如何将Kubernetes集群与镜像仓库连接及Pod部署故障排查

集群环境信息 #

节点状态：

kubectl get nodes
NAME                 STATUS   ROLES           AGE    VERSION
master.domain.com    Ready    control-plane   161m   v1.24.4
worker1.domain.com   Ready    <none>          154m   v1.24.4
worker2.domain.com   Ready    <none>          153m   v1.24.4

容器运行时：cri-o

问题1：Nginx Pod镜像拉取失败 #

Pod定义文件 #

apiVersion: v1
kind: Pod
metadata:
  name: nginx
  labels:
    app: frontend
spec:
  containers:
    - name: nginx
      image: nginx

事件日志 #

Events:
  Type     Reason     Age                From               Message
  ----     ------     ----               ----               -------
  Normal   Scheduled  40s                default-scheduler  Successfully assigned default/nginx to worker2.domain.com
  Normal   BackOff    26s                kubelet            Back-off pulling image "nginx"
  Warning  Failed     26s                kubelet            Error: ImagePullBackOff
  Normal   Pulling    11s (x2 over 32s)  kubelet            Pulling image "nginx"
  Warning  Failed     2s (x2 over 27s)   kubelet            Failed to pull image "nginx": rpc error: code = Unknown desc = Error reading manifest latest in registry.hub.docker.com/nginx: unauthorized: authentication required
  Warning  Failed     2s (x2 over 27s)   kubelet            Error: ErrImagePull

故障分析与解决 #

• 核心错误：unauthorized: authentication required，拉取Docker Hub镜像时未通过身份验证，可能是Docker Hub限流或镜像权限问题。
• 解决步骤：
  1. 验证节点与Docker Hub的网络连通性，确保无防火墙或代理拦截。
  2. 创建镜像拉取密钥：

     kubectl create secret docker-registry regcred --docker-server=registry.hub.docker.com --docker-username=<你的Docker用户名> --docker-password=<你的Docker密码> --docker-email=<你的邮箱>
     

  3. 修改Pod定义，添加密钥引用：

     spec:
       imagePullSecrets:
         - name: regcred
       containers:
         - name: nginx
           image: nginx
     

  4. 可选：指定具体镜像标签（如nginx:1.25.3），避免latest标签的潜在认证问题。

问题2：MySQL Pod启动后CrashLoopBackOff #

事件日志 #

Type     Reason     Age                   From               Message
  ----     ------     ----                  ----               -------
  Normal   Scheduled  23m                   default-scheduler  Successfully assigned default/mysql to worker1.domain.com
  Normal   Pulled     22m                   kubelet            Successfully pulled image "mysql" in 54.067277637s
  Normal   Pulled     22m                   kubelet            Successfully pulled image "mysql" in 18.227802182s
  Normal   Pulled     21m                   kubelet            Successfully pulled image "mysql" in 13.511077504s
  Normal   Created    20m (x4 over 22m)     kubelet            Created container mysql
  Normal   Started    20m (x4 over 22m)     kubelet            Started container mysql
  Normal   Pulled     20m                   kubelet            Successfully pulled image "mysql" in 11.998942705s
  Normal   Pulling    20m (x5 over 23m)     kubelet            Pulling image "mysql"
  Normal   Pulled     20m                   kubelet            Successfully pulled image "mysql" in 13.68976309s
  Normal   Pulled     18m                   kubelet            Successfully pulled image "mysql" in 16.584670292s
  Warning  BackOff    3m12s (x80 over 22m)  kubelet            Back-off restarting failed container

当前Pod状态 #

kubectl get pods
NAME    READY   STATUS             RESTARTS        AGE
mysql   0/1     CrashLoopBackOff   8 (4m51s ago)   23m
nginx   0/1     ImagePullBackOff   0               3m26s

故障分析与解决 #

• 镜像拉取成功但容器反复重启，需先查看容器日志定位具体原因：

  kubectl logs mysql
  kubectl logs mysql --previous  # 查看上一次启动的日志
  

• 常见修复方案：
  1. 补充必要环境变量：MySQL镜像必须配置MYSQL_ROOT_PASSWORD等核心变量，修改Pod定义：

     spec:
       containers:
         - name: mysql
           image: mysql
           env:
             - name: MYSQL_ROOT_PASSWORD
               value: "your-secure-password"
             - name: MYSQL_DATABASE
               value: "your-db-name"
     

  2. 检查存储权限：若挂载了持久化卷，确保卷权限适配MySQL运行用户（UID/GID通常为999）。
  3. 验证节点资源：通过kubectl describe node worker1.domain.com检查节点CPU/内存是否充足，必要时调整Pod的resources配置。
  4. 指定稳定镜像版本：替换mysql为具体版本（如mysql:8.0），避免latest版本的兼容性问题。

内容的提问来源于stack exchange，提问作者pugazhendhi_r