-
各作業節點負責運行Pod物件，而Pod的核心功能用于運行容器，因此作業節點上必須配置容器引擎，如Dokcer、Containerd等，啟動容器時，容器引擎將首先于本地查找指定的鏡像檔案，不存在的鏡像則需要從指定的鏡像倉庫(Registry)下載至本地；
-
kubernetes支持用戶自定義鏡像檔案的獲取方式策略，例如在網路資源緊張的時候可以禁止從倉庫中獲取檔案鏡像等，容器的ImagePullPolicy欄位用于為其指定鏡像獲取策略，可用值包括:
- IfNotPresent: 本地有鏡像則使用本地鏡像，本地不存在則拉取鏡像；(默認值)
- Always: 每次都嘗試拉取鏡像；
- Never: 永不拉取，禁止從倉庫下載鏡像，如果本地鏡像已經存在，kubelet會嘗試啟動容器，否則，啟動失敗；
-
官方檔案: https://kubernetes.io/zh-cn/docs/concepts/containers/images/
-
我們可以通過explain來查看它的屬性
imgaepullpolicy是容器級別的；
root@ks-master01-10:~# kubectl explain pod.spec.containers.imagePullPolicy
KIND: Pod
VERSION: v1
FIELD: imagePullPolicy <string>
DESCRIPTION:
Image pull policy. One of Always, Never, IfNotPresent. Defaults to Always
if :latest tag is specified, or IfNotPresent otherwise. Cannot be updated.
More info:
https://kubernetes.io/docs/concepts/containers/images#updating-images
- 示例說明；
root@ks-master01-10:~# cat tomcat-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: tomcat-test
namespace: default
spec:
containers:
- name: tomcat
image: tomcat:latest
imagePullPolicy: Always
root@ks-master01-10:~# kubectl apply -f tomcat-test.yaml
pod/tomcat-test created
- 現在Pod是正常狀態；
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
tomcat-test 1/1 Running 0 87s
- 我們來看看詳細描述；
定義了使用tomcat:latest鏡像，其獲取策略為Always，這就意味每次啟動容器時，它都會從鏡像倉庫獲取最新版本的鏡像檔案；
root@ks-master01-10:~# kubectl describe pods tomcat-test
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 82s default-scheduler Successfully assigned default/mysql-test to ks-node24-24
Normal Pulling 81s kubelet Pulling image "tomcat:latest"
Normal Pulled 45s kubelet Successfully pulled image "tomcat:latest" in 36.41152006s
Normal Created 45s kubelet Created container tomcat
Normal Started 45s kubelet Started container tomcat
- IfNotPresent
對于其他標簽的鏡像，其默認策略為IfNotPresent，需要注意的是，使用私有倉庫中的鏡像時通常需要由Registry服務器完成認證才能進行，認證程序要么需要在相關節點上互動執行docker login命令進行，要么就是將認證資訊定義為secret資源，通過ImagePullSecrets欄位來完成認證資訊；
- 示例
root@ks-master01-10:~# cat httpdpod-test.yaml
apiVersion: v1
kind: Pod
metadata:
name: httpd-testpod
namespace: default
spec:
containers:
- name: httpd
image: registry.cn-hangzhou.aliyuncs.com/lengyuye/httpd:alpine3.14
imagePullPolicy: IfNotPresent
root@ks-master01-10:~# kubectl apply -f httpdpod-test.yaml
pod/httpd-testpod created
來查看下詳情；
為什么能拉取私有倉庫的鏡像，因為docker login認證過，沒有認證的話拉取鏡像的時候會Error；
root@ks-master01-10:~# kubectl describe pods httpd-testpod
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 4m28s default-scheduler Successfully assigned default/httpd-testpod to ks-node24-24
Normal Pulling 4m27s kubelet Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/httpd:alpine3.14"
Normal Pulled 4m24s kubelet Successfully pulled image "registry.cn-hangzhou.aliyuncs.com/lengyuye/httpd:alpine3.14" in 3.56652979s
Normal Created 4m23s kubelet Created container httpd
Normal Started 4m23s kubelet Started container httpd
Pod運行正常；
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
httpd-testpod 1/1 Running 0 3m26s
轉載請註明出處，本文鏈接：https://www.uj5u.com/qita/502321.html
標籤：其他
上一篇：UE藍圖---實作場景物體Transform狀態重置效果
下一篇：代碼審計-PHP反序列化漏洞