k8s中imagePullSecrets _image

从来好事天生俭，自古瓜儿苦后甜。这篇文章主要讲述k8s中imagePullSecrets相关的知识，希望能为你提供帮助。
在k8s集群的使用过程中，初学者可能会碰到这样的（怪异）问题：在一个k8s集群里，部署服务（用的私有镜像仓库，如harbor）的时候，只有个别node的服务是部署成功的，其他都是部署失败的，错误的原因就是镜像拉取失败，如下：

kubectl get pods -A -owide |grep jenkins-demo
devlopmentjenkins-demo-67d4f9d666-2fh8k1/1Running027m10.244.2.40local-k8s-nd02
devlopmentjenkins-demo-dbc9f5b6b-h78tx0/1ImagePullBackOff06m4s10.244.6.93local-k8s-nd03
productionjenkins-demo-dbc9f5b6b-tnkfs1/1Running05m47s10.244.2.44local-k8s-nd02
qatestjenkins-demo-67d4f9d666-hb22t1/1Running027m10.244.2.41local-k8s-nd02
qatestjenkins-demo-dbc9f5b6b-d6txr0/1ImagePullBackOff06m10.244.6.94local-k8s-nd03

查看失败详情

# kubectl describe pods -n qatest jenkins-demo-6cbfb64844-79n8l
..........
Events:
TypeReasonAgeFromMessage
-------------------------
NormalScheduled78sdefault-schedulerSuccessfully assigned qatest/jenkins-demo-6cbfb64844-79n8l to local-k8s-nd03
NormalPulling37s (x3 over 78s)kubeletPulling image "dev-hub.jiatuiyun.net/zeng/my-demo:429d9c1"
WarningFailed36s (x3 over 77s)kubeletFailed to pull image "dev-hub.jiatuiyun.net/zeng/my-demo:429d9c1": rpc error: code = Unknown desc = Error response from daemon: pull access denied for dev-hub.jiatuiyun.net/zeng/my-demo, repository does not exist or may require docker login: denied: requested access to the resource is denied
WarningFailed36s (x3 over 77s)kubeletError: ErrImagePull
NormalBackOff6s (x5 over 77s)kubeletBack-off pulling image "dev-hub.jiatuiyun.net/zeng/my-demo:429d9c1"
WarningFailed6s (x5 over 77s)kubeletError: ImagePullBackOff

【k8s中imagePullSecrets】 然后我们去镜像拉取失败的机器上，直接用命令拉取，竟然是ok的

# docker pull dev-hub.jiatuiyun.net/zeng/my-demo:eb7ec1d
eb7ec1d: Pulling from zeng/my-demo
4fe2ade4980c: Already exists
2e793f0ebe8a: Already exists
77995fba1918: Already exists
4495499e856d: Already exists
0ff8f8e34aa6: Already exists
6c24ea7b9085: Pull complete
c07b8e5ec47b: Pull complete
Digest: sha256:95077089b59358820c4c763ae8bc390e470c62ac3d212abfe38292ff6389c7bb
Status: Downloaded newer image for dev-hub.jiatuiyun.net/zeng/my-demo:eb7ec1d
dev-hub.jiatuiyun.net/zeng/my-demo:eb7ec1d

同一个集群，同一个镜像仓库的同一个镜像，只是node不同而已，个别node拉取镜像ok，其余node拉取镜像失败，为何？其实这个问题的原因就处在，服务的部署文件里边没有配置拉取镜像用的secret，在服务配置文件中的名字是 imagePullSecrets 如下：

.....
spec:
imagePullSecrets:
- name: registry-pull-secret
containers:
- image: dev-hub.xxxxx.net/zeng/my-demo:
imagePullPolicy: IfNotPresent
name: jenkins-demo
.....

注意：如果服务分布在多个不同的namespace下，那在这些namespace下都要创建secret至于secret如何创建就不在此赘述了，网上很多可以参考的资料。