前面可以通過ImagPullPolicy和ImageullSecrets指定下載鏡像的策略，ServiceAccount也可以基于spec.imagePullSecret字段附帶一個(gè)由下載鏡像專用的Secret資源組成的列表，用于在容器創(chuàng)建時(shí)，從某個(gè)私有鏡像倉庫下載鏡像文件之前的服務(wù)認(rèn)證。
1.創(chuàng)建Secrets資源
這里根據(jù)自己的實(shí)際去定義即可；一定要是對(duì)方的地址和認(rèn)證信息；否則無法pull/push
root@ks-master01-10:~# kubectl create secret Docker-registry
> aliyun-haitang-registry
> --docker-server=registry.cn-hangzhou.aliyuncs.com
> --docker-username=xxxxxxx
> --docker-password=xxxxxx
secret/aliyun-haitang-registry created
1.1查看Secrets
root@ks-master01-10:~# kubectl describe secret aliyun-haitang
Name: aliyun-haitang
Namespace: default
Labels: <none>
Annotations: <none>
Type: kube.NETes.io/dockerconfigjson
Data
====
.dockerconfigjson: 140 bytes
2.創(chuàng)建ServiceAccount
2.1不設(shè)置任何策略，測(cè)試是否能拉取私有倉庫鏡像
此處不配置任何鏡像拉取策略，測(cè)試是否能拉取私有倉庫鏡像；
root@ks-master01-10:~# cat pod-serviceaccount-secret.yaml
apiVersion: v1
kind: Pod
metadata:
name: stree-serviceaccount
spec:
containers:
- name: stree
image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest
2.2查看Pod，處于ErrImage
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
stree-serviceaccount 0/1 ErrImagePull 0 8s
2.3describe查看Events
可以看到事件，是Docker認(rèn)證的問題；
root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 20s default-scheduler Successfully assigned default/stree-serviceaccount to ks-node02-12
Normal BackOff 17s kubelet Back-off pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Warning Failed 17s kubelet Error: ImagePullBackOff
Normal Pulling 2s (x2 over 19s) kubelet Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Warning Failed 2s (x2 over 18s) kubelet Failed to pull image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for registry.cn-hangzhou.aliyuncs.com/lengyuye/stress, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Warning Failed 2s (x2 over 18s) kubelet Error: ErrImagePull
2.4創(chuàng)建ServiceAccount
aliyun-haitang是docker-registry類型的Secrets對(duì)象，由用戶提前手動(dòng)創(chuàng)建，它可以通過鍵值數(shù)據(jù)提供docker倉庫服務(wù)器的地址，接入服務(wù)器的用戶名，密碼及用戶的電子郵件信息等，認(rèn)證通過后，引用ServiceAccount的Pod資源即可從指定的鏡像倉庫下載image。
root@ks-master01-10:~# cat serviceaccount-imagepullsecret.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: imagepull-aliyun-sa
imagePullSecrets:
- name: aliyun-haitang
root@ks-master01-10:~# kubectl Apply -f serviceaccount-imagepullsecret.yaml
serviceaccount/imagepull-aliyun-sa created
2.5查看SA
root@ks-master01-10:~# kubectl get sa imagepull-aliyun-sa -o yaml
apiVersion: v1
imagePullSecrets:
- name: aliyun-haitang
kind: ServiceAccount
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","imagePullSecrets":[{"name":"aliyun-haitang"}],"kind":"ServiceAccount","metadata":{"annotations":{},"name":"imagepull-aliyun-sa","namespace":"default"}}
creationTimestamp: "2022-09-07T02:31:05Z"
name: imagepull-aliyun-sa
namespace: default
resourceVersion: "226300"
uid: fabc93b1-572c-4703-a2dd-465d4e0915cb
secrets:
- name: imagepull-aliyun-sa-token-vf67z
2.6Pod引用ServiceAccount
root@ks-master01-10:~# cat pod-serviceaccount-secret.yaml
apiVersion: v1
kind: Pod
metadata:
name: stree-serviceaccount
spec:
serviceAccount: imagepull-aliyun-sa # 這里則是創(chuàng)建的sa的名稱
containers:
- name: stree
image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest
root@ks-master01-10:~/rbac# kubectl apply -f pod-serviceaccount-secret.yaml
pod/stree-serviceaccount created
3.創(chuàng)建Pod測(cè)試；
3.1查看Pod
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
stree-serviceaccount 1/1 Running 0 8s
3.2describe查看事件
root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 3m36s default-scheduler Successfully assigned default/stree-serviceaccount to ks-node02-12
Normal Pulling 3m35s kubelet Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Normal Pulled 3m33s kubelet Successfully pulled image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest" in 1.729555429s
Normal Created 3m33s kubelet Created container stree
Normal Started 3m33s kubelet Started container stree
3.3查看詳細(xì)信息
root@ks-master01-10:~# kubectl get pods stree-serviceaccount -o yaml
imagePullSecrets:
- name: aliyun-haitang
nodeName: ks-node02-12
preemptionPolicy: PreemptLowerPriority
priority: 0
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: imagepull-aliyun-sa
serviceAccountName: imagepull-aliyun-sa
