从 Kube.netes 中的私有容器注册表 (Harbor) 拉取镜像

Question

I am using Harbor ( https://goharbor.io/ ) for private container registry. I run the Harbor using docker compose, and it is working fine. I can push/ pull images to this private registry using a VM. I already used 'docker login' command to login into this Harbor repository.

For Kube.netes, I am using k3s.

Now, I want to create a pod in Kube.netes using the image in this Harbor private repository. I referred to Harbor & Kube.netes documentations ( https://goharbor.io/docs/1.10/working-with-projects/working-with-images/pulling-pushing-images/ ) & ( https://kube.netes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ ) to pull the image.

As mentioned in Harbor documentation:

Kube.netes users can easily deploy pods with images stored in Harbor. The settings are similar to those of any other private registry. There are two issues to be aware of:

When your Harbor instance is hosting HTTP and the certificate is self-signed, you must modify daemon.json on each work node of your cluster. For information, see https://docs.docker.com/registry/insecure/#deploy-a-plain-http-registry .

If your pod references an image under a private project, you must create a secret with the credentials of a user who has permission to pull images from the project. For information, see https://kube.netes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ .

I created the daemon.json file in /etc/docker:

{
  "insecure-registries" : "my-harbor-server:443"
}

As mentioned in Kube.netes documentation, I created the Secret using this command:

kubectl create secret generic regcred \
    --from-file=.dockerconfigjson=<path/to/.docker/config.json> \
    --type=kubernetes.io/dockerconfigjson

Then I used a file called pod.yml to create pod (using kubectl apply -f pod.yml):

apiVersion: v1
kind: Pod
metadata:
  name: myapp
spec:
  containers:
    - name: myapp
      image: my-harbor-server/my-project/mayapp:v1.0
  imagePullSecrets:
    - name: regcred

However, when I checked the pod status, it is showing 'ImagePullBackOff'. The pod logs shows:

Error from server (BadRequest): container "myapp" in pod "myapp" is waiting to start: trying and failing to pull image

Is there any other step that I have to do to pull this image from Harbor private repository into Kube.netes? What is the reason that I cannot pull this image from Harbor private repository into Kube.netes?

Answer 1

The /etc/docker/daemon.json file configures the docker engine. If your CRI is not the docker shim, them this file will not apply to Kube.netes. For k3s, that is configured using /etc/rancher/k3s/registries.yaml . See https://rancher.com/docs/k3s/latest/en/installation/private-registry/ for details on configuring this file. It needs to be performed on each host.