时间戳

首页 > 解决方案 > 为什么 Kubernetes 没有将我的秘密附加到我的 pod 中？

docker - 为什么 Kubernetes 没有将我的秘密附加到我的 pod 中？

问题描述

我已经按照 Kubernetes 的建议创建了我的秘密并按照教程进行操作，但是 pod 没有附加我的秘密。

如您所见，我创建了秘密并对其进行了描述。在我创建了我的 pod 之后。

$ kubectl get secret my-secret --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
{"auths":{"my-private-repo.com":{"username":"<username>","password":"<password>","email":"<email>","auth":"<randomAuth>="}}}

$ kubectl create -f my-pod.yaml
pod "my-pod" created

$ kubectl describe pods trunfo
Name:         my-pod
Namespace:    default
Node:         gke-trunfo-default-pool-07eea2fb-3bh9/10.233.224.3
Start Time:   Fri, 28 Sep 2018 16:41:59 -0300
Labels:       <none>
Annotations:  kubernetes.io/limit-ranger=LimitRanger plugin set: cpu request for container container-trunfo
Status:       Pending
IP:           10.10.1.37
Containers:
  container-trunfo:
    Container ID:   
    Image:          <my-image>
    Image ID:       
    Port:           9898/TCP
    State:          Waiting
      Reason:       ErrImagePull
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:        100m
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-hz4mf (ro)
Conditions:
  Type           Status
  Initialized    True 
  Ready          False 
  PodScheduled   True 
Volumes:
  default-token-hz4mf:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-hz4mf
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason                 Age   From                                            Message
  ----     ------                 ----  ----                                            -------
  Normal   Scheduled              4s    default-scheduler                               Successfully assigned trunfo to gke-trunfo-default-pool-07eea2fb-3bh9
  Normal   SuccessfulMountVolume  4s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  MountVolume.SetUp succeeded for volume "default-token-hz4mf"
  Normal   Pulling                3s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  pulling image "my-private-repo.com/my-image:latest"
  Warning  Failed                 3s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  Failed to pull image "my-private-repo.com/my-image:latest": rpc error: code = Unknown desc = Error response from daemon: Get https://my-private-repo.com/v1/_ping: dial tcp: lookup my-private-repo.com on 169.254.169.254:53: no such host
  Warning  Failed                 3s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  Error: ErrImagePull
  Normal   BackOff                3s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  Back-off pulling image "my-private-repo.com/my-image:latest"
  Warning  Failed                 3s    kubelet, gke-trunfo-default-pool-07eea2fb-3bh9  Error: ImagePullBackOff

我能做些什么来解决它？

编辑

这是我的吊舱：

apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: my-container
    image: my-private-repo/images/<my-image>
    ports:
    - containerPort: 9898
  imagePullSecrets:
  - name: my-secret

正如我们所看到的，秘密是按预期定义的，但没有正确附加。

标签： dockerkubernetes

解决方案

你还没有得到秘密。你的日志说

无法提取图像“my-private-repo.com/my-image:latest”：rpc 错误：代码 = 未知 desc = 来自守护进程的错误响应：获取https://my-private-repo.com/v1/_ping：拨打 tcp：在 169.254.169.254:53 上查找 my-private-repo.com：没有这样的主机 警告 3s kubelet 失败，gke-trunfo-default-pool-07eea2fb-3bh9 错误：ErrImagePull

这意味着您的 pod 无法启动事件，因为图像不可用。解决这个问题，如果在观察者 pod 状态“准备好”发布您的 yaml 定义后，您仍然有秘密问题。

推荐阅读