minikube - x509:由未知颁发机构签名的证书

Question

我正在使用迷你库贝和库贝特为蒙戈创建一个RC。我正在使用该公司的VPN。

通过kubectl create-f./rc/mongo-rc.yaml命令创建了RC。

使用kubectl describe pod mongo-5zttk命令时出现以下kubernetes事件：

...
Events:
  Type     Reason     Age                    From               Message
  ----     ------     ----                   ----               -------
  Normal   Scheduled  7m18s                  default-scheduler  Successfully assigned default/mongo-5zttk to minikube
  Normal   Pulling    5m42s (x4 over 7m17s)  kubelet, minikube  Pulling image "mongo"
  Warning  Failed     5m40s (x4 over 7m15s)  kubelet, minikube  Failed to pull image "mongo": rpc error: code = Unknown desc = Error response from daemon: Get https://registry-1.docker.io/v2/library/mongo/manifests/latest: Get https://auth.docker.io/token?scope=repository%3Alibrary%2Fmongo%3Apull&service=registry.docker.io: x509: certificate signed by unknown authority
  Warning  Failed     5m40s (x4 over 7m15s)  kubelet, minikube  Error: ErrImagePull
  Normal   BackOff    5m29s (x6 over 7m15s)  kubelet, minikube  Back-off pulling image "mongo"
  Warning  Failed     2m8s (x21 over 7m15s)  kubelet, minikube  Error: ImagePullBackOff

当我尝试使用卷曲访问网址时：

⚡  curl https://registry-1.docker.io/v2/library/mongo/manifests/latest
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/mongo","Action":"pull"}]}]}

我可以成功地从泊坞中心注册表中提取 mongo：最新映像。

⚡  docker pull mongo:latest
latest: Pulling from library/mongo
Digest: sha256:efc408845bc917d0b7fd97a8590e9c8d3c314f58cee651bd3030c9cf2ce9032d
Status: Image is up to date for mongo:latest
docker.io/library/mongo:latest

环境信息:

• minikube版本：v1.14.1
• kubectl
  • 客户端版本：v1.18.8
  • 服务器版本：v1.19.2

  我已经阅读了由未知机构签署的doc:vpn_and_proxy/#x509证书。解决方案是要求IT部门提供适当的PEM文件。如果我无法获取PEM文件，有什么解决方案吗？例如，使用一些命令标志：--跳过验证证书？

  更新:

  mongo-rc.yaml：

  apiVersion: v1
  kind: ReplicationController
  metadata: 
    name: mongo
  spec: 
    replicas: 1
    selector: 
      app: mongo
    template: 
      metadata: 
        labels:
          app: mongo
      spec: 
        containers: 
        - name: mongo
          image: mongo
          ports: 
          - containerPort: 27017
          env: 
          - name: MONGO_ROOT_PASSWORD
            value: "123456"
  

Answer 1

您应该能够使用--unsecureregistry标志，但您可能需要重新创建minikube集群才能使其工作。

minikube start --insecure-registry="registry-1.docker.io"