AKS ko le fa image lati registry aladani ti o wa leyin VPN
kubelet n fa nipasẹ nẹtiwọọki node, kii ṣe nipasẹ VPN pod. Pinnu nipa awọn ipa-ọna node, DNS node, gbogbo endpoint ti fifa kan, lẹhinna TLS ati idanimọ.
Kọmputa rẹ n fa image laisi iṣoro, ṣugbọn pod duro ni ImagePullBackOff ati pe ẹnikan daba lati ṣiṣẹ VPN client ile-iṣẹ bi sidecar. Iyẹn ko ni ran lọwọ, nitori fifa naa ṣẹlẹ ṣaaju ki container rẹ to wa: kubelet beere lọwọ container runtime lori node lati mu image wa, runtime si nlo network namespace node.
Ilana awọn iṣẹ ni o pinnu ipele
Ni akọkọ ipinnu orukọ, lẹhinna asopọ, ijẹrisi, gbigba awọn ipele, ati lẹhinna container bẹrẹ. Gbogbo ohun ti pod ṣe pẹlu VPN ṣẹlẹ lẹhin ilana yẹn, nitori naa tunnel ti n ṣiṣẹ ninu cluster kii ṣe ẹri nipa fifa.
Nitori naa image ti o wa ninu cache jẹ irọ ti o ni igbẹkẹle: node ti o fa image ni ọsẹ sẹyìn n tẹsiwaju lati pese, deployment dabi ẹni ti o ni ilera, ikuna si han nikan nigbati scheduler gbe replica sori node tuntun. scale-up tabi rirọpo node jẹ okunfa, kii ṣe idi.
Awọn ẹṣẹ mẹta pinnu atunṣe
Wiwọle da lori ipa ọna, ipinnu orukọ ati akojọ endpoint. Ti subnet node ko ba le tọpa lọ si nẹtiwọọki registry, ko si credential ti yoo ran lọwọ. Ti orukọ ko ba yanju nipasẹ DNS node, asopọ ko ni bẹrẹ. Ti manifest nikan ba de ọdọ rẹ, blob kii, fifa yoo kuna ni aarin.
| Condition | Typical symptom | Where to look |
|---|---|---|
| Node subnet has no route to the registry network | Timeout, no connection | Effective routes on the node NIC, gateway transit, return path on-premises |
| Node resolver cannot see the private zone | Name resolution failure in events | VNet DNS settings and the resolver the node actually uses |
| Only the manifest endpoint is reachable | Auth succeeds, layer download fails | Every hostname the registry hands out during the pull |
| TLS or identity is wrong | Certificate error, 401 or 403 | Server certificate name and trust, scoped pull identity |
VNet peering nikan ko fun ọ ni gbogbo eto gateway transit, ati ipa ọna ẹgbẹ kan kii ṣe ipa ọna ti n ṣiṣẹ. Node nilo ọna ti o ni atilẹyin nipasẹ VPN gateway, ẹgbẹ registry si nilo ipa ọna pada si subnet node.
Ka ikuna naa ṣaaju yiyan atunṣe
Bẹrẹ pẹlu awọn iṣẹlẹ pod ati node ti o gbe kalẹ, pẹlu awọn orukọ gidi rẹ: kubectl describe pod app-example -n team-example ati kubectl get pod app-example -n team-example -o wide. Ọrọ iṣẹlẹ ya hostname ti ko yanju kuro ninu timeout, ikọsilẹ certificate kuro ninu image ti ko si, ati ikuna aṣẹ kuro ninu gbogbo wọn.
Ijẹrisi ni ohun elo ti a ṣe akiyesi ju. imagePullSecret fun runtime ni awọn credential registry; ko fi ipa ọna sori, ko yi resolver node pada, ko si jẹ ki certificate ti ko ni igbẹkẹle di ẹtọ. Ti iṣẹlẹ ba sọ pe fifa ko ni aṣẹ, wo iwọn idanimọ; ti o ba sọ pe asopọ ti pari, awọn credential ko ṣe pataki.
Iwe image Kubernetes ni orisun fun ihuwasi fifa ati awọn credential registry aladani, o si tọ lati ka lẹẹkan ṣaaju yiyan nẹtiwọọki pada, nitori o ṣalaye aala laarin ijẹrisi ati gbigbe.
Kọ ọna labẹ pod
Ṣiṣẹ ni ilana yii. Ni akọkọ tọpa nẹtiwọọki node: jẹrisi pe subnet ni ọna ti o ni atilẹyin si nẹtiwọọki registry, ṣayẹwo awọn ipa ọna ti n ṣiṣẹ lori node, awọn ofin aabo ni ẹgbẹ mejeeji ati ipa ọna pada ni ẹgbẹ registry.
Lẹhinna yanju orukọ lati ipo node. Resolver node kii ṣe eto DNS pod, ati aṣeyọri inu pod kii ṣe ẹri fun host runtime. Lo DNS aladani ti a ṣakoso dipo titẹ sii hosts ayeraye; titẹ sii naa wa titi node yoo fi rọpo, lẹhinna o parẹ ni idakẹjẹ.
Lẹhinna fi idi endpoint kọọkan mulẹ. Registry le fun olupin ni iṣẹ ijẹrisi lọtọ ati ibi ipamọ blob lọtọ. De manifest ko fi idi nkan kan mulẹ nipa awọn ipele. Nikẹhin pari TLS ati aṣẹ: certificate ti o wulo fun orukọ registry ati ti a gbẹkẹle nipasẹ eto node ti o ni atilẹyin, pẹlu idanimọ fifa ti o ni opin si kika repo yẹn.
Daju lori node ti o ko tọju pẹlu ọwọ
Idanwo ti o ṣe pataki ni fifa tuntun ati gbigba gbogbo awọn ipele ni kikun lori node ti o yẹ, dara julọ ti a ṣẹda nipasẹ scale tabi rirọpo. Eyi bo gbogbo pool ti o le gbe workload, pẹlu awọn ti o gbagbe. Atunṣe ọwọ lori node kan kii ṣe awoṣe imuṣẹ, ati iṣẹlẹ autoscale ti o tẹle yoo ri aafo naa.
Ṣiṣe cluster lẹẹkansi ni VNet miiran le yi ọna pada, ṣugbọn iyẹn ni ọna ikẹhin kii ṣe igbesẹ ayẹwo akọkọ. Fi nẹtiwọọki node ti o wa wé ọna aladani ti o nilo ati awọn iṣakoso nẹtiwọọki AKS ti o ni atilẹyin ṣaaju daba gbigbe, ki o si tọju asopọ application lẹhin ibẹrẹ gẹgẹbi ayẹwo lọtọ: pod ti n ba backend rẹ sọrọ jẹ ayẹwo miiran ju node ti n gba image.