Skip to content

Commit 9af9784

Browse files
windsonseawindsonsea
committed
[zh] sync pull-image-private-registry.md
1 parent 5da7cb5 commit 9af9784

File tree

2 files changed

+81
-40
lines changed

2 files changed

+81
-40
lines changed

‎content/zh-cn/docs/setup/production-environment/tools/kops.md

Lines changed: 25 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ title: 使用 kOps 安装 Kubernetes
33
content_type: task
44
weight: 20
55
---
6-
76
<!--
87
title: Installing Kubernetes with kOps
98
content_type: task
@@ -28,17 +27,22 @@ It uses a tool called [`kOps`](https://github.com/kubernetes/kops).
2827
* Fully automated installation
2928
* Uses DNS to identify clusters
3029
* Self-healing: everything runs in Auto-Scaling Groups
31-
* Multiple OS support (Amazon Linux, Debian, Flatcar, RHEL, Rocky and Ubuntu) - see the [images.md](https://github.com/kubernetes/kops/blob/master/docs/operations/images.md)
32-
* High-Availability support - see the [high_availability.md](https://github.com/kubernetes/kops/blob/master/docs/operations/high_availability.md)
33-
* Can directly provision, or generate terraform manifests - see the [terraform.md](https://github.com/kubernetes/kops/blob/master/docs/terraform.md)
30+
* Multiple OS support (Amazon Linux, Debian, Flatcar, RHEL, Rocky and Ubuntu) - see the
31+
[images.md](https://github.com/kubernetes/kops/blob/master/docs/operations/images.md)
32+
* High-Availability support - see the
33+
[high_availability.md](https://github.com/kubernetes/kops/blob/master/docs/operations/high_availability.md)
34+
* Can directly provision, or generate terraform manifests - see the
35+
[terraform.md](https://github.com/kubernetes/kops/blob/master/docs/terraform.md)
3436
-->
3537
* 全自动安装流程
3638
* 使用 DNS 识别集群
3739
* 自我修复：一切都在自动扩缩组中运行
3840
* 支持多种操作系统（Amazon Linux、Debian、Flatcar、RHEL、Rocky 和 Ubuntu），
3941
参考 [images.md](https://github.com/kubernetes/kops/blob/master/docs/operations/images.md)。
40-
* 支持高可用，参考 [high_availability.md](https://github.com/kubernetes/kops/blob/master/docs/operations/high_availability.md)。
41-
* 可以直接提供或者生成 terraform 清单，参考 [terraform.md](https://github.com/kubernetes/kops/blob/master/docs/terraform.md)。
42+
* 支持高可用，参考
43+
[high_availability.md](https://github.com/kubernetes/kops/blob/master/docs/operations/high_availability.md)。
44+
* 可以直接提供或者生成 terraform 清单，参考
45+
[terraform.md](https://github.com/kubernetes/kops/blob/master/docs/terraform.md)。
4246

4347
## {{% heading "prerequisites" %}}
4448

@@ -47,7 +51,10 @@ It uses a tool called [`kOps`](https://github.com/kubernetes/kops).
4751
4852
* You must [install](https://github.com/kubernetes/kops#installing) `kops` on a 64-bit (AMD64 and Intel 64) device architecture.
4953
50-
* You must have an [AWS account](https://docs.aws.amazon.com/polly/latest/dg/setting-up.html), generate [IAM keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) and [configure](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration) them. The IAM user will need [adequate permissions](https://github.com/kubernetes/kops/blob/master/docs/getting_started/aws.md#setup-iam-user).
54+
* You must have an [AWS account](https://docs.aws.amazon.com/polly/latest/dg/setting-up.html),
55+
generate [IAM keys](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys)
56+
and [configure](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html#cli-quick-configuration) them.
57+
The IAM user will need [adequate permissions](https://github.com/kubernetes/kops/blob/master/docs/getting_started/aws.md#setup-iam-user).
5158
-->
5259
* 你必须安装 [kubectl](/zh-cn/docs/tasks/tools/)。
5360
* 你必须安装[安装](https://github.com/kubernetes/kops#installing) `kops`
@@ -66,7 +73,8 @@ It uses a tool called [`kOps`](https://github.com/kubernetes/kops).
6673
6774
#### Installation
6875
69-
Download kops from the [releases page](https://github.com/kubernetes/kops/releases) (it is also convenient to build from source):
76+
Download kops from the [releases page](https://github.com/kubernetes/kops/releases)
77+
(it is also convenient to build from source):
7078
-->
7179
## 创建集群 {#creating-a-cluster}
7280

@@ -202,7 +210,7 @@ from clients.
202210
### (2/5) 为你的集群创建一个 route53 域名
203211

204212
kops 在集群内部和外部都使用 DNS 进行发现操作，这样你可以从客户端访问
205-
kubernetes API 服务器。
213+
Kubernetes API 服务器。
206214

207215
<!--
208216
kops has a strong opinion on the cluster name: it should be a valid DNS name. By doing so you will
@@ -225,7 +233,8 @@ but also `dev.example.com` or even `example.com`. kops works with any of these,
225233
you choose for organization reasons (e.g. you are allowed to create records under `dev.example.com`,
226234
but not under `example.com`).
227235
-->
228-
Route53 托管区域可以服务子域名。你的托管区域可能是 `useast1.dev.example.com`，还有 `dev.example.com` 甚至 `example.com`。
236+
Route53 托管区域可以服务子域名。你的托管区域可能是 `useast1.dev.example.com`，
237+
还有 `dev.example.com` 甚至 `example.com`。
229238
kops 可以与以上任何一种配合使用，因此通常你出于组织原因选择不同的托管区域。
230239
例如，允许你在 `dev.example.com` 下创建记录，但不能在 `example.com` 下创建记录。
231240

