kubernetes之基于ServiceAccount拉取私有镜像

　　前面可以通过ImagPullPolicy和ImageullSecrets指定下载镜像的策略，ServiceAccount也可以基于spec.imagePullSecret字段附带一个由下载镜像专用的Secret资源组成的列表，用于在容器创建时，从某个私有镜像仓库下载镜像文件之前的服务认证。  1.创建Secrets资源
　　这里根据自己的实际去定义即可；一定要是对方的地址和认证信息；否则无法pull/push  root@ks-master01-10:~# kubectl create secret docker-registry  > aliyun-haitang-registry  > --docker-server=registry.cn-hangzhou.aliyuncs.com  > --docker-username=xxxxxxx > --docker-password=xxxxxx secret/aliyun-haitang-registry created1.1查看Secretsroot@ks-master01-10:~#  kubectl describe secret aliyun-haitang Name:         aliyun-haitang Namespace:    default Labels:        Annotations:    Type:  kubernetes.io/dockerconfigjson  Data ==== .dockerconfigjson:  140 bytes2.创建ServiceAccount2.1不设置任何策略，测试是否能拉取私有仓库镜像
　　此处不配置任何镜像拉取策略，测试是否能拉取私有仓库镜像；  root@ks-master01-10:~#  cat pod-serviceaccount-secret.yaml  apiVersion: v1 kind: Pod metadata:   name: stree-serviceaccount spec:   containers:   - name: stree     image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest2.2查看Pod，处于ErrImageroot@ks-master01-10:~# kubectl get pods NAME                                      READY   STATUS         RESTARTS       AGE stree-serviceaccount                      0/1     ErrImagePull   0              8s2.3describe查看Events
　　可以看到事件，是Docker认证的问题；  root@ks-master01-10:~# kubectl describe pods stree-serviceaccount Events:   Type     Reason     Age               From               Message   ----     ------     ----              ----               -------   Normal   Scheduled  20s               default-scheduler  Successfully assigned default/stree-serviceaccount to ks-node02-12   Normal   BackOff    17s               kubelet            Back-off pulling image ＂registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest＂   Warning  Failed     17s               kubelet            Error: ImagePullBackOff   Normal   Pulling    2s (x2 over 19s)  kubelet            Pulling image ＂registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest＂   Warning  Failed     2s (x2 over 18s)  kubelet            Failed to pull image ＂registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest＂: rpc error: code = Unknown desc = Error response from daemon: pull access denied for registry.cn-hangzhou.aliyuncs.com/lengyuye/stress, repository does not exist or may require ＂docker login＂: denied: requested access to the resource is denied   Warning  Failed     2s (x2 over 18s)  kubelet            Error: ErrImagePull2.4创建ServiceAccount
　　aliyun-haitang是docker-registry类型的Secrets对象，由用户提前手动创建，它可以通过键值数据提供docker仓库服务器的地址，接入服务器的用户名，密码及用户的电子邮件信息等，认证通过后，引用ServiceAccount的Pod资源即可从指定的镜像仓库下载image。  root@ks-master01-10:~# cat serviceaccount-imagepullsecret.yaml  apiVersion: v1 kind: ServiceAccount metadata:    name: imagepull-aliyun-sa imagePullSecrets: - name: aliyun-haitang root@ks-master01-10:~# kubectl apply -f serviceaccount-imagepullsecret.yaml  serviceaccount/imagepull-aliyun-sa created2.5查看SAroot@ks-master01-10:~# kubectl get sa imagepull-aliyun-sa -o yaml apiVersion: v1 imagePullSecrets: - name: aliyun-haitang kind: ServiceAccount metadata:   annotations:     kubectl.kubernetes.io/last-applied-configuration: |       {＂apiVersion＂:＂v1＂,＂imagePullSecrets＂:[{＂name＂:＂aliyun-haitang＂}],＂kind＂:＂ServiceAccount＂,＂metadata＂:{＂annotations＂:{},＂name＂:＂imagepull-aliyun-sa＂,＂namespace＂:＂default＂}}   creationTimestamp: ＂2022-09-07T02:31:05Z＂   name: imagepull-aliyun-sa   namespace: default   resourceVersion: ＂226300＂   uid: fabc93b1-572c-4703-a2dd-465d4e0915cb secrets: - name: imagepull-aliyun-sa-token-vf67z2.6Pod引用ServiceAccountroot@ks-master01-10:~# cat pod-serviceaccount-secret.yaml  apiVersion: v1 kind: Pod metadata:   name: stree-serviceaccount    spec:   serviceAccount: imagepull-aliyun-sa   # 这里则是创建的sa的名称   containers:   - name: stree     image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest root@ks-master01-10:~/rbac# kubectl apply -f pod-serviceaccount-secret.yaml  pod/stree-serviceaccount created3.创建Pod测试；3.1查看Podroot@ks-master01-10:~# kubectl get pods NAME                                      READY   STATUS    RESTARTS       AGE stree-serviceaccount                      1/1     Running   0              8s3.2describe查看事件root@ks-master01-10:~# kubectl describe pods stree-serviceaccount Events:   Type    Reason     Age    From               Message   ----    ------     ----   ----               -------   Normal  Scheduled  3m36s  default-scheduler  Successfully assigned default/stree-serviceaccount to ks-node02-12   Normal  Pulling    3m35s  kubelet            Pulling image ＂registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest＂   Normal  Pulled     3m33s  kubelet            Successfully pulled image ＂registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest＂ in 1.729555429s   Normal  Created    3m33s  kubelet            Created container stree   Normal  Started    3m33s  kubelet            Started container stree3.3查看详细信息root@ks-master01-10:~# kubectl get pods stree-serviceaccount -o yaml   imagePullSecrets:   - name: aliyun-haitang   nodeName: ks-node02-12   preemptionPolicy: PreemptLowerPriority   priority: 0   restartPolicy: Always   schedulerName: default-scheduler   securityContext: {}   serviceAccount: imagepull-aliyun-sa   serviceAccountName: imagepull-aliyun-sa