Kubernetes配置Docker Hub凭据后无法拉取私有镜像求助

环境信息 #

• Kubernetes集群，容器运行时为containerd
• Master节点系统：CentOS 7
• 私有镜像存储：Docker Hub

已执行操作 #

1. 通过docker login命令结合个人访问令牌（PAT）登录Docker，可正常拉取私有镜像。
2. 在目标命名空间创建dockerhub-credentials Secret：

kubectl create secret docker-registry dockerhub-credentials \
    --docker-server=https://index.docker.io/v1/ \
    --docker-username=<username> \
    --docker-password=<dockerhubPAT> \
    --docker-email=<example@gmail.com> -n <mynamespace>

3. 部署Deployment配置（可正常拉取公共镜像，但私有镜像拉取失败）：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-world-deployment
  namespace: <mynamespace>
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hello-world
  template:
    metadata:
      labels:
        app: hello-world
    spec:
      containers:
      - name: hello-world-container
        image: <dockerhub-username>/<dockerhub-repository-name>:<image-tag>
      imagePullSecrets:
      - name: dockerhub-credentials

错误信息 #

Pod状态 #

kubectl get pods -n <mynamespace>
NAME                                     READY   STATUS             RESTARTS   AGE
hello-world-deployment-79dbffcd7-xq5br   0/1     ImagePullBackOff   0          146m

日志信息 #

kubectl logs hello-world-deployment-79dbffcd7-xq5br -n <mynamespace>
Error from server (BadRequest): container "hello-world-container" in pod "hello-world-deployment-79dbffcd7-xq5br" is waiting to start: trying and failing to pull image

Pod描述关键事件 #

kubectl describe pod hello-world-deployment-79dbffcd7-xq5br -n <mynamespace>
# 仅保留事件部分
Events:
  Type     Reason   Age                    From     Message
  ----     ------   ----                   ----     -------
  Warning  Failed   29m (x13 over 135m)    kubelet  Error: ErrImagePull
  Warning  Failed   20m (x2 over 37m)      kubelet  Failed to pull image "<dockerhub-username>/<dockerhub-repository-name>:<image-tag>": failed to pull and unpack image "docker.io/<dockerhub-username>/<dockerhub-repository-name>:<image-tag>": failed to read expected number of bytes: unexpected EOF
  Warning  Failed   10m (x13 over 135m)    kubelet  Failed to pull image "<dockerhub-username>/<dockerhub-repository-name>:<image-tag>": failed to pull and unpack image "docker.io/<dockerhub-username>/<dockerhub-repository-name>:<image-tag>": failed to copy: httpReadSeeker: failed open: server message: invalid_token: authorization failed
  Normal   BackOff  9m49s (x55 over 135m)  kubelet  Back-off pulling image "<dockerhub-username>/<dockerhub-repository-name>:<image-tag>"

Secret信息 #

Secret描述 #

kubectl describe secrets dockerhub-credentials -n <mynamespace>
Name:         dockerhub-credentials
Namespace:    <mynamespace>
Labels:       <none>
Annotations:  <none>

Type:  kubernetes.io/dockerconfigjson

Data
====
.dockerconfigjson:  223 bytes

Secret JSON输出 #

{
    "apiVersion": "v1",
    "data": {
        ".dockerconfigjson": "<HERE'S-BASE64-ENCODED-DATA-FROM-DOCKERCONFIG.JSON>"
    },
    "kind": "Secret",
    "metadata": {
        "creationTimestamp": "2023-09-19T16:35:32Z",
        "name": "dockerhub-credentials",
        "namespace": "<mynamespace>",
        "resourceVersion": "3557701",
        "uid": "e453ef1d-f4df-4c2a-9c08-f4e1271f8b03"
    },
    "type": "kubernetes.io/dockerconfigjson"
}

求助 #

已尝试多种授权方式，查阅大量资料但仍卡在这一步。本人正在学习Kubernetes，第一次提问，希望能解决这个问题，可提供更多必要信息。

内容的提问来源于stack exchange，提问作者yury mid