AKS ba za ta iya ɗebo hoto daga registry mai zaman kansa bayan VPN ba
kubelet yana ɗebo ta hanyar cibiyar sadarwar node, ba ta VPN ɗin pod ba. Yanke shawara da hanyoyin node, DNS ɗin node, kowane endpoint da ɗebon ya taɓa, sannan TLS da asali.
Kwamfutarka tana ɗebo hoton ba matsala, amma pod ɗin yana zama a ImagePullBackOff, kuma wani yana ba da shawarar gudanar da abokin ciniki na VPN na kamfani a matsayin sidecar. Wannan ba zai taimaka ba, domin ɗebon yana faruwa kafin container ɗinka ya wanzu: kubelet yana roƙon container runtime a kan node ya kawo hoton, kuma runtime yana amfani da sararin suna na cibiyar sadarwar node. VPN cikin workload ba shi da hanyar da zai bayar wa wannan hanya, kuma dole ne a fara ɗebo hoton taimakonsa.
Tsarin ayyuka ne ke ƙayyade matakin
Da farko ana warware sunan hoton. kubelet, ta hanyar runtime, yana warware sunan registry, ya haɗa, ya tabbatar, ya sauke matakan, sannan ya fara container. Duk abin da pod ɗinka ke yi da VPN yana faruwa bayan wannan jerin, don haka tunnel da ke aiki a cikin cluster ba hujja ba ne kan ɗebon.
Shi ya sa hoton da aka ajiye a cache ya zama ƙarya mai gamsarwa. Node da ya ɗebo hoton makonni da suka wuce yana ci gaba da bayar da shi, deployment ɗin yana kama da lafiya, kuma gazawar tana bayyana ne kawai lokacin da mai tsarawa ya sanya replica a sabon node. Idan layin lokaci ya ƙunshi scale-up, maye gurbin node ko haɓaka pool, ɗauke su a matsayin mai jawo, ba sanadi ba.
Sharudda uku ne ke ƙayyade gyaran
Isar da registry mai zaman kansa daga node pool da ake sarrafawa ya dogara da turawa, warware sunaye da jerin endpoint. Idan subnet ɗin node ba zai iya turawa zuwa cibiyar sadarwar registry ba, babu wata shaidar da za ta taimaka. Idan yana turawa amma ba ya warware sunan registry ta hanyar DNS ɗin node, haɗin ba zai fara ba. Idan duka biyu suna aiki ga manifest endpoint amma ba ga blob endpoint da registry ke turawa zuwa gare shi ba, ɗebon yana gazawa a tsakiya.
| Condition | Typical symptom | Where to look |
|---|---|---|
| Node subnet has no route to the registry network | Timeout, no connection | Effective routes on the node NIC, gateway transit, return path on-premises |
| Node resolver cannot see the private zone | Name resolution failure in events | VNet DNS settings and the resolver the node actually uses |
| Only the manifest endpoint is reachable | Auth succeeds, layer download fails | Every hostname the registry hands out during the pull |
| TLS or identity is wrong | Certificate error, 401 or 403 | Server certificate name and trust, scoped pull identity |
VNet peering shi kaɗai ba ya ba ka duk tsarin gateway transit kai tsaye, kuma hanya da ke wanzu a gefe ɗaya ba hanya ce da ke aiki ba. Node yana buƙatar hanyar da aka goyi bayan ta hanyar VPN gateway da aka nufa ko naɓura da aka amince da ita, kuma gefen registry yana buƙatar hanyar dawowa zuwa subnet ɗin node.
Karanta gazawar kafin ka zaɓi magani
Fara da abubuwan da suka faru na pod da node da ya sauka a kai, da ainihin sunayenka: kubectl describe pod app-example -n team-example da kubectl get pod app-example -n team-example -o wide. Rubutun abin da ya faru yana raba sunan mai masauki da ba a warware ba daga timeout, kin amincewa da takardar shaida daga hoton da ya ɓace, da gazawar izini daga dukansu. Waɗannan huɗu suna da masu huɗu daban-daban.
Tabbatarwa ita ce mafi yawan abin da ake ƙima. imagePullSecret yana ba runtime shaidar registry; ba ya girka hanya, ba ya canza resolver ɗin node kuma ba ya sa takardar shaida marar aminci ta zama mai aiki. Idan abin da ya faru ya ce ɗebon bai sami izini ba, duba iyakar asalin. Idan ya ce haɗin ya ƙare, shaidar ba ta da mahimmanci.
Takardun hoto na Kubernetes su ne tushe kan halin ɗebo da shaidar registry masu zaman kansu, kuma ya cancanci karantawa sau ɗaya kafin ka canza cibiyar sadarwa, domin yana bayyana iyaka tsakanin tabbatarwa da jigilar.
Gina hanyar ƙasan pod
Yi aiki a wannan tsari, domin kowane mataki ba shi da maɓana har sai na baya ya tabbata. Fara turawa cibiyar sadarwar node: tabbatar subnet ɗin node yana da hanyar da aka goyi bayan zuwa cibiyar sadarwar registry, duba hanyoyin da ke aiki a kan node, dokokin tsaro a ɓangarorin biyu da hanyar dawowa a gefen registry.
Sannan warware sunan daga mahallin node. Resolver ɗin node ba daidai yake da tsarin DNS ɗin pod ba, kuma nasara cikin pod ba hujja ba ce kan runtime ɗin mai masauki. Yi amfani da DNS mai zaman kansa da ake sarrafawa maimakon shigarwa ta dindindin a hosts; shigarwar tana rayuwa har sai an maye gurbin node sannan ta ɓace a hankali.
Sannan tabbatar da kowane endpoint. Registry na iya ba abokin ciniki sabis na tabbatarwa daban da wurin ajiya na blob daban. Isar manifest endpoint ba ya tabbatar da kusan kome game da matakan. A ƙarshe kammala TLS da izini: takardar shaida mai aiki ga sunan registry kuma wadda aka amince da ita ta hanyar tsarin node da aka goyi bayan, tare da asalin ɗebo da aka iyakance ga karanta wannan repository.
Tabbatar a kan node da ba ka gyara da hannu ba
Jarrabawar da ke da mahimmanci ita ce sabon ɗebo da cikakken saukar da duk matakan a kan node da ya dace, mafi kyau wanda aka ƙirƙira ta hanyar scale ko maye gurbi. Wannan yana rufe duk pool ɗin da za su iya sanya workload, har da waɗanda ka manta. Gyaran hannu a node ɗaya ba tsarin turawa ba ne, kuma abin da ya faru na autoscale na gaba zai sami gibin.
Sake ƙirƙirar cluster a wata VNet na iya canza hanyar, amma ita ce makoma ta ƙarshe ba matakin bincike na farko ba. Kwatanta cibiyar sadarwar node da ke akwai da hanyar mai zaman kansa da ake buƙata da kuma matakan sarrafa cibiyar sadarwar AKS da aka goyi bayan kafin ka ba da shawarar ƙaura, kuma riƙe haɗin aikace-aikacen bayan farawa a matsayin tabbaci daban: pod ɗin da ke magana da backend ɗinsa wani bincike ne daban da node ɗin da ke sauke hoton.