docker - Jenkins 图像的kubernetes拉取给Imagepullbackoff

Question

尝试使用拉动jenkins图像 Helm 机安装稳定/ jenkins --values jenkins.values --name jenkins
到我的本地集群中，但是每次，当我构建Pod时，都会出现以下错误。

`

[root@kube-master tmp]# kubectl describe pod newjenkins-84cd855fb6-mr9rm
Name:           newjenkins-84cd855fb6-mr9rm
Namespace:      default
Priority:       0
Node:           worker-node2/192.168.20.56
Start Time:     Thu, 14 May 2020 14:58:13 +0500
Labels:         app.kubernetes.io/component=jenkins-master
                app.kubernetes.io/instance=newjenkins
                app.kubernetes.io/managed-by=Tiller
                app.kubernetes.io/name=jenkins
                helm.sh/chart=jenkins-1.16.0
                pod-template-hash=84cd855fb6
Annotations:    checksum/config: 70d4b49bc5cd79a1a978e1bbafdb8126f8accc44871772348fd481642e33cffb
Status:         Pending
IP:
IPs:            <none>
Controlled By:  ReplicaSet/newjenkins-84cd855fb6
Init Containers:
  copy-default-config:
    Container ID:
    Image:         jenkins/jenkins:lts
    Image ID:
    Port:          <none>
    Host Port:     <none>
    Command:
      sh
      /var/jenkins_config/apply_config.sh
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:     50m
      memory:  256Mi
    Environment:
      ADMIN_PASSWORD:  <set to the key 'jenkins-admin-password' in secret 'newjenkins'>  Optional: false
      ADMIN_USER:      <set to the key 'jenkins-admin-user' in secret 'newjenkins'>      Optional: false
    Mounts:
      /tmp from tmp (rw)
      /usr/share/jenkins/ref/secrets/ from secrets-dir (rw)
      /var/jenkins_config from jenkins-config (rw)
      /var/jenkins_home from jenkins-home (rw)
      /var/jenkins_plugins from plugin-dir (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from newjenkins-token-jmfsz (ro)
Containers:
  jenkins:
    Container ID:
    Image:         jenkins/jenkins:lts
    Image ID:
    Ports:         8080/TCP, 50000/TCP
    Host Ports:    0/TCP, 0/TCP
    Args:
      --argumentsRealm.passwd.$(ADMIN_USER)=$(ADMIN_PASSWORD)
      --argumentsRealm.roles.$(ADMIN_USER)=admin
      --httpPort=8080
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:      50m
      memory:   256Mi
    Liveness:   http-get http://:http/login delay=90s timeout=5s period=10s #success=1 #failure=5
    Readiness:  http-get http://:http/login delay=60s timeout=5s period=10s #success=1 #failure=3
    Environment:
      POD_NAME:                  newjenkins-84cd855fb6-mr9rm (v1:metadata.name)
      JAVA_OPTS:
      JENKINS_OPTS:
      JENKINS_SLAVE_AGENT_PORT:  50000
      ADMIN_PASSWORD:            <set to the key 'jenkins-admin-password' in secret 'newjenkins'>  Optional: false
      ADMIN_USER:                <set to the key 'jenkins-admin-user' in secret 'newjenkins'>      Optional: false
    Mounts:
      /tmp from tmp (rw)
      /usr/share/jenkins/ref/plugins/ from plugin-dir (rw)
      /usr/share/jenkins/ref/secrets/ from secrets-dir (rw)
      /var/jenkins_config from jenkins-config (ro)
      /var/jenkins_home from jenkins-home (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from newjenkins-token-jmfsz (ro)
Conditions:
  Type              Status
  Initialized       False
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  plugins:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  tmp:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  jenkins-config:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      newjenkins
    Optional:  false
  secrets-dir:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  plugin-dir:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  jenkins-home:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  newjenkins
    ReadOnly:   false
  newjenkins-token-jmfsz:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  newjenkins-token-jmfsz
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type    Reason     Age        From                   Message
  ----    ------     ----       ----                   -------
  Normal  Scheduled  <unknown>  default-scheduler      Successfully assigned default/newjenkins-84cd855fb6-mr9rm to worker-node2
  Normal  Pulling    9m41s      kubelet, worker-node2  Pulling image "jenkins/jenkins:lts"
[root@kube-master tmp]# kubectl describe pod newjenkins-84cd855fb6-mr9rm
Name:           newjenkins-84cd855fb6-mr9rm
Namespace:      default
Priority:       0
Node:           worker-node2/192.168.20.56
Start Time:     Thu, 14 May 2020 14:58:13 +0500
Labels:         app.kubernetes.io/component=jenkins-master
                app.kubernetes.io/instance=newjenkins
                app.kubernetes.io/managed-by=Tiller
                app.kubernetes.io/name=jenkins
                helm.sh/chart=jenkins-1.16.0
