AKS ma heli karo image-ka registry gaar ah oo ka dambeeya VPN-kaaga
kubelet waxay ku soo jiidataa shabakada node-ka, ma aha VPN-ka pod-ka. Go@APOS@aami doonka node-ka, DNS-ka node-ka, endpoint kasta oo soo jiidashadu taabato, ka dibna TLS iyo aqoonsiga.
Laptop-kaagu si fudud ayuu u soo jiitaa image-ka, laakiin pod-ku wuxuu ku hadhaa ImagePullBackOff. Soo jeedinta ah in VPN client-ka shirkadda loo shaqeeyo sidecar ma caawinayso, sababtoo ah soo jiidashadu waxay dhacdaa ka hor inta container-kaagu uusan jirin: kubelet waxay ka codsataa container runtime-ka node-ka inuu image-ka keeno, runtime-na wuxuu isticmaalaa network namespace-ka node-ka.
Nidaamka hawlahu waa kan go’aamiya lakabka
Marka hore xallinta magaca, ka dib isku xirka, xaqiijinta, soo dejinta lakabyada, ka dibna container-ku wuu bilaabmaa. Wax kasta oo pod-ku VPN ku sameeyo waxay dhacaan ka dib nidaamkaas, sidaas darteed tunnel-ka ka shaqeeya cluster-ka ma aha caddayn ku saabsan soo jiidashada.
Taasi waa sababta image-ka cache-ka uu yahay been qancin leh: node soo jiitay image-ka toddobaadyo ka hor ayaa weli bixiya, deployment-ku wuxuu u muuqdaa caafimaad qab, oo guuldarradu waxay soo baxdaa kaliya marka scheduler-ku replica dhigto node cusub. scale-up ama beddelka node-ka waa kicinta, ma aha sababta.
Saddex shuruudood ayaa go’aamiya hagaajinta
Helitaanku wuxuu ku saleysan yahay marin-u-jiid, xallinta magacyada iyo set-ka endpoint. Haddii subnet-ka node-ka uusan marin karin shabakada registry, ma jiro credential caawinaya. Haddii magaca aan lagu xallin DNS-ka node-ka, isku xirku ma bilaabmo. Haddii kaliya manifest la helo blob-na aan la helin, soo jiidashadu waxay ku guuldareysataa badhtamaha.
| Condition | Typical symptom | Where to look |
|---|---|---|
| Node subnet has no route to the registry network | Timeout, no connection | Effective routes on the node NIC, gateway transit, return path on-premises |
| Node resolver cannot see the private zone | Name resolution failure in events | VNet DNS settings and the resolver the node actually uses |
| Only the manifest endpoint is reachable | Auth succeeds, layer download fails | Every hostname the registry hands out during the pull |
| TLS or identity is wrong | Certificate error, 401 or 403 | Server certificate name and trust, scoped pull identity |
Kaliya VNet peering ma bixiso dhammaan qaababka gateway transit, oo waddo hal jiho ah ma aha waddo shaqeysa. Node-ku wuxuu u baahan yahay waddo la taageeray oo mara VPN gateway-ka, dhinaca registry-na wuxuu u baahan yahay waddo ku noqota subnet-ka node-ka.
Akhri guuldarrada ka hor intaadan dooran hagaajinta
Ka bilow dhacdooyinka pod-ka iyo node-ka uu ku dhacay, magacyadaada dhabta ah: kubectl describe pod app-example -n team-example iyo kubectl get pod app-example -n team-example -o wide. Qoraalka dhacdadu wuxuu kala soocaa hostname aan la xallin iyo timeout, diidmada certificate iyo image maqan, iyo guuldarrada oggolaanshaha iyo dhammaantood.
Xaqiijintu waa qalabka ugu badan ee la qiyaaso. imagePullSecret waxay runtime-ka siisaa credential-ka registry; ma dhigto waddo, ma beddelo resolver-ka node-ka oo ma dhigo certificate aan la aamini karin mid ansax ah. Haddii dhacdadu sheegto in soo jiidashada aan la ogolaan, eeg baaxadda aqoonsiga; haddii ay sheegto in isku xirku waqtigiisu dhammaaday, credential-yadu waxba ma tarayaan.
Dukumentiga image-ka Kubernetes waa tixraaca hab-dhaqanka soo jiidashada iyo credential-ka registry gaar ah, oo mudan in hal mar la akhriyo ka hor intaadan beddelin shabakadda, sababtoo ah waxay caddeynaysaa xadka u dhexeeya xaqiijinta iyo gudbinta.
Dhismo waddada pod-ka hoostiisa
U shaqee nidaamkan. Marka hore marin shabakadda node-ka: xaqiiji in subnet-ku leeyahay waddo la taageeray oo tagta shabakadda registry, hubi waddooyinka wax-ku-oolka ah ee node-ka, xeerarka amniga labada dhinac iyo waddada ku noqota dhinaca registry.
Ka dib xalli magaca laga bilaabo macnaha node-ka. Resolver-ka node-ka ma aha dejinta DNS-ka pod-ka, oo guusha gudaha pod-ka ma aha caddayn ku saabsan host runtime. Isticmaal DNS gaar ah oo la maamulo halkii aad ka isticmaali lahayd gelinta hosts ee joogtada ah; gelintu waxay noolaataa ilaa node-ka la beddelo ka dibna si aamusan ayay u baaba’daa.
Ka dib caddee endpoint kasta. Registry waxay macmiilka siin kartaa adeeg xaqiijin gooni ah iyo kayd blob gooni ah. Gaaritaanka manifest waxba kama caddeyso lakabyada. Ugu dambeyn dhammee TLS iyo oggolaanshaha: certificate ansax u ah magaca registry oo lagu kalsoonaan karo iyada oo loo marayo habeynta node la taageeray, iyo aqoonsi soo jiidasho oo ku xaddidan akhrinta repository-gaas.
Xaqiiji node aadan gacan ku hagaajin
Imtixaanka muhiimka ah waa soo jiidasho cusub iyo soo dejinta buuxda ee dhammaan lakabyada node ku habboon, sida ugu wanaagsan mid lagu abuuray scale ama beddel. Taasi waxay daboolaysaa dhammaan pool-yada laga yaabo inay dhigaan workload-ka, oo ay ku jiraan kuwa la illoobay. Hagaajinta gacanta ee node keliya ma aha qaabka deployment-ka, oo dhacdada autoscale ee xigta waxay heli doontaa meesha bannaan.
Dib u abuurista cluster-ka VNet kale waxay beddeli kartaa waddada, laakiin taasi waa tallaabada ugu dambaysa ee ma aha tallaabada koowaad ee baaritaanka. Isbarbardhig shabakadda node-ka ee jirta iyo waddada gaarka ah ee loo baahan yahay iyo kontaroolada shabakadda AKS ee la taageeray ka hor intaadan soo jeedin guuritaan, oo hay isku xirka application-ka kadib bilowga oo ah xaqiijin gooni ah: pod-ka oo la hadlaya backend-kiisa waa baaritaan ka duwan kan node-ka soo dejinaya image-ka.