如何在ImagePullBackOff上调试gcr.io

Question

我可以推和拉到gcr.io

更新:如果我使用引擎站点界面和deploy按钮，也是一样的。

更新:从查看中升级了集群，没有工作：Kubernetes pods failing on "Pod sandbox changed, it will be killed and re-created"

Update:使用httpbin完全再现这一过程：

gcloud auth configure-docker
docker pull kennethreitz/httpbin
docker tag kennethreitz/httpbin:latest gcr.io/<proj-id>/images/httpbin:v1.0
docker push gcr.io/<proj-id>/images/httpbin:v1.0
kubectl run test --image=gcr.io/<proj-id>/images/httpbin:v1.0

然后我得到了ImagePullBackOff：

kubectl describe pod test-5f447f48f4-kcpg9
Name:           test-5f447f48f4-kcpg9
Namespace:      default
Node:           <proj-id>-cluster-default-pool-f398e01b-5kmb/10.132.0.2
Start Time:     Tue, 28 Aug 2018 09:08:43 +0200
Labels:         pod-template-hash=1900390490
                run=test
Annotations:    kubernetes.io/limit-ranger=LimitRanger plugin set: cpu request for container test
Status:         Pending
IP:             10.16.1.46
Controlled By:  ReplicaSet/test-5f447f48f4
Containers:
  test:
    Container ID:   
    Image:          gcr.io/<proj-id>/images/httpbin:v1.0
    Image ID:       
    Port:           <none>
    State:          Waiting
      Reason:       ImagePullBackOff
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:        100m
    Environment:  <none>
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-9mcms (ro)
Conditions:
  Type           Status
  Initialized    True 
  Ready          False 
  PodScheduled   True 
Volumes:
  default-token-9mcms:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-9mcms
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason                 Age                From                                                   Message
  ----     ------                 ----               ----                                                   -------
  Normal   Scheduled              5m                 default-scheduler                                      Successfully assigned test-5f447f48f4-kcpg9 to <proj-id>-cluster-default-pool-f398e01b-5kmb
  Normal   SuccessfulMountVolume  5m                 kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  MountVolume.SetUp succeeded for volume "default-token-9mcms"
  Normal   SandboxChanged         5m (x3 over 5m)    kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  Pod sandbox changed, it will be killed and re-created.
  Normal   BackOff                5m (x6 over 5m)    kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  Back-off pulling image "gcr.io/<proj-id>/images/httpbin:v1.0"
  Normal   Pulling                4m (x3 over 5m)    kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  pulling image "gcr.io/<proj-id>/images/httpbin:v1.0"
  Warning  Failed                 4m (x3 over 5m)    kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  Failed to pull image "gcr.io/<proj-id>/images/httpbin:v1.0": rpc error: code = Unknown desc = Error response from daemon: repository gcr.io/<proj-id>/images/httpbin not found: does not exist or no pull access
  Warning  Failed                 4m (x3 over 5m)    kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  Error: ErrImagePull
  Warning  Failed                 31s (x23 over 5m)  kubelet, <proj-id>-cluster-default-pool-f398e01b-5kmb  Error: ImagePullBackOff

更新:在中运行的是相同的东西。

在Cloud：docker images中，也显示了图像

更新:我可以在浏览器控制台(https://console.cloud.google.com/gcr/images/projId/)中看到图像，如果我复制路径，它与下面的路径相同--只需使用另一个项目id。

但是kubectl运行aName aName

未能在Google Kubernetes引擎上提取图像

ImagePullBackOff

kubectl描述荚aName..。

Failed to pull image "myimages/myimage:v1.0": rpc error: code = Unknown desc = Error response from daemon: repository myimages/myimage not found: does not exist or no pull access

所以可能是"or no pull access"，但我该如何解决呢？

Answer 1

myimages/myimage格式表明您使用的是码头集线器。如果是这样的话，您可能需要使用图像拉秘密(https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/#create-a-secret-in-the-cluster-that-holds-your-authorization-token)对Docker进行身份验证。

如果您正在使用( GCR，它的映像以gcr.io/*开头)，GKE节点将已经可以访问与集群相同的GCP项目中的GCR映像--您不需要做任何事情。(但是，如果有人用不太默认的--scopes创建了GKE集群或节点池，比如省略了storage-ro，那么集群将无法从GCP项目中的GCR中提取图像。)

按照https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app的教程进行以下操作：

1. 创建一个集群
2. 从源代码构建图像
3. 把它推到GCR
4. 部署到GKE。