I-AKS ayikwazi ukudonsa image kusuka ku-registry eyimfihlo ngemuva kwe-VPN
I-kubelet idonsa ngobuxhakaxhaka be-node, hhayi nge-VPN ye-pod. Nquma ngezindlela ze-node, i-DNS ye-node, yonke i-endpoint edonswa iyithinta, bese kuba i-TLS nobunikazi.
I-laptop yakho idonsa i-image ngaphandle kwenkinga, kodwa i-pod ihlala ku-ImagePullBackOff futhi othile uphakamisa ukusebenzisa i-VPN client yenkampani njenge-sidecar. Lokho ngeke kusize, ngoba ukudonsa kwenzeka ngaphambi kokuba i-container yakho ibekhona: i-kubelet icela i-container runtime kwi-node ukuthi ilethe i-image, futhi i-runtime isebenzisa i-network namespace ye-node.
Ukulandelana kwemisebenzi kunquma isendlalelo
Kuqala ukuxazululwa kwegama, bese ukuxhumana, ukuqinisekisa, ukulanda izingqimba, bese i-container iqala. Konke i-pod ekwenzayo nge-VPN kwenzeka ngemuva kwalokho, ngakho i-tunnel esebenza ku-cluster akubona ubufakazi ngokudonsa.
Yingakho i-image eseku-cache ingamanga akholakalayo: i-node eyadonsa i-image emasontweni adlule iyaqhubeka nokuyinikeza, i-deployment ibukeka iphilile, futhi iphutha livela kuphela lapho i-scheduler ibeka i-replica ku-node entsha. I-scale-up noma ukushintshwa kwe-node kuyimbangela, hhayi isizathu.
Imibandela emithathu inquma ukulungiswa
Ukufinyeleleka kuncike ekuhambiseni, ekuxazululeni amagama kanye nesethi ye-endpoint. Uma i-subnet ye-node ingakwazi ukuhambisa ku-network ye-registry, akukho credential ezosiza. Uma igama lingaxazululeki nge-DNS ye-node, ukuxhumana akukaqali. Uma i-manifest kuphela efinyelelekayo kodwa i-blob ingeyona, ukudonsa kuzohluleka phakathi.
| Condition | Typical symptom | Where to look |
|---|---|---|
| Node subnet has no route to the registry network | Timeout, no connection | Effective routes on the node NIC, gateway transit, return path on-premises |
| Node resolver cannot see the private zone | Name resolution failure in events | VNet DNS settings and the resolver the node actually uses |
| Only the manifest endpoint is reachable | Auth succeeds, layer download fails | Every hostname the registry hands out during the pull |
| TLS or identity is wrong | Certificate error, 401 or 403 | Server certificate name and trust, scoped pull identity |
I-VNet peering yodwa ayiniki zonke izilungiselelo ze-gateway transit, futhi indlela yohlangothi olulodwa ayiyona indlela esebenzayo. I-node idinga indlela esekelwe nge-VPN gateway, futhi uhlangothi lwe-registry ludinga indlela yokubuyela ku-subnet ye-node.
Funda iphutha ngaphambi kokukhetha ukulungisa
Qala ngezehlakalo ze-pod kanye ne-node ehlale kuyo, ngamagama akho wangempela: kubectl describe pod app-example -n team-example kanye no-kubectl get pod app-example -n team-example -o wide. Umbhalo wesenzakalo uhlukanisa i-hostname engaxazululekile ne-timeout, ukwenqatshwa kwe-certificate ne-image engekho, nokuhluleka kwegunya nakho konke lokho.
Ukuqinisekisa iyona ndlela edlulelwe ngokweqile. I-imagePullSecret inika i-runtime imininingwane ye-registry; ayifaki indlela, ayishintshi i-resolver ye-node futhi ayenzi i-certificate engathenjwa ibe semthethweni. Uma isenzakalo sithi ukudonsa akuzange kugunyazwe, bheka ububanzi bobunikazi; uma sithi ukuxhumana kuphelelwe isikhathi, imininingwane ayibalulekile.
Imibhalo ye-image ye-Kubernetes ingumthombo wokuziphatha kokudonsa nokukhonjiswa kwe-registry eyimfihlo, futhi kufanele ifundwe kanye ngaphambi kokushintsha uxhakaxhaka, ngoba icacisa umngcele phakathi kokuqinisekisa nokuthutha.
Yakha indlela ngaphansi kwe-pod
Sebenza ngalolu hlelo. Qala ngokuhambisa uxhakaxhaka lwe-node: qinisekisa ukuthi i-subnet inendlela esekelwe eya ku-network ye-registry, hlola izindlela ezisebenzayo ku-node, imithetho yezokuphepha ezinhlangothini zombili kanye nendlela yokubuyela ohlangothini lwe-registry.
Bese uxazulula igama kusuka kumongo we-node. I-resolver ye-node akuyona ilungiselelo le-DNS le-pod, futhi impumelelo ngaphakathi kwe-pod akubona ubufakazi be-host runtime. Sebenzisa i-DNS eyimfihlo elawulwayo esikhundleni sokufakwa kwe-hosts okuhlala njalo; ukufakwa kuhlala kuze kushintshwe i-node bese kunyamalala buthule.
Bese ufakazela yonke i-endpoint. I-registry inganika iklayenti isevisi yokuqinisekisa ehlukile nendawo yokugcina i-blob ehlukile. Ukufinyelela ku-manifest akufakazeli cishe lutho ngezingqimba. Ekugcineni qedela i-TLS negunya: i-certificate evumelekile egameni le-registry futhi ethenjwayo ngokulungiselelwa kwe-node okusekelwe, kanye nobunikazi bokudonsa obulinganiselwe ekufundeni leyo repository.
Qinisekisa ku-node ongayilungisanga ngesandla
Isivivinyo esibalulekile ukudonsa okusha nokulanda okugcwele kwazo zonke izingqimba ku-node efanele, ikakhulukazi eyakhiwe nge-scale noma ngokushintsha. Lokhu kuhlanganisa wonke ama-pool angabeka i-workload, kuhlanganise lawa okuwukhohliwe. Ukulungiswa ngesandla ku-node eyodwa akusona isibonelo sokuthunyelwa, futhi umcimbi olandelayo we-autoscale uzothola igebe.
Ukwakha kabusha i-cluster kwenye i-VNet kungashintsha indlela, kodwa lokho kuyindlela yokugcina hhayi isinyathelo sokuqala sokuxilonga. Qhathanisa uxhakaxhaka lwe-node olukhona nendlela eyimfihlo edingekayo kanye nezilawuli zoxhakaxhaka ze-AKS ezisekelwe ngaphambi kokuphakamisa ukufuduka, futhi gcina ukuxhumana kwe-application ngemuva kokuqala njengokuhlola okuhlukile: i-pod ekhuluma ne-backend yayo ukuhlola okuhlukile kunokulanda i-image kwe-node.