Kubernetes从多个专用docker注册中心拉取

Question

kubectl create secret docker-registry regcred --docker-server=<your-registry-server> --docker-username=<your-name> --docker-password=<your-pword> --docker-email=<your-email>

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      imagePullSecrets:
      - name: regcred
      containers:
      - name: foo
        image: foo.example.com

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      containers:
      - name: foo
        image: foo.example.com
        imagePullSecrets:
        - name: foo-secret
      - name: bar
        image: bar.example.com
        imagePullSecrets:
        - name: bar-secret

我尝试创建foo-secret和bar-secret两个秘密，并适当地引用每一个，但我发现它无法拉动这两个容器。

Answer 1

您必须在pod级别直接包含ImagePullSecrets:，但在那里可以有多个秘密。

apiVersion: apps/v1beta1
kind: Deployment
metadata:
  name: foo
spec:
  replicas: {{ .Values.replicaCount }}
  template: 
    spec:
      imagePullSecrets:
      - name: foo-secret
      - name: bar-secret
      containers:
      - name: foo
        image: foo.example.com/foo-image
      - name: bar
        image: bar.example.com/bar-image

Kubernetes在此方面的文档说明：

如果需要访问多个注册表，可以为每个注册表创建一个秘密。Kubelet在为您的Pod提取图像时，会将任何ImagePullSecrets合并到单个虚拟的.docker/config.json中。