k8s拉取harbor仓库镜像

目录

• 1. 修改containerd配置文件
• 2. 重启containerd
• 3. 验证
• 4. 给containerd配置docker镜像加速器

由于现在国内无法连接dockerhub，所以镜像也是拉取不到的，所以需要去拉取本地仓库的地址

k8s版本 1.26

如果直接去指定harbor的地址的话是会失败的

[root@master containerd]# kubectl run tomcat1 --image 192.168.200.200:5000/test/tomcat:latest --image-pull-policy IfNotPresent
pod/tomcat1 created
[root@master containerd]# kubectl get pods
NAME      READY   STATUS         RESTARTS   AGE
tomcat1   0/1     ErrImagePull   0          6s

查看失败的原因

[root@master ~]# kubectl describe pods/tomcat1
  Warning  Failed     4m45s (x4 over 6m20s)  kubelet            Failed to pull image "192.168.200.200:5000/test/tomcat:latest": rpc error: code = Unknown desc = failed to pull and unpack image "192.168.200.200:5000/test/tomcat:latest": failed to resolve reference "192.168.200.200:5000/test/tomcat:latest": failed to do request: Head "https://192.168.200.200:5000/v2/test/tomcat/manifests/latest": http: server gave HTTP response to HTTPS client
  Warning  Failed     4m45s (x4 over 6m20s)  kubelet            Error: ErrImagePull
  Normal   BackOff    66s (x22 over 6m20s)   kubelet            Back-off pulling image "192.168.200.200:5000/test/tomcat:latest"

他说的意思就是他用的https的请求，但是harbor不支持https，所以报错了，我们现在需要修改配置让他信任harbor

1. 修改containerd配置文件

所有的k8s节点都需要做

[root@master ~]# vim /etc/containerd/config.toml
# 大概是在147行
147     [plugins."io.containerd.grpc.v1.cri".registry.auths]
148 
149       [plugins."io.containerd.grpc.v1.cri".registry.configs]
150           [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.200.200:5000".tls]   # 这里是新增的，端口写你自己的harbor端口
151                 insecure_skip_verify = true
152           [plugins."io.containerd.grpc.v1.cri".registry.configs."192.168.200.200:5000".auth]   # 这里是新增的
153                 username = "admin"                     # 写上你自己的harbor用户名和密码
154                 password = "Harbor12345"

158       [plugins."io.containerd.grpc.v1.cri".registry.mirrors]
159           [plugins."io.containerd.grpc.v1.cri".registry.mirrors."192.168.200.200:5000"]      #新增
160           endpoint = ["http://192.168.200.200:5000"]              # 新增

2. 重启containerd

[root@master ~]# systemctl restart containerd

3. 验证

[root@master ~]# kubectl run tomcat01 --image 192.168.200.200:5000/test/tomcat
pod/tomcat01 created
[root@master ~]# kubectl run tomcat02 --image 192.168.200.200:5000/test/tomcat
pod/tomcat02 created
[root@master ~]# kubectl get pods
NAME       READY   STATUS              RESTARTS   AGE
tomcat01   1/1     Running             0          6s
tomcat02   0/1     ContainerCreating   0          2s

可以看到，镜像已经拉取成功了

[root@master ~]# kubectl describe pods/tomcat01
  ----    ------     ----  ----               -------
  Normal  Scheduled  34s   default-scheduler  Successfully assigned internal/tomcat01 to node1
  Normal  Pulling    33s   kubelet            Pulling image "192.168.200.200:5000/test/tomcat"
  Normal  Pulled     33s   kubelet            Successfully pulled image "192.168.200.200:5000/test/tomcat" in 40.701332ms (40.705439ms including waiting)
  Normal  Created    33s   kubelet            Created container tomcat01
  Normal  Started    33s   kubelet            Started container tomcat01

4. 给containerd配置docker镜像加速器

[root@master calico]# vim /etc/containerd/config.toml
[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."docker.io"]
    endpoint = ["https://xxx.yourdomain.cn"]

写成这个样子，这样他在docker拉取镜像的时候就会使用xxx.yourdomain.cn这个加速器去拉取镜像了