amazon-web-services - 如何在 Kubernetes Yaml 中对 AWS ECR 进行身份验证

Question

我有以下pod.yaml文件，它简单地描述了 Kubernetes pod 的创建：

apiVersion: v1
kind: Pod
metadata:
  name: dotnet-console-producer-poc.pod
  labels:
    app: helloworld
spec:
  containers:
  - name: dotnet-console-producer-pod
    image: 442285873998.dkr.ecr.us-east-1.amazonaws.com/dotnet-console-producer-benchmark-docker:latest
    ports:
    - containerPort: 8001

引用的图像位于 AWS ECR ( 442285873998.dkr.ecr.us-east-1.amazonaws.com/dotnet-console-producer-benchmark-docker:latest) 中。

运行 create resource 命令 ( kubectl create -f pod.yaml) 时，pod 被创建，但由于无法从 AWS ECR 访问图像而崩溃。Kubernetes 错误如下所示：

Failed to pull image "442285873998.dkr.ecr.us-east-1.amazonaws.com/mcflow-dotnet-console-producer-benchmark-docker:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for 442285873998.dkr.ecr.us-east-1.amazonaws.com/mcflow-dotnet-console-producer-benchmark-docker, repository does not exist or may require 'docker login': denied: User: arn:aws:sts::607546651489:assumed-role/nodes.dev.vet-dev.digitalecp.mcd.com/i-055276c817ba7a096 is not authorized to perform: ecr:BatchGetImage on resource: arn:aws:ecr:us-east-1:442285873998:repository/mcflow-dotnet-console-producer-benchmark-docker

我的 Kubernetes 实例在 EC2 实例上运行。如何在 ECR 中进行身份验证，以便 Kubernetes 可以检索图像并在 pod 中运行它？

标签： amazon-web-serviceskubernetes