Links

镜像拉取失败问题

常见镜像拉取问题排查

1. Pod状态为ErrImagePull或ImagePullBackOff

docker-hub-75d4dfb984-5hggg 0/1 ImagePullBackOff 0 14m 192.168.1.30 <node ip>
docker-hub-75d4dfb984-9r57b 0/1 ErrImagePull 0 53s 192.168.0.42 <node ip>
  • ErrImagePull:表示pod已经调度到node节点,kubelet调用docker去拉取镜像失败。
  • ImagePullBackOff:表示kubelet拉取镜像失败后,不断重试去拉取仍然失败。

2. 查看pod的事件

通过kubectl describe pod 命令查看pod事件,该事件的报错信息在kubelet或docker的日志中也会查看到。

2.1. http: server gave HTTP response to HTTPS client

如果遇到以下报错,尝试将该镜像仓库添加到docker可信任的镜像仓库配置中。
Error getting v2 registry: Get https://docker.com:8080/v2/: http: server gave HTTP response to HTTPS client"
具体操作是修改/etc/docker/daemon.json的insecure-registries参数
#cat /etc/docker/daemon.json
{
...
"insecure-registries": [
...
"docker.com:8080"
],
...
}

2.2. no basic auth credentials

如果遇到no basic auth credentials报错,说明kubelet调用docker接口去拉取镜像时,镜像仓库的认证信息失败。
Normal BackOff 18s kubelet, 192.168.1.1 Back-off pulling image "docker.com:8080/public/2048:latest"
Warning Failed 18s kubelet, 192.168.1.1 Error: ImagePullBackOff
Normal Pulling 5s (x2 over 18s) kubelet, 192.168.1.1 Pulling image "docker.com:8080/public/2048:latest"
Warning Failed 5s (x2 over 18s) kubelet, 192.168.1.1 Failed to pull image "docker.com:8080/public/2048:latest": rpc error: code = Unknown desc = Error response from daemon: Get http://docker.com:8080/v2/public/2048/manifests/latest: no basic auth credentials
Warning Failed 5s (x2 over 18s) kubelet, 192.168.1.1 Error: ErrImagePull
具体操作,在拉取镜像失败的节点上登录该镜像仓库,认证信息会更新到 $HOME/.docker/config.json文件中。将该文件拷贝到/var/lib/kubelet/config.json中。