                pod-template-hash=84cd855fb6
Annotations:    checksum/config: 70d4b49bc5cd79a1a978e1bbafdb8126f8accc44871772348fd481642e33cffb
Status:         Pending
IP:
IPs:            <none>
Controlled By:  ReplicaSet/newjenkins-84cd855fb6
Init Containers:
  copy-default-config:
    Container ID:
    Image:         jenkins/jenkins:lts
    Image ID:
    Port:          <none>
    Host Port:     <none>
    Command:
      sh
      /var/jenkins_config/apply_config.sh
    State:          Waiting
      Reason:       ErrImagePull
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:     50m
      memory:  256Mi
    Environment:
      ADMIN_PASSWORD:  <set to the key 'jenkins-admin-password' in secret 'newjenkins'>  Optional: false
      ADMIN_USER:      <set to the key 'jenkins-admin-user' in secret 'newjenkins'>      Optional: false
    Mounts:
      /tmp from tmp (rw)
      /usr/share/jenkins/ref/secrets/ from secrets-dir (rw)
      /var/jenkins_config from jenkins-config (rw)
      /var/jenkins_home from jenkins-home (rw)
      /var/jenkins_plugins from plugin-dir (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from newjenkins-token-jmfsz (ro)
Containers:
  jenkins:
    Container ID:
    Image:         jenkins/jenkins:lts
    Image ID:
    Ports:         8080/TCP, 50000/TCP
    Host Ports:    0/TCP, 0/TCP
    Args:
      --argumentsRealm.passwd.$(ADMIN_USER)=$(ADMIN_PASSWORD)
      --argumentsRealm.roles.$(ADMIN_USER)=admin
      --httpPort=8080
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Limits:
      cpu:     2
      memory:  4Gi
    Requests:
      cpu:      50m
      memory:   256Mi
    Liveness:   http-get http://:http/login delay=90s timeout=5s period=10s #success=1 #failure=5
    Readiness:  http-get http://:http/login delay=60s timeout=5s period=10s #success=1 #failure=3
    Environment:
      POD_NAME:                  newjenkins-84cd855fb6-mr9rm (v1:metadata.name)
      JAVA_OPTS:
      JENKINS_OPTS:
      JENKINS_SLAVE_AGENT_PORT:  50000
      ADMIN_PASSWORD:            <set to the key 'jenkins-admin-password' in secret 'newjenkins'>  Optional: false
      ADMIN_USER:                <set to the key 'jenkins-admin-user' in secret 'newjenkins'>      Optional: false
    Mounts:
      /tmp from tmp (rw)
      /usr/share/jenkins/ref/plugins/ from plugin-dir (rw)
      /usr/share/jenkins/ref/secrets/ from secrets-dir (rw)
      /var/jenkins_config from jenkins-config (ro)
      /var/jenkins_home from jenkins-home (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from newjenkins-token-jmfsz (ro)
Conditions:
  Type              Status
  Initialized       False
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  plugins:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  tmp:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  jenkins-config:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      newjenkins
    Optional:  false
  secrets-dir:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  plugin-dir:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  jenkins-home:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  newjenkins
    ReadOnly:   false
  newjenkins-token-jmfsz:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  newjenkins-token-jmfsz
    Optional:    false
QoS Class:       Burstable
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason          Age                From                   Message
  ----     ------          ----               ----                   -------
  Normal   Scheduled       <unknown>          default-scheduler      Successfully assigned default/newjenkins-84cd855fb6-mr9rm to worker-node2
  Warning  Failed          50s                kubelet, worker-node2  Failed to pull image "jenkins/jenkins:lts": rpc error: code = Unknown desc = unauthorized: authentication required
  Warning  Failed          50s                kubelet, worker-node2  Error: ErrImagePull
  Normal   SandboxChanged  49s                kubelet, worker-node2  Pod sandbox changed, it will be killed and re-created.
  Normal   Pulling 28s (x2 over 10m)  kubelet, worker-node2  Pulling image "jenkins/jenkins:lts"

每次使用docker ErrImagePull时，使用docker pull Jenkins 镜像(使用docker pull jenkins进行docker hub登录而没有docker hub帐户登录)来手动提取jenkins镜像。

Answer 1

提示位于Events部分:

Failed to pull image "jenkins/jenkins:lts": rpc error: code = Unknown desc = unauthorized: authentication required

当工作容器旋转容器时，工作节点上的kubelet会在执行pod之前执行docker pull。

确保该节点使用docker login登录，以便本地工作节点可以手动提取镜像(如果尚未提取)。

如果有并且还在发生，则可能需要适当的密码才能访问有问题的存储库。如果仍然发生这种情况，请不要为镜像使用简称(不是jenkins/jenkins:lts，请指定完整路径，例如my-image-registry:5001/jenkins/jenkins:lts)以确保它是从正确的位置提取的，而不是配置了Docker的默认注册表。希望能有所帮助。