从私有ECR拉取镜像时K8s报ErrImagePull: no basic auth credentials

已完成以下授权配置，但仍无法拉取镜像，请求排查遗漏点：

已执行的配置步骤 #

• 执行ECR登录命令成功：

  aws ecr get-login-password --region eu-west-2 | docker login --username AWS --password-stdin redacted.dkr.ecr.eu-west-2.amazonaws.com
  

• 本地通过docker pull和docker run可正常拉取并运行镜像，确认账号具备拉取权限
• 创建独立命名空间client-ns
• 在client-ns命名空间下创建regcred镜像拉取密钥：

  kubectl create secret docker-registry regcred \
    --docker-server=redacted.dkr.ecr.eu-west-2.amazonaws.com \
    --docker-username=AWS \
    --docker-password=$(aws ecr get-login-password) \
    --namespace=client-ns
  

• 在Deployment清单中添加镜像拉取密钥配置：

  imagePullSecrets:
  - name: regcred
  

• 已验证密钥内容与ECR登录密码匹配：

  # 获取当前ECR登录密码
  aws ecr get-login-password
  
  # 解码并查看密钥中的dockerconfigjson内容
  kubectl get secret regcred --namespace=client-ns --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
  

Pod事件信息 #

Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  45s                default-scheduler  Successfully assigned client-ns/client-deployment-8567f459b8-9j25j to minikube
  Normal   BackOff    17s (x3 over 43s)  kubelet            Back-off pulling image "redacted.dkr.ecr.eu-west-2.amazonaws.com/client:v1.0.1"
  Warning  Failed     17s (x3 over 43s)  kubelet            Error: ImagePullBackOff
  Normal   Pulling    5s (x3 over 44s)   kubelet            Pulling image "redacted.dkr.ecr.eu-west-2.amazonaws.com/client:v1.0.1"
  Warning  Failed     5s (x3 over 44s)  kubelet            Failed to pull image "redacted.dkr.ecr.eu-west-2.amazonaws.com/client:v1.0.1": rpc error: code = Unknown desc = Error response from daemon: Head "https://redacted.dkr.ecr.eu-west-2.amazonaws.com/v2/client/manifests/v1.0.1": no basic auth credentials
  Warning  Failed     5s (x3 over 44s)  kubelet            Error: ErrImagePull

完整Deployment清单 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: client-deployment 
  namespace: client-ns
spec:
  replicas: 1
  selector:
    matchLabels:
      app: client-app
  template:
    metadata:
      labels:
        app: client-app
    spec:
      containers:
      - name: client-app 
        image: redacted.dkr.ecr.eu-west-2.amazonaws.com/client:v1.0.1
        imagePullPolicy: Always
        ports:
          - containerPort: 50054
            name: eds-app
        securityContext:
          runAsUser: 20000
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
        resources:
          requests:
            memory: "64Mi"
            cpu: "100m"
            ephemeral-storage: "5Mi"
          limits:
            memory: "128Mi"
            cpu: "200m"
            ephemeral-storage: "10Mi"
        volumeMounts:
        - name: env-file
          mountPath: /client/build/default.env
          subPath: default.env
        - name: csv-file
          mountPath: /client/csv/customers.csv
          subPath: customers.csv
      volumes:
      - name: env-file
        hostPath:
          path: /home/nocnoc/Documents/redacted/github/client/build/default.env
      - name: csv-file
        hostPath:
          path: /home/nocnoc/Documents/redacted/github/client/csv/customers.csv
      imagePullSecrets:
      - name: regcred

可能的排查方向 #

1. ECR登录密码过期：AWS ECR登录密码有效期为12小时，若创建密钥时的密码已过期，需重新生成密钥并重启Deployment：

   kubectl delete secret regcred --namespace=client-ns
   kubectl create secret docker-registry regcred \
     --docker-server=redacted.dkr.ecr.eu-west-2.amazonaws.com \
     --docker-username=AWS \
     --docker-password=$(aws ecr get-login-password --region eu-west-2) \
     --namespace=client-ns
   kubectl rollout restart deployment client-deployment --namespace=client-ns
   

2. 集群节点的ECR访问权限：
   • 若为EKS集群，需确认节点IAM角色绑定了AmazonEC2ContainerRegistryReadOnly权限
   • 若为minikube等本地集群，需通过minikube ssh进入节点，检查是否存在有效的AWS凭证（~/.aws/credentials或环境变量），且节点能正常访问ECR域名
3. 密钥格式验证：解码后的.dockerconfigjson需确保格式正确，示例正确结构如下，若格式有误需重新创建密钥：

   {
     "auths": {
       "redacted.dkr.ecr.eu-west-2.amazonaws.com": {
         "auth": "QVdTOkN...（AWS:密码的base64编码值）"
       }
     }
   }
   

4. 镜像地址准确性：核对Deployment中的镜像地址redacted.dkr.ecr.eu-west-2.amazonaws.com/client:v1.0.1，确保仓库域名、镜像名称、标签与ECR控制台完全一致
5. 命名空间一致性：确认密钥与Deployment都处于client-ns命名空间下，避免跨命名空间引用密钥

内容的提问来源于stack exchange，提问作者nocnoc