首先要了解创建一个docker-registry类型的secret的资源命令:

[root@k8s ~]# kubectl create secret docker-registry --help
Create a new secret for use with Docker registries.

  Dockercfg secrets are used to authenticate against Docker registries.

  When using the Docker command line to push images, you can authenticate to a given registry by running:
      '$ docker login DOCKER_REGISTRY_SERVER --username=DOCKER_USER --password=DOCKER_PASSWORD --email=DOCKER_EMAIL'.

 That produces a ~/.dockercfg file that is used by subsequent 'docker push' and 'docker pull' commands to authenticate
to the registry. The email address is optional.

  When creating applications, you may have a Docker registry that requires authentication.  In order for the
  nodes to pull images on your behalf, they have to have the credentials.  You can provide this information
  by creating a dockercfg secret and attaching it to your service account.

Examples:
  # If you don't already have a .dockercfg file, you can create a dockercfg secret directly by using:
  kubectl create secret docker-registry my-secret --docker-server=DOCKER_REGISTRY_SERVER --docker-username=DOCKER_USER
--docker-password=DOCKER_PASSWORD --docker-email=DOCKER_EMAIL

Options:
      --allow-missing-template-keys=true: If true, ignore any errors in templates when a field or map key is missing in
the template. Only applies to golang and jsonpath output formats.
      --append-hash=false: Append a hash of the secret to its name.
      --docker-email='': Email for Docker registry
      --docker-password='': Password for Docker registry authentication
      --docker-server='https://index.docker.io/v1/': Server location for Docker registry
      --docker-username='': Username for Docker registry authentication
      --dry-run='none': Must be "none", "server", or "client". If client strategy, only print the object that would be
sent, without sending it. If server strategy, submit server-side request without persisting the resource.
      --from-file=[]: Key files can be specified using their file path, in which case a default name will be given to
them, or optionally with a name and file path, in which case the given name will be used.  Specifying a directory will
iterate each named file in the directory that is a valid secret key.
  -o, --output='': Output format. One of:
json|yaml|name|go-template|go-template-file|template|templatefile|jsonpath|jsonpath-file.
      --save-config=false: If true, the configuration of current object will be saved in its annotation. Otherwise, the
annotation will be unchanged. This flag is useful when you want to perform kubectl apply on this object in the future.
      --template='': Template string or path to template file to use when -o=go-template, -o=go-template-file. The
template format is golang templates [http://golang.org/pkg/text/template/#pkg-overview].
      --validate=true: If true, use a schema to validate the input before sending it

Usage:
  kubectl create secret docker-registry NAME --docker-username=user --docker-password=password --docker-email=email
[--docker-server=string] [--from-literal=key1=value1] [--dry-run=server|client|none] [options]

Use "kubectl options" for a list of global command-line options (applies to all commands).

创建指定服务的docker-registry服务的命令【常用于私有仓库】:

kubectl create secret docker-registry NAME --docker-server=servername --docker-username=user --docker-password=password
首先创建一个名为dockersecret的secret

示例对私有仓库的服务为:http://192.168.182.88:1180, 创建一个名为dockersecret的secret用户镜像拉取上传操作如下:

kubectl create secret docker-registry dockersecret --docker-server="http://192.168.182.88:1180" --docker-username="Test" --docker-password="Test123456789"

其次创建一个ServiceAccount

创建serviceAccount的yaml文件如下:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: harbor
imagePullSecrets:
- name: dockersecret

上述文件中imagePullsecrets下的name要与上述创建的secret名称保持一致,不然serviceAccount的image Pull secret中为none。

创建成功的可以通过下述命令查询:

kubectl describe sa harbor

1 对 “K8S中配置镜像拉取serviceAccount”的想法;

发表评论

电子邮件地址不会被公开。