62963605-0 Failed to pull image "aksclusterregistry.azurecr.io/jetty": rpc error: code = Unknown desc = Error response from daemon: Get https://aksclusterregistry.azurecr.io/v2/jetty/manifests/latest: unauthorized: authentication required
Warning Failed 2m (x2 over 2m) kubelet,aks-nodepool1-62963605-0 Error: ErrImagePull
Normal BackOff 2m (x5 over 2m) kubelet,aks-nodepool1-62963605-0 Back-off pulling image "aksclusterregistry.azurecr.io/jetty"
Normal SandboxChanged 2m (x7 over 2m) kubelet,aks-nodepool1-62963605-0 Pod sandbox changed,it will be killed and re-created.
Warning Failed 2m (x6 over 2m) kubelet,aks-nodepool1-62963605-0 Error: ImagePullBackOff
怎么了？为什么秘密的方法不起作用？
请不要建议我与服务主管的方法,因为我想了解为什么这个方法不起作用.我认为它必须有效.
这对我来说也很好看.也就是说,建议不要使用管理员帐户,而应使用服务原则.通过SP,您可以获得对ACR实例(读取,贡献者,所有者)的访问权限的精细控制.
该文档包括两种使用服务原则在AKS和ACR之间进行身份验证的方法.
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-aks
