一、问题描述
我们期望运行ingress就必须给我们的集群创建ingress controller
目前官方推荐的controller有：[目前支持和维护 aws， gce 和 nginx ingress 控制器]
https://kubernetes.io/zh/docs/concepts/services-networking/ingress-controllers/
我们使用nginx控制器，其官网给出的配置方法如下：https://kubernetes.github.io/ingress-nginx/deploy/
# 不使用helm，使用yaml kubectl apply -f https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.1.1/deploy/static/provider/cloud/deploy.yaml
注意，不同的版本适应的k8s版本不同，详细见表格：（根据你的k8s版本选择支持的版本，替换上面的v1.1.1,我的是1.23）
| ingress-nginx version | k8s supported version | alpine version | nginx version |
|---|---|---|---|
| v1.1.1 | 1.23, 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.1.0 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.5 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.4 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.3 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.2 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.1 | 1.22, 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v1.0.0 | 1.22, 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.50.0 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.3 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.2 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.1 | 1.21, 1.20, 1.19 | 3.14.2 | 1.19.9† |
| v0.49.0 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.48.1 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.47.0 | 1.21, 1.20, 1.19 | 3.13.5 | 1.20.1 |
| v0.46.0 | 1.21, 1.20, 1.19 | 3.13.2 | 1.19.6 |
但是官方给出的yaml文件中拉取的镜像不在docker hub中，在k8s.gcr.io中，所以在国内我们拉取就会报错：errimagepull
$ k describe pod/ingress-nginx-admission-create-8zv9w ... ... events: type reason age from message ---- ------ ---- ---- ------- normal scheduled 16m default-scheduler successfully assigned ingress-nginx/ingress-nginx-admissio n-create-8zv9w to node2 normal sandboxchanged 16m kubelet pod sandbox changed, it will be killed and re-created. warning failed 14m (x6 over 16m) kubelet error: imagepullbackoff normal pulling 14m (x4 over 16m) kubelet pulling image "k8s.gcr.io/ingress-nginx/kube-webhook-certg en:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660" warning failed 14m (x4 over 16m) kubelet failed to pull image "k8s.gcr.io/ingress-nginx/kube-webhoo k-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660": rpc error: code = unknown desc = error response from daemon: get "https://k8s.gcr.io/v2/": net/http: request canceled while waiting for connection (client.ti meout exceeded while awaiting headers) warning failed 14m (x4 over 16m) kubelet error: errimagepull normal backoff 77s (x58 over 16m) kubelet back-off pulling image "k8s.gcr.io/ingress-nginx/kube-webh ook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660"
相同问题的issue：https://github.com/kubernetes/ingress-nginx/issues/6335
issue中官方人员说没法上传到docker hub，可能也有自己的苦衷吧。。。
二、解决方法
解决方法很简单，用国内好心人搬运到docker hub上的仓库代替
好心人的项目地址：https://github.com/anjia0532/gcr.io_mirror，对应的docker hub地址：https://hub.docker.com/u/anjia0532
还可以手动发issue让其更新，以后gcr.io或k8s.gcr.io仓库的都可以在此更换
所以，v1.1.1版本的修改过的镜像的完整yaml文件如下：（我已经帮你找好了），如果你要使用其他版本ingress控制器，请在该docker hub上自己寻找替换，如果不是最新自己发issue拉取
apiversion: v1 kind: namespace metadata: name: ingress-nginx labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx --- # source: ingress-nginx/templates/controller-serviceaccount.yaml apiversion: v1 kind: serviceaccount metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx namespace: ingress-nginx automountserviceaccounttoken: true --- # source: ingress-nginx/templates/controller-configmap.yaml apiversion: v1 kind: configmap metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx-controller namespace: ingress-nginx data: allow-snippet-annotations: 'true' --- # source: ingress-nginx/templates/clusterrole.yaml apiversion: rbac.authorization.k8s.io/v1 kind: clusterrole metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm name: ingress-nginx rules: - apigroups: - '' resources: - configmaps - endpoints - nodes - pods - secrets - namespaces verbs: - list - watch - apigroups: - '' resources: - nodes verbs: - get - apigroups: - '' resources: - services verbs: - get - list - watch - apigroups: - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apigroups: - '' resources: - events verbs: - create - patch - apigroups: - networking.k8s.io resources: - ingresses/status verbs: - update - apigroups: - networking.k8s.io resources: - ingressclasses verbs: - get - list - watch --- # source: ingress-nginx/templates/clusterrolebinding.yaml apiversion: rbac.authorization.k8s.io/v1 kind: clusterrolebinding metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm name: ingress-nginx roleref: apigroup: rbac.authorization.k8s.io kind: clusterrole name: ingress-nginx subjects: - kind: serviceaccount name: ingress-nginx namespace: ingress-nginx --- # source: ingress-nginx/templates/controller-role.yaml