从公共ECR仓库拉取Helm镜像时出现Socket连接错误

问题详情 #

执行以下命令拉取Karpenter Helm Chart时失败：

helm pull oci://public.ecr.aws/karpenter/karpenter --version v0.33.1 --debug v 10

错误日志显示在请求CloudFront资源时触发socket is not connected错误，完整调试日志如下：

DEBU[0000] resolving                                     host=public.ecr.aws DEBU[0000] do request                                    host=public.ecr.aws request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=Helm/3.14.0 request.method=HEAD url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/v0.33.1" DEBU[0000] fetch response received                       host=public.ecr.aws response.header.content-length=58 response.header.content-type="application/json; charset=utf-8" response.header.date="Wed, 31 Jan 2024 13:02:31 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.www-authenticate="Bearer realm=\"https://public.ecr.aws/token/\",service=\"public.ecr.aws\",scope=\"aws\"" response.status="401 Unauthorized" url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/v0.33.1" DEBU[0000] Unauthorized                                  header="Bearer realm=\"https://public.ecr.aws/token/\",service=\"public.ecr.aws\",scope=\"aws\"" host=public.ecr.aws DEBU[0000] do request                                    host=public.ecr.aws request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=Helm/3.14.0 request.method=HEAD url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/v0.33.1" DEBU[0000] fetch response received                       host=public.ecr.aws response.header.content-length=717 response.header.content-type=application/vnd.oci.image.manifest.v1+json response.header.date="Wed, 31 Jan 2024 13:02:31 GMT" response.header.docker-content-digest="sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" response.header.docker-distribution-api-version=registry/2.0 response.status="200 OK" url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/v0.33.1" DEBU[0000] resolved                                      desc.digest="sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" host=public.ecr.aws DEBU[0000] do request                                    digest="sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" request.header.accept="application/vnd.oci.image.manifest.v1+json, */*" request.header.user-agent=Helm/3.14.0 request.method=GET url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" DEBU[0000] fetch response received                       digest="sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" response.header.content-length=717 response.header.content-type=application/vnd.oci.image.manifest.v1+json response.header.date="Wed, 31 Jan 2024 13:02:31 GMT" response.header.docker-distribution-api-version=registry/2.0 response.status="200 OK" url="https://public.ecr.aws/v2/karpenter/karpenter/manifests/sha256:72a1d3f31167169dc19691cd64f539b038368fe64ac827dd084ed287ac8a24f3" DEBU[0000] do request                                    digest="sha256:1145bfda95a014eebc775ac8557711de719e428b00131e2d5fa70d001229a3cb" request.header.accept="application/vnd.cncf.helm.chart.content.v1.tar+gzip, */*" request.header.user-agent=Helm/3.14.0 request.method=GET url="https://public.ecr.aws/v2/karpenter/karpenter/blobs/sha256:1145bfda95a014eebc775ac8557711de719e428b00131e2d5fa70d001229a3cb" DEBU[0000] do request                                    digest="sha256:3363ded2b4ae75c52cedeaf922cc917c2577d041025fa7bcee19f805521d6fde" request.header.accept="application/vnd.cncf.helm.config.v1+json, */*" request.header.user-agent=Helm/3.14.0 request.method=GET url="https://public.ecr.aws/v2/karpenter/karpenter/blobs/sha256:3363ded2b4ae75c52cedeaf922cc917c2577d041025fa7bcee19f805521d6fde" Error: failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://d2glxqk2uabbnd.cloudfront.net/13a474-071440425669-f2c05e17-0e20-a997-dcf2-eb0520a718eb/1f3ea994-dc26-42de-8334-d644b2b7740b?Expires=1706709751&Signature=NbNdfFJzBONOnjN263DVcD-kIEFU2uARKWPJ0I9dGL4e4Q2ykPv1caRSjpxoPLdatIXcSXVFhcHBJP4hT6BtLtnf5g4P7h8U15o0iu8mr1BujAvnmMN6QxySm3uF9f16vmnvAj1K9QS0sc4a1fonnVGCEMvJesR3Pxws0MWU9k4ovB50V2dyeKxSP~JYcV88ibpOj~tBExEN1Jmoq68vf7~ak4DhJJ5OlnF75M9qRDyQlE5EZdcrHerP7ARd-XORehIeS8Qlx~zo5Xp1fOXQYc1WqgfSMbYD4FmiAriR7Mcg3htMTgmDQc~UA~TQrscpf60E7F82UQeB7KMJCNbqgQ__&Key-Pair-Id=KSPLJWGOARK62": write tcp [2601:5cc:c700:1b10:28c2:32d4:45e1:3cfd]:64601->[2600:9000:2512:3000:1d:242c:6e40:21]:443: write: socket is not connected helm.go:84: [debug] failed to copy: httpReadSeeker: failed open: failed to do request: Get "https://d2glxqk2uabbnd.cloudfront.net/13a474-071440425669-f2c05e17-0e20-a997-dcf2-eb0520a718eb/1f3ea994-dc26-42de-8334-d644b2b7740b?Expires=1706709751&Signature=NbNdfFJzBONOnjN263DVcD-kIEFU2uARKWPJ0I9dGL4e4Q2ykPv1caRSjpxoPLdatIXcSXVFhcHBJP4hT6BtLtnf5g4P7h8U15o0iu8mr1BujAvnmMN6QxySm3uF9f16vmnvAj1K9QS0sc4a1fonnVGCEMvJesR3Pxws0MWU9k4ovB50V2dyeKxSP~JYcV88ibpOj~tBExEN1Jmoq68vf7~ak4DhJJ5OlnF75M9qRDyQlE5EZdcrHerP7ARd-XORehIeS8Qlx~zo5Xp1fOXQYc1WqgfSMbYD4FmiAriR7Mcg3htMTgmDQc~UA~TQrscpf60E7F82UQeB7KMJCNbqgQ__&Key-Pair-Id=KSPLJWGOARK62": write tcp [2601:5cc:c700:1b10:28c2:32d4:45e1:3cfd]:64601->[2600:9000:2512:3000:1d:242c:6e40:21]:443: write: socket is not connected

解决方案 #

• 强制使用IPv4连接：日志中显示是IPv6连接失败，在执行命令前添加环境变量强制使用IPv4：

  IPV4=1 helm pull oci://public.ecr.aws/karpenter/karpenter --version v0.33.1
  

  或者全局设置export GODEBUG=netdns=cgo，让Go优先使用IPv4解析。

• 直接重试命令：这类socket连接错误大概率是临时网络波动导致的，重新执行原命令即可，无需额外配置。

• 检查网络拦截规则：确认本地防火墙、杀毒软件或代理工具没有拦截CloudFront域名的访问，暂时关闭代理或添加放行规则。

• 升级Helm版本：当前使用的Helm 3.14.0可能存在OCI仓库的网络兼容问题，升级到最新稳定版后再尝试拉取。

• 手动下载Chart包：如果以上方法都无效，直接获取对应版本的Karpenter Chart包，解压后本地使用。

内容的提问来源于stack exchange，提问作者Prince Birring