AKS，拉取 docker 映像失败并出现错误：未找到标记为“最新”的清单

Question

我正在尝试使用 azure devops git repo 中的管道设置将 Spring Boot 应用程序部署到 azure kubernetes 集群。但是 aks 部署失败并出现以下错误：

无法提取图像“sapcemission.azurecr.io/spaceship”：[rpc 错误： 代码 = 未知 desc = 来自守护进程的错误响应：清单 sapcemission.azurecr.io/spaceship：最新未找到：清单未知： 未找到标记为“最新”的清单，rpc 错误：代码 = 未知 desc = 来自守护程序的错误响应：获取 https://sapcemission.azurecr.io/v2/spaceship/manifests/latest： 未授权：需要认证，访问 https://aka.ms/acr/authorization 了解更多信息。]

我的项目是一个包含两个模块的 Spring Boot 多模块项目。我正在尝试同时部署它们。我在这里做错了什么？

azure-pipelines.yml

# Deploy to Azure Kubernetes Service
# Build and push image to Azure Container Registry; Deploy to Azure Kubernetes Service
# https://docs.microsoft.com/azure/devops/pipelines/languages/docker

trigger:
- master

resources:
- repo: self

variables:

  # Container registry service connection established during pipeline creation
  dockerRegistryServiceConnection: 'd5d300b9-b22f-4b38-a5c8-35526548a630'
  imageRepositoryCommandCenter: 'commandcenter'
  imageRepositorySpaceShip: 'spaceship'
  containerRegistry: 'sapcemissipion.azurecr.io'
  dockerfilePathCommandCenter: '**/command-center/Dockerfile'
  dockerfilePathSpaceShip: '**/space-ship/Dockerfile'
  tag: '$(Build.BuildId)'
  imagePullSecret: 'sapcemission13564b3d-auth'

  # Agent VM image name
  vmImageName: 'ubuntu-latest'
  

stages:
- stage: Build
  displayName: Build stage
  jobs:  
  - job: Build
    displayName: Build
    pool:
      vmImage: $(vmImageName)
    steps:
    - task: Maven@3
      inputs:
        mavenPomFile: 'pom.xml'
        publishJUnitResults: true
        testResultsFiles: '**/surefire-reports/TEST-*.xml'
        javaHomeOption: 'JDKVersion'
        mavenVersionOption: 'Default'
        mavenAuthenticateFeed: false
        effectivePomSkip: false
        sonarQubeRunAnalysis: false
    - task: Docker@2
      displayName: Build and push an command center image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepositoryCommandCenter)
        dockerfile: $(dockerfilePathCommandCenter)
        containerRegistry: $(dockerRegistryServiceConnection)
        tags: |
          $(tag)
    - task: Docker@2
      displayName: Build and push an space ship image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepositorySpaceShip)
        dockerfile: $(dockerfilePathSpaceShip)
        containerRegistry: $(dockerRegistryServiceConnection)
        tags: |
          $(tag)
          
    - upload: manifests
      artifact: manifests

- stage: Deploy
  displayName: Deploy stage
  dependsOn: Build

  jobs:
  - deployment: Deploy
    displayName: Deploy
    pool:
      vmImage: $(vmImageName)
    environment: 'spacemission-1550.kube-system'
    strategy:
      runOnce:
        deploy:
          steps:
          - task: KubernetesManifest@0
            displayName: Create imagePullSecret
            inputs:
              action: createSecret
              secretName: $(imagePullSecret)
              dockerRegistryEndpoint: $(dockerRegistryServiceConnection)
              
          - task: KubernetesManifest@0
            displayName: Deploy to Kubernetes cluster
            inputs:
              action: deploy
              manifests: |
                $(Pipeline.Workspace)/manifests/deployment.yml
                $(Pipeline.Workspace)/manifests/service.yml
              imagePullSecrets: |
                $(imagePullSecret)
              containers: |
                $(containerRegistry)/$(imageRepositoryCommandCenter):$(tag)
                $(containerRegistry)/$(imageRepositorySpaceShip):$(tag)

deployment.yml

apiVersion : apps/v1beta1
kind: Deployment
metadata:
  name: commandcenter
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: commandcenter
    spec:
      containers:
        - name: commandcenter
          image: sapcemission.azurecr.io/commandcenter
          ports:
          - containerPort: 8080


---


apiVersion : apps/v1beta1
kind: Deployment
metadata:
  name: spaceship
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: spaceship
    spec:
      containers:
        - name: spaceship
          image: sapcemission.azurecr.io/spaceship
          ports:
          - containerPort: 8081

service.yml

apiVersion: v1
kind: Service
metadata:
    name: commandcenter
spec:
    type: LoadBalancer
    ports:
    - port: 8080
    selector:
        app: commandcenter

---

apiVersion: v1
kind: Service
metadata:
    name: spaceship
spec:
    type: LoadBalancer
    ports:
        - port: 8080
    selector:
        app: spaceship

Answer 1

由于错误显示需要身份验证。我看到您创建了imagePullSecret，因此您只需在部署 YAML 文件时添加 imagePullSecret，如下所示：

apiVersion : apps/v1beta1
kind: Deployment
metadata:
  name: commandcenter
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: commandcenter
    spec:
      containers:
        - name: commandcenter
          image: sapcemission.azurecr.io/commandcenter
          ports:
          - containerPort: 8080
      imagePullSecrets:                             # here
      - name: "sapcemission13564b3d-auth"
---
apiVersion : apps/v1beta1
kind: Deployment
metadata:
  name: spaceship
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: spaceship
    spec:
      containers:
        - name: spaceship
          image: sapcemission.azurecr.io/spaceship
          ports:
          - containerPort: 8081
      imagePullSecrets:                             # here                             
      - name: "sapcemission13564b3d-auth"

并且该错误还显示找不到图像标签。所以你还需要检查标签是否真的存在。

Answer 2

在此处关注文档Authenticate with Azure Container Registry from Azure Kubernetes Service

将 Azure 容器注册表 (ACR) 与 Azure Kubernetes 服务 (AKS) 结合使用时，需要建立身份验证机制。通过向您的 ACR 授予所需的权限，此操作作为 CLI 和门户体验的一部分实施。

最简单的方法是：

az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acrName>

但这需要：

• Azure 订阅的所有者或 Azure 帐户管理员角色
• Azure CLI 2.7.0 或更高版本

为避免需要所有者或 Azure 帐户管理员角色，您可以手动配置服务主体或使用现有服务主体从 AKS 对 ACR 进行身份验证。有关详细信息，请参阅使用服务主体的 ACR 身份验证或使用拉取密钥从 Kubernetes 进行身份验证。