Kubernetes 一键安装文档

Appearance

TLS：拉取镜像验证失败 ​

文档 ​

  1. https://github.com/containerd/containerd/blob/main/docs/hosts.md#cri
  2. https://github.com/containerd/containerd/blob/main/docs/hosts.md#bypass-tls-verification-example
  3. https://github.com/containerd/containerd/blob/main/docs/cri/config.md#registry-configuration

问题描述 ​

  1. kubectl -n <namespace> get pods 显示 Pod 状态为 ImagePullBackOff
  2. Kubernetes 拉取的镜像 域名证书 在 当前系统上 不受信任，无法拉取镜像
    shell
    tls: failed to verify certificate: x509: certificate signed by unknown authority
    shell
    [root@anolis-7-7 ~]# kubectl describe pod test 
......
Events:
  Type     Reason     Age   From               Message
  ----     ------     ----  ----               -------
  Normal   Scheduled  3s    default-scheduler  Successfully assigned default/test to k8s-1
  Normal   Pulling    2s    kubelet            Pulling image "xuxiaowei.io/cn-com-xuxiaowei/dynamic-ho-spring-boot2:0.0.1-SNAPSHOT-20240923082744-2"
  Warning  Failed     2s    kubelet            Failed to pull image "xuxiaowei.io/cn-com-xuxiaowei/dynk-relay-spring-boot2:0.0.1-SNAPSHOT-20240923082744-2": failed to pull and unpack image "xuxiaowei.io/cxiaowei/dynamic-hook-relay-spring-boot2:0.0.1-SNAPSHOT-20240923082744-2": failed to resolve reference ei.io/cn-com-xuxiaowei/dynamic-hook-relay-spring-boot2:0.0.1-SNAPSHOT-20240923082744-2": failed to do  Head "https://xuxiaowei.io/v2/cn-com-xuxiaowei/dynamic-hook-relay-spring-boot2/manifests/0.0.1-SNAPSH923082744-2": tls: failed to verify certificate: x509: certificate signed by unknown authority
  Warning  Failed     2s    kubelet            Error: ErrImagePull
  Normal   BackOff    1s    kubelet            Back-off pulling image "xuxiaowei.io/cn-com-xuxiaowei/dook-relay-spring-boot2:0.0.1-SNAPSHOT-20240923082744-2"
  Warning  Failed     1s    kubelet            Error: ImagePullBackOff
[root@anolis-7-7 ~]#

解决方案 ​

提示

  • 下列内容以 Kubernetes 拉取 xuxiaowei.io 域名下的镜像 TLS 验证失败为例
  • 如果有端口，下列配置中，需要携带端口，如：xuxiaowei.io:8443

  1. 查看 containerd 配置文件 /etc/containerd/config.toml 中的 config_path

    shell
    cat /etc/containerd/config.toml | grep config_path

  2. 创建 /etc/containerd/certs.d 文件夹

    shell
    sudo mkdir -p /etc/containerd/certs.d

  3. 将 config_path 配置为 /etc/containerd/certs.d，并重启 containerd

    shell
    systemctl restart containerd

  4. 创建 域名 域名证书的配置文件

    Docker 镜像仓库 host
    Docker 镜像仓库 port
    shell