使用kubectl插件推送镜像至Docker Registry失败求助

问题描述 #

推送镜像至本地Docker Registry时，部分镜像短暂推送成功后很快失败，报错如下：

{"status":"The push refers to repository [docker-registry:30001/netapp/astracc/22.08.1-26/graphql-server]"}
{"errorDetail":{"message":"Get \"https://docker-registry:30001/v2/\": dial tcp 192.168.0.96:30001: connect: connection refused"},"error":"Get \"https://docker-registry:30001/v2/\": dial tcp 192.168.0.96:30001: connect: connection refused"}

已重建Registry并确认Docker运行状态，Registry相关Pod处于正常Up状态：

[root@kubmas2 acc]# docker ps | grep registry
ab05d3e41abf   registry                                                "/entrypoint.sh /etc…"   About a minute ago   Up About a minute             k8s_registry_docker-registry-547576f64c-9w8rl_registry_b48428e8-4b45-422f-906c-37c6c6286f80_0
d59cab9271fc   k8s.gcr.io/pause:3.6                                    "/pause"                 About a minute ago   Up About a minute             k8s_POD_docker-registry-547576f64c-9w8rl_registry_b48428e8-4b45-422f-906c-37c6c6286f80_0
f40fdeae0b7c   registry.k8s.io/sig-storage/csi-node-driver-registrar   "/csi-node-driver-re…"   8 days ago           Up 8 days                     k8s_driver-registrar_trident-csi-nxhxb_trident_6245b9f7-205a-463a-bb7b-0d15a08b5189_0

排查与解决方案 #

• 验证端口可达性：在推送镜像的节点执行nc -zv 192.168.0.96 30001或telnet 192.168.0.96 30001，确认端口是否连通。若不通，检查节点防火墙/iptables规则：iptables -L -n | grep 30001，放行30001端口。
• 检查Service端口映射：执行kubectl get svc docker-registry -n registry -o yaml，确认：
  • spec.ports.nodePort为30001
  • spec.ports.targetPort与Registry容器暴露端口一致（默认5000）
  • 若Service为ClusterIP类型，需改为NodePort/LoadBalancer，或临时用端口转发测试：kubectl port-forward pod/docker-registry-547576f64c-9w8rl 30001:5000 -n registry
• 查看Registry容器日志：执行kubectl logs docker-registry-547576f64c-9w8rl -n registry，排查是否有启动失败、端口绑定冲突等错误（如listen tcp :5000: bind: address already in use）。
• 配置Docker不安全仓库：在推送节点的/etc/docker/daemon.json中添加：

  {
    "insecure-registries": ["docker-registry:30001", "192.168.0.96:30001"]
  }
  

  重启Docker：systemctl restart docker
• 检查K8s网络插件：若跨节点推送，执行kubectl run -it --image busybox:1.28 test-pod --rm -- ping 192.168.0.96，确认节点间网络连通性，排查Calico/Flannel等插件是否正常运行。

内容的提问来源于stack exchange，提问作者Joseph Dean Ocampo