前面可以通過ImagPullPolicy和ImageullSecrets指定下載映象的策略，ServiceAccount也可以基於spec.imagePullSecret欄位附帶一個由下載映象專用的Secret資源組成的列表，用於在容器建立時，從某個私有映象倉庫下載映象檔案之前的服務認證。
這裡根據自己的實際去定義即可；一定要是對的地址和認證資訊；否則無法pull/push
root@ks-master01-10:~# kubectl create secret docker-registry \
> aliyun-haitang-registry \
> --docker-server=registry.cn-hangzhou.aliyuncs.com \
> --docker-username=xxxxxxx\
> --docker-password=xxxxxx
secret/aliyun-haitang-registry created
root@ks-master01-10:~# kubectl describe secret aliyun-haitang
Name: aliyun-haitang
Namespace: default
Labels: <none>
Annotations: <none>
Type: kubernetes.io/dockerconfigjson
Data
====
.dockerconfigjson: 140 bytes
此處不設定任何映象拉取策略，測試是否能拉取私有倉庫映象；
root@ks-master01-10:~# cat pod-serviceaccount-secret.yaml
apiVersion: v1
kind: Pod
metadata:
name: stree-serviceaccount
spec:
containers:
- name: stree
image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
stree-serviceaccount 0/1 ErrImagePull 0 8s
可以看到事件，是Docker認證的問題；
root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 20s default-scheduler Successfully assigned default/stree-serviceaccount to ks-node02-12
Normal BackOff 17s kubelet Back-off pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Warning Failed 17s kubelet Error: ImagePullBackOff
Normal Pulling 2s (x2 over 19s) kubelet Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Warning Failed 2s (x2 over 18s) kubelet Failed to pull image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest": rpc error: code = Unknown desc = Error response from daemon: pull access denied for registry.cn-hangzhou.aliyuncs.com/lengyuye/stress, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Warning Failed 2s (x2 over 18s) kubelet Error: ErrImagePull
aliyun-haitang是docker-registry型別的Secrets物件，由使用者提前手動建立，它可以通過鍵值資料提供docker倉庫伺服器的地址，接入伺服器的使用者名稱，密碼及使用者的電子郵件資訊等，認證通過後，參照ServiceAccount的Pod資源即可從指定的映象倉庫下載image。
root@ks-master01-10:~# cat serviceaccount-imagepullsecret.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
name: imagepull-aliyun-sa
imagePullSecrets:
- name: aliyun-haitang
root@ks-master01-10:~# kubectl apply -f serviceaccount-imagepullsecret.yaml
serviceaccount/imagepull-aliyun-sa created
root@ks-master01-10:~# kubectl get sa imagepull-aliyun-sa -o yaml
apiVersion: v1
imagePullSecrets:
- name: aliyun-haitang
kind: ServiceAccount
metadata:
annotations:
kubectl.kubernetes.io/last-applied-configuration: |
{"apiVersion":"v1","imagePullSecrets":[{"name":"aliyun-haitang"}],"kind":"ServiceAccount","metadata":{"annotations":{},"name":"imagepull-aliyun-sa","namespace":"default"}}
creationTimestamp: "2022-09-07T02:31:05Z"
name: imagepull-aliyun-sa
namespace: default
resourceVersion: "226300"
uid: fabc93b1-572c-4703-a2dd-465d4e0915cb
secrets:
- name: imagepull-aliyun-sa-token-vf67z
root@ks-master01-10:~# cat pod-serviceaccount-secret.yaml
apiVersion: v1
kind: Pod
metadata:
name: stree-serviceaccount
spec:
serviceAccount: imagepull-aliyun-sa # 這裡則是建立的sa的名稱
containers:
- name: stree
image: registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest
root@ks-master01-10:~/rbac# kubectl apply -f pod-serviceaccount-secret.yaml
pod/stree-serviceaccount created
root@ks-master01-10:~# kubectl get pods
NAME READY STATUS RESTARTS AGE
stree-serviceaccount 1/1 Running 0 8s
root@ks-master01-10:~# kubectl describe pods stree-serviceaccount
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 3m36s default-scheduler Successfully assigned default/stree-serviceaccount to ks-node02-12
Normal Pulling 3m35s kubelet Pulling image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest"
Normal Pulled 3m33s kubelet Successfully pulled image "registry.cn-hangzhou.aliyuncs.com/lengyuye/stress:latest" in 1.729555429s
Normal Created 3m33s kubelet Created container stree
Normal Started 3m33s kubelet Started container stree
root@ks-master01-10:~# kubectl get pods stree-serviceaccount -o yaml
imagePullSecrets:
- name: aliyun-haitang
nodeName: ks-node02-12
preemptionPolicy: PreemptLowerPriority
priority: 0
restartPolicy: Always
schedulerName: default-scheduler
securityContext: {}
serviceAccount: imagepull-aliyun-sa
serviceAccountName: imagepull-aliyun-sa