CKAD实验中Kubernetes无法从本地非安全镜像仓库拉取镜像求助

问题场景 #

在Linux基金会CKAD认证课程（LFD259）的Lab 3.2实验中，搭建了仅支持HTTP的本地非安全镜像仓库，尝试让Kubernetes拉取仓库中的simpleapp镜像时失败。

创建Deployment前，组件状态正常：

student@master:~$ curl 10.97.82.186:5000/v2/_catalog
{"repositories":["simpleapp"]}
student@master:~$ k get deploy
NAME       READY   UP-TO-DATE   AVAILABLE   AGE
nginx      1/1     1            1           118m
registry   1/1     1            1           118m
student@master:~$ k get pod
NAME                       READY   STATUS    RESTARTS      AGE
nginx-6488f757bc-cf4q4     1/1     Running   1 (51m ago)   118m
registry-d4cf9fd7d-qj6tn   1/1     Running   1 (51m ago)   118m
student@master:~$ sudo podman images
REPOSITORY                   TAG         IMAGE ID      CREATED      SIZE
localhost/simpleapp          latest      bb19ffc6050a  2 hours ago  943 MB
10.97.82.186:5000/simpleapp  latest      bb19ffc6050a  2 hours ago  943 MB
docker.io/library/python     3           e285995a3494  8 days ago   943 MB
10.97.82.186:5000/tagtest    latest      9c6f07244728  6 weeks ago  5.83 MB
student@master:~$ echo $repo
10.97.82.186:5000

创建Deployment后出现镜像拉取失败，错误核心为：

student@master:~$ k describe pod try1-5f97db4fb8-j9csw |grep Failed
  Warning  Failed     11s                kubelet            Failed to pull image "10.97.82.186:5000/simpleapp": rpc error: code = Unknown desc = failed to pull and unpack image "10.97.82.186:5000/simpleapp:latest": failed to resolve reference "10.97.82.186:5000/simpleapp:latest": failed to do request: Head https://10.97.82.186:5000/v2/simpleapp/manifests/latest: http: server gave HTTP response to HTTPS client
  Warning  Failed     11s                kubelet            Error: ErrImagePull
  Warning  Failed     10s (x2 over 11s)  kubelet            Error: ImagePullBackOff

错误显示Kubernetes使用HTTPS请求访问仅支持HTTP的镜像仓库，导致拉取失败。

当前配置问题 #

已修改的/etc/containers/registries.conf.d/registry.conf仅对Podman生效，而Kubernetes使用的containerd并未正确配置允许该非安全仓库的HTTP访问。现有containerd配置仅添加了镜像源，但未配置跳过TLS验证或允许HTTP访问。

student@master:~$ diff -U3 /etc/containerd/config.toml /etc/containerd/config.toml.orig
--- /etc/containerd/config.toml 2022-09-21 21:22:37.032171446 +0000
+++ /etc/containerd/config.toml.orig    2022-09-22 03:35:37.032007211 +0000
@@ -152,9 +152,6 @@

       [plugins."io.containerd.grpc.v1.cri".registry.mirrors]

-      [plugins."io.containerd.grpc.v1.cri".registry.mirrors."*"]
-        endpoint = ["10.97.82.186:5000"]
-
     [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
       tls_cert_file = ""
       tls_key_file = ""

解决方案 #

1. 正确配置containerd允许非安全仓库访问 #

编辑/etc/containerd/config.toml，在[plugins."io.containerd.grpc.v1.cri".registry]区块下添加针对目标仓库的TLS配置：

[plugins."io.containerd.grpc.v1.cri".registry]
  # 保留原有mirrors配置，添加以下configs部分
  [plugins."io.containerd.grpc.v1.cri".registry.configs]
    [plugins."io.containerd.grpc.v1.cri".registry.configs."10.97.82.186:5000".tls]
      insecure_skip_verify = true  # 跳过TLS验证，适用于HTTP或自签名证书仓库
      # 若仓库完全使用HTTP，可替换为：plain_http = true

2. 重启containerd和kubelet服务 #

sudo systemctl restart containerd
sudo systemctl restart kubelet

3. 重新创建Deployment #

删除之前失败的Deployment，重新创建以应用新配置：

k delete deployment try1
k create deployment try1 --image=$repo/simpleapp

4. 验证Pod状态 #

等待片刻后检查Pod状态，确认镜像拉取成功：

k get pods

内容的提问来源于stack exchange，提问作者mark