apiversion: rbac.authorization.k8s.io/v1 kind: role metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx namespace: ingress-nginx rules: - apigroups: - '' resources: - namespaces verbs: - get - apigroups: - '' resources: - configmaps - pods - secrets - endpoints verbs: - get - list - watch - apigroups: - '' resources: - services verbs: - get - list - watch - apigroups: - networking.k8s.io resources: - ingresses verbs: - get - list - watch - apigroups: - networking.k8s.io resources: - ingresses/status verbs: - update - apigroups: - networking.k8s.io resources: - ingressclasses verbs: - get - list - watch - apigroups: - '' resources: - configmaps resourcenames: - ingress-controller-leader verbs: - get - update - apigroups: - '' resources: - configmaps verbs: - create - apigroups: - '' resources: - events verbs: - create - patch --- # source: ingress-nginx/templates/controller-rolebinding.yaml apiversion: rbac.authorization.k8s.io/v1 kind: rolebinding metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx namespace: ingress-nginx roleref: apigroup: rbac.authorization.k8s.io kind: role name: ingress-nginx subjects: - kind: serviceaccount name: ingress-nginx namespace: ingress-nginx --- # source: ingress-nginx/templates/controller-service-webhook.yaml apiversion: v1 kind: service metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx-controller-admission namespace: ingress-nginx spec: type: clusterip ports: - name: https-webhook port: 443 targetport: webhook appprotocol: https selector: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/component: controller --- # source: ingress-nginx/templates/controller-service.yaml apiversion: v1 kind: service metadata: annotations: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx-controller namespace: ingress-nginx spec: type: loadbalancer externaltrafficpolicy: local ipfamilypolicy: singlestack ipfamilies: - ipv4 ports: - name: http port: 80 protocol: tcp targetport: http appprotocol: http - name: https port: 443 protocol: tcp targetport: https appprotocol: https selector: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/component: controller --- # source: ingress-nginx/templates/controller-deployment.yaml apiversion: apps/v1 kind: deployment metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: ingress-nginx-controller namespace: ingress-nginx spec: selector: matchlabels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/component: controller revisionhistorylimit: 10 minreadyseconds: 0 template: metadata: labels: app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/component: controller spec: dnspolicy: clusterfirst containers: - name: controller image: anjia0532/google-containers.ingress-nginx.controller:v1.1.1 imagepullpolicy: ifnotpresent lifecycle: prestop: exec: command: - /wait-shutdown args: - /nginx-ingress-controller - --publish-service=$(pod_namespace)/ingress-nginx-controller - --election-id=ingress-controller-leader - --controller-class=k8s.io/ingress-nginx - --configmap=$(pod_namespace)/ingress-nginx-controller - --validating-webhook=:8443 - --validating-webhook-certificate=/usr/local/certificates/cert - --validating-webhook-key=/usr/local/certificates/key securitycontext: capabilities: drop: - all add: - net_bind_service runasuser: 101 allowprivilegeescalation: true env: - name: pod_name valuefrom: fieldref: fieldpath: metadata.name - name: pod_namespace valuefrom: fieldref: fieldpath: metadata.namespace - name: ld_preload value: /usr/local/lib/libmimalloc.so livenessprobe: failurethreshold: 5 httpget: path: /healthz port: 10254 scheme: http initialdelayseconds: 10 periodseconds: 10 successthreshold: 1 timeoutseconds: 1 readinessprobe: failurethreshold: 3 httpget: path: /healthz port: 10254 scheme: http initialdelayseconds: 10 periodseconds: 10 successthreshold: 1 timeoutseconds: 1 ports: - name: http containerport: 80 protocol: tcp - name: https containerport: 443 protocol: tcp - name: webhook containerport: 8443 protocol: tcp volumemounts: - name: webhook-cert mountpath: /usr/local/certificates/ readonly: true resources: requests: cpu: 100m memory: 90mi nodeselector: kubernetes.io/os: linux serviceaccountname: ingress-nginx terminationgraceperiodseconds: 300 volumes: - name: webhook-cert secret: secretname: ingress-nginx-admission --- # source: ingress-nginx/templates/controller-ingressclass.yaml # we don't support namespaced ingressclass yet # so a clusterrole and a clusterrolebinding is required apiversion: networking.k8s.io/v1 kind: ingressclass metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: controller name: nginx namespace: ingress-nginx spec: controller: k8s.io/ingress-nginx --- # source: ingress-nginx/templates/admission-webhooks/validating-webhook.yaml # before changing this value, check the required kubernetes