4

Harbor镜像拉取凭证配置

 1 year ago
source link: https://blog.51cto.com/lidabai/5373261
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

镜像拉取凭证

主题：在k8s创建Pod过程中，从Harbor私有镜像仓库下载镜像。Harbor的私有镜像为保证镜像的安全性，需要通过配置Secret才可以从Harbor下载镜像。公有仓库不需要配置。

之前在我的专栏《Harbor宝典》中分享了Harbor系列的文章。

本期将继续分享在k8s的容器内如何拉取Harbor中的私有镜像。

Harbor中公有的镜像我们可以随便拉取，但是一些私有的镜像无法直接拉取到。我们可以使用Secret资源对象来拉取私有镜像，以下为详细的操作步骤。

Harbor地址： https://192.168.2.250:443

Harbor用户：admin

Harbor密码：Harbor12345

文末记录遇到的问题及解决办法！

1、登录Harbor

登录成功后会在~/.docker/config.json文件中记录登录信息，然后基于该信息创建Secret，容器中通过imagePullSecret指定该Secret来实现认证，从而拉取私有镜像。

如果登录Harbor失败，请查看专栏的问题解决。

# docker  login  -u admin -p Harbor12345 192.168.2.250:443
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
WARNING! Your password will be stored unencrypted in /root/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store
Login Succeeded       //登录成功



# cat ~/.docker/config.json
{
  "auths": {
    "192.168.2.250:443": {
      "auth": "YWRtaW46SGFyYm9yMTIzNDU="
    }
  },
  "HttpHeaders": {
    "User-Agent": "Docker-Client/19.03.8 (linux)"
  }
}



2、用BASH64编码解析密钥数据



        一下创建Secret的时候需要用到解析出来的结果；-w 0 表示生成秘钥不转行，默认转行不是正确的格式会出错。       



# cat ~/.docker/config.json  | base64 -w 0
ewoJImF1dGhzIjogewoJCSIxOTIuMTY4LjIuMjUwOjQ0MyI6IHsKCQkJImF1dGgiOiAiWVdSdGFXNDZTR0Z5WW05eU1USXpORFU9IgoJCX0KCX0sCgkiSHR0cEhlYWRlcnMiOiB7CgkJIlVzZXItQWdlbnQiOiAiRG9ja2VyLUNsaWVudC8xOS4wMy44IChsaW51eCkiCgl9Cn0=



3、创建Secret镜像拉取凭证



         .dockerconfigjson的值就是第2步解析的结果（将结果复制到该处）



# vim  harbor-image-secret.yaml
apiVersion: v1
kind: Secret
metadata:
  name: harbor-pull
type: kubernetes.io/dockerconfigjson
data:
  .dockerconfigjson: ewoJImF1dGhzIjogewoJCSIxOTIuMTY4LjIuMjUwOjQ0MyI6IHsKCQkJImF1dGgiOiAiWVdSdGFXNDZTR0Z5WW05eU1USXpORFU9IgoJCX0KCX0sCgkiSHR0cEhlYWRlcnMiOiB7CgkJIlVzZXItQWdlbnQiOiAiRG9ja2VyLUNsaWVudC8xOS4wMy44IChsaW51eCkiCgl9Cn0=



# kubectl apply  -f harbor-image-secret.yaml 
secret/harbor-pull created
# kubectl get secret
NAME                  TYPE                                  DATA   AGE
default-token-qqjxn   kubernetes.io/service-account-token   3      13d
harbor-pull           kubernetes.io/dockerconfigjson        1      52s



         命令行创建secret的方法见kubectl create secret -h来创建，本处不详细说明了。



4、容器中使用镜像拉取凭证来拉取私有镜像



          本处以拉取私有镜像192.168.2.250:443/muli/tomcat:8.5.34-jre8-alpine为例。



# cat tomcat-pod1.yaml
kind: Pod
apiVersion: v1
metadata: 
  name: tomcat-v2.3.1
  namespace: test
spec: 
  imagePullSecrets:
   - name: image-secret
     containers: 
   - name: tomcat-po
     image: 192.168.2.250:443/muli/tomcat:8.5.34-jre8-alpine
     imagePullPolicy: IfNotPresent
# kubectl apply -f   tomcat-pod1.yaml
pod/tomcat-v2.3.1 created
# kubectl get pods
NAME            READY   STATUS    RESTARTS   AGE
tomcat-v2.3.1   1/1     Running   0          20h




        

        

            

                report
            

        

    







        
Recommend

        



                

    
About Joyk

    
 





Aggregate valuable and interesting links.

Joyk means Joy of geeK