K8S发布阿里云仓库的镜像

试过多次发现k8s不能从阿里云直接接取镜像,发布流程与官方多了个创建使用证书的步骤，使用记录需要以下处理 
1:登陆阿里云

docker login --username=****** registry.cn-shanghai.aliyuncs.com

输入密码，登陆成功可看到docker记录权限内容config.json,目录路径~/.docker/config.json

{
        "auths": {
                "registry.cn-shanghai.aliyuncs.com": {
                        "auth": "************************"
                }
}

2:生成密钥

#kubectl create secret docker-registry regcred --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>

kubectl create secret docker-registry wogemusecret --docker-server=registry.cn-shanghai.aliyuncs.com --docker-username=****** --docker-password=****** 

解释：
summerzhangregsecret :指定秘钥的键名称，可自行定义
--docker-server ：指定docker仓库的地址
--docker-username :指定docker仓库账号
--docker-password ：指定docker仓库密码
--docker-email： 指定docker邮件地址（选填）

生成成功查看系统secret
kubectl get secret

NAME                  TYPE                                  DATA   AGE
default-token-d9czk   kubernetes.io/service-account-token   3      3d21h
wogemusecret          kubernetes.io/dockerconfigjson        1      19h

default-token-d9czk是默认密钥
wegemusecret为刚生成密钥

该秘钥只能在对应的namespace中使用，也就是这里使用的default，如果需要用到其他namespace，比如：test，就需要在生成secret的时候指定namespac
3:查看wogemusecret详情

[root@VM-0-11-centos ~]# kubectl get secret wogemusecret --output=yaml
apiVersion: v1
data:
  .dockerconfigjson: eyJhdXRocyI6eyJyZWdpc3Rye********************************************************************************************************************************************************RZV2gxYVMweU1ERXkifX19
kind: Secret
metadata:
  creationTimestamp: "2021-04-01T03:41:23Z"
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        .: {}
        f:.dockerconfigjson: {}
      f:type: {}
    manager: kubectl-create
    operation: Update
    time: "2021-04-01T03:41:23Z"
  name: wogemusecret
  namespace: default
  resourceVersion: "1029749"
  selfLink: /api/v1/namespaces/default/secrets/wogemusecret
  uid: 944f9439-4c55-4346-9812-d0fe7d81fb17
type: kubernetes.io/dockerconfigjson

dockerconfigjson的值便是base64编码的证书内容，查看内容详情

[root@VM-0-11-centos ~]# kubectl get secret wogemusecret --output="jsonpath={.data.\.dockerconfigjson}" | base64 --decode
{"auths":{"registry.cn-shanghai.aliyuncs.com":{"username":"******","password":"******","email":"****@*****","auth":"*****************************"}}}[root@VM-0-11-centos ~]# 

auth值为base64编码的用户名与密码。查看方式

echo "c3R...zE2" | base64 --decode

4:根据密钥生成创建pod,文件格式如下 

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: <your-private-image>
  imagePullSecrets:
  - name: wogemusecret

下载：wget -O my-private-reg-pod.yaml https://k8s.io/examples/pods/private-reg-pod.yaml

 

5：修改my-private-reg-pod.yaml文件

apiVersion: v1
kind: Pod
metadata:
  name: private-reg
spec:
  containers:
  - name: private-reg-container
    image: registry.cn-shanghai.aliyuncs.com/****/standalong:1.1.6
  imagePullSecrets:
  - name: wogemusecret

6:根据证书和文件运行pod

wogemu2018:mahui-2012[root@VM-0-11-centos ~]# kubectl apply -f my-private-reg-pod.yaml
pod/private-reg created
[root@VM-0-11-centos ~]# kubectrl get pod
-bash: kubectrl: command not found
[root@VM-0-11-centos ~]# kubectl get pod
NAME                     READY   STATUS    RESTARTS   AGE
nginx-6799fc88d8-zmrjv   1/1     Running   0          24m
private-reg              1/1     Running   0          34s

 

7:或者布署镜像

[root@VM-0-11-centos ~]# kubectl create deployment standalong --port=9101 --image=registry.cn-shanghai.aliyuncs.com/glsa/standalong:1.1.6
deployment.apps/standalong created
[root@VM-0-11-centos ~]# kubectl get deployment
NAME         READY   UP-TO-DATE   AVAILABLE   AGE
nginx        1/1     1            1           27m
standalong   1/1     1            1           5s
[root@VM-0-11-centos ~]# kubectl get pod
NAME                         READY   STATUS    RESTARTS   AGE
nginx-6799fc88d8-zmrjv       1/1     Running   0          27m
private-reg                  1/1     Running   0          3m11s
standalong-b7498f59c-69768   1/1     Running   0          12s

8:发布service

[root@VM-0-11-centos ~]# kubectl expose deployment standalong --port=9101 --type=NodePort
service/standalong exposed
[root@VM-0-11-centos ~]# kubectl get service
NAME         TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)          AGE
kubernetes   ClusterIP   10.96.0.1        <none>        443/TCP          5d3h
nginx        NodePort    10.108.117.115   <none>        80:32616/TCP     26m
standalong   NodePort    10.97.28.186     <none>        9101:31773/TCP   13s

9:外网查看:根据service,standalong NodePort 10.97.28.186 <none> 9101:31773/TCP 13s,数据查看端口为31773