当前位置：网站首页>The "open source star picking program" container pulls private images from harbor, which is a necessary skill for cloud native advanced technology

The "open source star picking program" container pulls private images from harbor, which is a necessary skill for cloud native advanced technology

2022-06-23 19:45:00 【51CTO】

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _Harbor

【 Abstract 】 To configure Containerd Pull harbor Image in private warehouse , The essential skills of migrant workers ！

This article has participated in 「 Open source star picking program 」, Welcome to join us .

Activity Links ： https://github.com/weopenprojects/WeOpen-Star

Preface

stay k8s Of 1.20 After the release , Announced that 1.23.x No longer use doker shim Run time as the default underlying container , But through Container Runtime Interface(CRI) Use containerd To run as a container , So it turned out that docker The personal warehouse environment configured in no longer works , Lead to k8s To configure pods Failed to pull the image on , This article will demonstrate how to containerd Configure from Harbor Private warehouses pull images .

Environmental statement

operating system ：CentOS
Harbor Version：2.3.5
Containerd Version:1.6.5
Harbor Address ： https://192.168.2.22:443

Containerd Use binary installation , For installation steps, see ： https://blog.51cto.com/lidabai/5408290
Harbor Use https Deployed by certificate authentication , For deployment documents, see ： https://blog.51cto.com/lidabai/5173694

modify containerd To configure

To configure Harbor Private image warehouse address

       
       [[email protected] ~]
       
       # vim /etc/containerd/config.toml
       
...
       
version 
       
       = 
       
       2
       
...
       
[plugins]
       
   [plugins.
       
       "io.containerd.grpc.v1.cri"]
       
      [plugins.
       
       "io.containerd.grpc.v1.cri".cni]
       
      ...
       
       ######################################################## Configure the following sections ：
       
       [plugins.
       
       "io.containerd.grpc.v1.cri".registry]
       
      config_path 
       
       = 
       
       ""
       
      [plugins.
       
       "io.containerd.grpc.v1.cri".registry.auths]
       
      [plugins.
       
       "io.containerd.grpc.v1.cri".registry.headers]
       
      [plugins.
       
       "io.containerd.grpc.v1.cri".registry.mirrors]
       
         [plugins.
       
       "io.containerd.grpc.v1.cri".registry.mirrors.
       
       "docker.io"]
       
           endpoint 
       
       = [
       
       "https://kvuwuws2.mirror.aliyuncs.com",
       
       "http://hub-mirror.c.163.com"]
       
         [plugins.
       
       "io.containerd.grpc.v1.cri".registry.mirrors.
       
       "harbor.lidabai"]   
       
       # name 
       
           endpoint 
       
       = [
       
       "https://192.168.2.22:443"]    
       
       #Harbor Of Url Address 
       
      [plugins.
       
       "io.containerd.grpc.v1.cri".registry.configs]
       
         [plugin.
       
       "io.containerd.grpc.v1.cri".registry.configs.
       
       "harbor.lidabai".tls]  
       
       #tle,harbor  Certificate authentication configuration 
       
            insecure_skip_verify 
       
       = 
       
       true   
       
       # Whether to skip Certificate Authentication 
       
            ca_file 
       
       = 
       
       "/etc/containerd/harbor/ca.crt"   
       
       # CA  certificate 
       
            cert_file 
       
       = 
       
       "/etc/containerd/harbor/harbor.crt"    
       
       # harbor  certificate 
       
            key_file  
       
       = 
       
       "/etc/containerd/harbor/harbor.key"  
       
       # harbor  Private key 
       
         [plugin.
       
       "io.containerd.grpc.v1.cri".registry.configs.
       
       "harbor.lidabai".auth] 
       
       #auth, Configure registry credentials 
       
            username 
       
       = 
       
       "admin"    
       
       #Harbor user name 
       
            password 
       
       = 
       
       "Harbor12345"    
       
       #Harbor password 
       
            auth 
       
       = 
       
       ""
       
            identitytoken 
       
       = 
       
       ""
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _ Operation and maintenance _02

restart containerd.service service

Reload load systemd Of daemon Daemon and restart containerd.service service , then k8s The cluster node can normally start from Harbor Pull the mirror image .

