在OCP 4.3上安装Cloud Pak for Data 2.5.0时拉取镜像失败

I’ve run into this exact image pull issue a few times when working with CPD 2.5.0 on OCP 4.3, so let’s walk through the most effective fixes and checks to get past this:

1. Confirm Registry Access & Image Pull Secrets #

• First, make sure your OCP cluster nodes can reach IBM’s Container Registry (icr.io). Jump into a node shell with oc debug node/<your-node-name>, then run curl https://icr.io to test connectivity. If this fails, you’ll need to adjust network policies or proxy settings to allow outbound access to icr.io.
• Verify the ibm-entitlement-key secret exists in your CPD installation namespace and contains valid credentials. Run oc get secrets -n <cpd-namespace> to check, and if it’s missing, create it using your IBM entitlement key with:

  oc create secret docker-registry ibm-entitlement-key \
    --docker-server=icr.io \
    --docker-username=cp \
    --docker-password=<your-entitlement-key> \
    --docker-email=<your-email> \
    -n <cpd-namespace>
  

2. Validate the Image Tag Exists #

• The tag v2.5.0.0-68 is specific to CPD 2.5.0, but typos or incorrect repository paths often cause failures. From a machine with Docker installed, log into icr.io with docker login icr.io (use cp as the username and your entitlement key as the password), then try pulling the image directly:

  docker pull icr.io/cpopen/cpdoperator:v2.5.0.0-68
  

• If this pull fails, either the tag is invalid (double-check the CPD 2.5.0 documentation for the correct operator tag) or your entitlement key doesn’t have access to this image.

3. Dig into OCP’s Image Pull Events #

• Get granular details about the failure by checking namespace events:

  oc get events -n <cpd-namespace> --sort-by='.metadata.creationTimestamp'
  

• Look for FailedPull events related to the cpdoperator pod—these will tell you exactly what’s wrong (e.g., "authentication denied", "network timeout", "image not found").
• If the pod was created, describe it to see even more context:

  oc describe pod <cpdoperator-pod-name> -n <cpd-namespace>
  

  The "Events" section at the bottom will have the full error message from the kubelet.

4. Ensure Prerequisites Are Fully Met #

• CPD 2.5.0 has strict requirements for OCP 4.3:
  • Make sure your cluster is running exactly OCP 4.3 (no minor version mismatches—CPD 2.5.0 doesn’t work with newer or older OCP versions).
  • Confirm you have a compatible block storage class provisioned (CPD requires RWO storage for many components; check that your storage class is correctly configured and can provision volumes).
  • Run the CPD installer’s prerequisite checker script (included with the 2.5.0 installation package) to catch any missing resources, permissions, or configuration issues.

5. Clean Up & Retry the Installation #

• If you’ve retried before without success, leftover partial resources might be causing issues. Clean up first:

  # Delete the operator pod if it exists
  oc delete pod -l name=cpd-operator -n <cpd-namespace>
  # Delete the operator deployment
  oc delete deployment cpd-operator -n <cpd-namespace>
  

• Then re-run the CPD installation command, making sure to specify the correct namespace, entitlement key, and OCP API endpoint.

内容的提问来源于stack exchange，提问作者Vergie Hadiana