version # https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#prerequisites apiversion: admissionregistration.k8s.io/v1 kind: validatingwebhookconfiguration metadata: labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook name: ingress-nginx-admission webhooks: - name: validate.nginx.ingress.kubernetes.io matchpolicy: equivalent rules: - apigroups: - networking.k8s.io apiversions: - v1 operations: - create - update resources: - ingresses failurepolicy: fail sideeffects: none admissionreviewversions: - v1 clientconfig: service: namespace: ingress-nginx name: ingress-nginx-controller-admission path: /networking/v1/ingresses --- # source: ingress-nginx/templates/admission-webhooks/job-patch/serviceaccount.yaml apiversion: v1 kind: serviceaccount metadata: name: ingress-nginx-admission namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook --- # source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrole.yaml apiversion: rbac.authorization.k8s.io/v1 kind: clusterrole metadata: name: ingress-nginx-admission annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook rules: - apigroups: - admissionregistration.k8s.io resources: - validatingwebhookconfigurations verbs: - get - update --- # source: ingress-nginx/templates/admission-webhooks/job-patch/clusterrolebinding.yaml apiversion: rbac.authorization.k8s.io/v1 kind: clusterrolebinding metadata: name: ingress-nginx-admission annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook roleref: apigroup: rbac.authorization.k8s.io kind: clusterrole name: ingress-nginx-admission subjects: - kind: serviceaccount name: ingress-nginx-admission namespace: ingress-nginx --- # source: ingress-nginx/templates/admission-webhooks/job-patch/role.yaml apiversion: rbac.authorization.k8s.io/v1 kind: role metadata: name: ingress-nginx-admission namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook rules: - apigroups: - '' resources: - secrets verbs: - get - create --- # source: ingress-nginx/templates/admission-webhooks/job-patch/rolebinding.yaml apiversion: rbac.authorization.k8s.io/v1 kind: rolebinding metadata: name: ingress-nginx-admission namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade,post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook roleref: apigroup: rbac.authorization.k8s.io kind: role name: ingress-nginx-admission subjects: - kind: serviceaccount name: ingress-nginx-admission namespace: ingress-nginx --- # source: ingress-nginx/templates/admission-webhooks/job-patch/job-createsecret.yaml apiversion: batch/v1 kind: job metadata: name: ingress-nginx-admission-create namespace: ingress-nginx annotations: helm.sh/hook: pre-install,pre-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook spec: template: metadata: name: ingress-nginx-admission-create labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook spec: containers: - name: create image: anjia0532/google-containers.ingress-nginx.kube-webhook-certgen:v1.1.1 imagepullpolicy: ifnotpresent args: - create - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(pod_namespace).svc - --namespace=$(pod_namespace) - --secret-name=ingress-nginx-admission env: - name: pod_namespace valuefrom: fieldref: fieldpath: metadata.namespace securitycontext: allowprivilegeescalation: false restartpolicy: onfailure serviceaccountname: ingress-nginx-admission nodeselector: kubernetes.io/os: linux securitycontext: runasnonroot: true runasuser: 2000 --- # source: ingress-nginx/templates/admission-webhooks/job-patch/job-patchwebhook.yaml apiversion: batch/v1 kind: job metadata: name: ingress-nginx-admission-patch namespace: ingress-nginx annotations: helm.sh/hook: post-install,post-upgrade helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook spec: template: metadata: name: ingress-nginx-admission-patch labels: helm.sh/chart: ingress-nginx-4.0.15 app.kubernetes.io/name: ingress-nginx app.kubernetes.io/instance: ingress-nginx app.kubernetes.io/version: 1.1.1 app.kubernetes.io/managed-by: helm app.kubernetes.io/component: admission-webhook spec: containers: - name: patch image: anjia0532/google-containers.ingress-nginx.kube-webhook-certgen:v1.1.1 imagepullpolicy: ifnotpresent args: - patch - --webhook-name=ingress-nginx-admission - --namespace=$(pod_namespace) - --patch-mutating=false - --secret-name=ingress-nginx-admission - --patch-failure-policy=fail env: - name: pod_namespace valuefrom: fieldref: fieldpath: metadata.namespace securitycontext: allowprivilegeescalation: false restartpolicy: onfailure serviceaccountname: ingress-nginx-admission nodeselector: kubernetes.io/os: linux securitycontext: runasnonroot: true runasuser: 2000
到此这篇关于解决国内k8s的ingress-nginx镜像无法正常pull拉取问题的文章就介绍到这了,更多相关k8s的ingress-nginx镜像无法pull拉取内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持！
声明：如若本站内容侵犯了原著者的合法权益，可联系我们进行处理。