      
      
       
       $ systemctl daemon-reload && systemctl 
       
       restart containerd.service
      
      
      
      
       
       1.

Pull the mirror image

Although the above method can make k8s Pull image directly , But using ctl command When manually pulling the image, the following error will be reported （ crater - After countless failed tests , I thought it was CA Issued by certificate harbor Certificate problem ）, Even if you are in config.toml Middle configuration insecure_skip_verify by true No way , You can add -k Parameter to skip Certificate Validation .

      
      
       
       [[email protected] ~]
       
       # ctr -n harbor.lidabai i pull 192.168.2.22:443/library/prepare:v2.5.1 -k
      
      
      
      
       
       1.

View the downloaded image

Just now we downloaded the image through -n The parameter specifies namespace. When viewing, you should also pass -n Appoint namespace, Otherwise, I can't see .

      
      
       
       [[email protected] ~]
       
       # ctr -n harbor.lidabai images ls
      
      
      
      
       
       1.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _ Cloud native _03

Record on pit

unexpected status code [manifests 1.28]: 401 Unauthorized

【 Problem description 】

download Harbor There is an error in the private image in ：

       
       [[email protected] app]
       
       # ctr -n harbor.lidabai images pull 192.168.2.22:443/lidabai/busybox:1.28 -k
       
ctr: failed to resolve reference 
       
       "192.168.2.22:443/lidabai/busybox:1.28": unexpected status code [manifests 
       
       1.28]: 
       
       401 Unauthorized
      
1.
2.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _kubernetes_04

【 reason 】401 unaccredited

【 solve 】 adopt -u Parameter assignment Harbor User name and password .

       
       $ ctr 
       
       -n harbor.lidabai  images  pull 
       
       192.168.2.22:443/lidabai/busybox:1.28  
       
       -u admin:Harbor12345 
       
       -k
      
1.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _ Operation and maintenance _05

x509: certificate signed by unknown authority

【 Error description 】 An error occurs when pulling the image ：

       
       [[email protected] ~]
       
       # ctr images pull 192.168.2.22:443/library/prepare:v2.5.1
       
       error
       
       =
       
       "failed to do request: Head \"https://192.168.2.22:443/v2/library/prepare/manifests/v2.5.1\": x509: certificate signed by unknown authority" 
       
       host
       
       =
       
       "192.168.2.22:443"
       
ctr: failed to resolve reference 
       
       "192.168.2.22:443/library/prepare:v2.5.1": failed to 
       
       do request: Head 
       
       "https://192.168.2.22:443/v2/library/prepare/manifests/v2.5.1": x509: certificate signed by unknown authority
      
1.
2.
3.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _ Operation and maintenance _06

【 terms of settlement 】：

1） adopt -k Parameter to skip Certificate Validation .

      
      
       
       [[email protected] ~]
       
       # ctr -n harbor.lidabai i pull 192.168.2.22:443/library/prepare:v2.5.1 -k
      
      
      
      
       
       1.

「 Open source star picking program 」Containerd Pull Harbor Private image in , Cloud native advanced necessary skills _ Operation and maintenance _07

2） Appoint CA certificate 、Harbor Relevant certificate file path .

       
       $ mkdir /etc/containerd/harbor/   
       
       # Create certificate storage directory 
       
       $ scp  /app/harbor-cert/{ca.pem,harbor.pem,harbor-key.pem} 
       
       192.168.2.41:/etc/containerd/harbor/
       
       $ ctr 
       
       -n harbor.lidabai  images  pull 
       
       192.168.2.22:443/library/prepare:v2.5.1 \
       
       --tlscacert  /etc/containerd/harbor/ca.pem \     
       
       # or ca.crt
       
       --tlscert  /etc/containerd/harbor/harbor.pem \   
       
       # or harbor.crt
       
       --tlskey  /etc/containerd/harbor/harbor-key.pem  
       
       # or harbor.key
      
1.
2.
3.
4.
5.
6.