@@ -393,7 +402,8 @@ for production clusters!
393402
<!--
394403
### Explore other add-ons
395404
396-
See the [list of add-ons](/docs/concepts/cluster-administration/addons/) to explore other add-ons, including tools for logging, monitoring, network policy, visualization, and control of your Kubernetes cluster.
405+
See the [list of add-ons](/docs/concepts/cluster-administration/addons/) to explore other add-ons,
406+
including tools for logging, monitoring, network policy, visualization, and control of your Kubernetes cluster.
397407
-->
398408
### 探索其他附加组件
399409

@@ -413,8 +423,10 @@ See the [list of add-ons](/docs/concepts/cluster-administration/addons/) to expl
413423

414424
<!--
415425
* Learn more about Kubernetes [concepts](/docs/concepts/) and [`kubectl`](/docs/reference/kubectl/).
416-
* Learn more about `kOps` [advanced usage](https://kops.sigs.k8s.io/) for tutorials, best practices and advanced configuration options.
417-
* Follow `kOps` community discussions on Slack: [community discussions](https://github.com/kubernetes/kops#other-ways-to-communicate-with-the-contributors).
426+
* Learn more about `kOps` [advanced usage](https://kops.sigs.k8s.io/) for tutorials,
427+
best practices and advanced configuration options.
428+
* Follow `kOps` community discussions on Slack:
429+
[community discussions](https://github.com/kubernetes/kops#other-ways-to-communicate-with-the-contributors).
418430
* Contribute to `kOps` by addressing or raising an issue [GitHub Issues](https://github.com/kubernetes/kops/issues).
419431
-->
420432
* 了解有关 Kubernetes 的[概念](/zh-cn/docs/concepts/)和

‎content/zh-cn/docs/tasks/configure-pod-container/pull-image-private-registry.md

Lines changed: 56 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ title: 从私有仓库拉取镜像
33
content_type: task
44
weight: 130
55
---
6-
76
<!--
87
title: Pull an Image from a Private Registry
98
content_type: task
@@ -19,7 +18,7 @@ from a private container image registry or repository. There are many private
1918
registries in use. This task uses [Docker Hub](https://www.docker.com/products/docker-hub)
2019
as an example registry.
2120
-->
22-
本文介绍如何使用 {{< glossary_tooltip text="Secret" term_id="secret" >}}
21+
本文介绍如何使用 {{< glossary_tooltip text="Secret" term_id="secret" >}}
2322
从私有的镜像仓库或代码仓库拉取镜像来创建 Pod。
2423
有很多私有镜像仓库正在使用中。这个任务使用的镜像仓库是
2524
[Docker Hub](https://www.docker.com/products/docker-hub)。
@@ -36,9 +35,8 @@ as an example registry.
3635
* If you are using a different private container registry, you need the command
3736
line tool for that registry and any login information for the registry.
3837
-->
39-
40-
* 要进行此练习，你需要 `docker` 命令行工具和一个知道密码的
41-
[Docker ID](https://docs.docker.com/docker-id/)。
38+
* 要进行此练习，你需要 `docker` 命令行工具和一个知道密码的
39+
[Docker ID](https://docs.docker.com/docker-id/)。
4240
* 如果你要使用不同的私有的镜像仓库，你需要有对应镜像仓库的命令行工具和登录信息。
4341

4442
<!-- steps -->
@@ -72,11 +70,10 @@ The login process creates or updates a `config.json` file that holds an authoriz
7270
7371
View the `config.json` file:
7472
-->
75-
当出现提示时，输入你的 Docker ID 和登录凭证（访问令牌、
76-
或 Docker ID 的密码）。
73+
当出现提示时，输入你的 Docker ID 和登录凭据（访问令牌或 Docker ID 的密码）。
7774

7875
登录过程会创建或更新保存有授权令牌的 `config.json` 文件。
79-
查看 [Kubernetes 中如何解析这个文件](/zh-cn/docs/concepts/containers/images#config-json)。
76+
查看 [Kubernetes 如何解析这个文件](/zh-cn/docs/concepts/containers/images#config-json)。
8077

8178
查看 `config.json` 文件：
8279

@@ -104,8 +101,9 @@ The output contains a section similar to this:
104101
If you use a Docker credentials store, you won't see that `auth` entry but a `credsStore` entry with the name of the store as value.
105102
In that case, you can create a secret directly. See [Create a Secret by providing credentials on the command line](#create-a-secret-by-providing-credentials-on-the-command-line).
106103
-->
107-
如果使用 Docker 凭证仓库，则不会看到 `auth` 条目，看到的将是以仓库名称作为值的 `credsStore` 条目。
108-
在这种情况下，你可以直接创建一个 Secret。请参阅[在命令行上提供凭证来创建 Secret](#create-a-secret-by-providing-credentials-on-the-command-line)。
104+
如果使用 Docker 凭据仓库，则不会看到 `auth` 条目，看到的将是以仓库名称作为值的 `credsStore` 条目。
105+
在这种情况下，你可以直接创建一个 Secret。
106+
请参阅[在命令行上提供凭据来创建 Secret](#create-a-secret-by-providing-credentials-on-the-command-line)。
109107
{{< /note >}}
110108

111109
<!--
@@ -117,12 +115,12 @@ a container registry to pull a private image.
117115
If you already ran `docker login`, you can copy
118116
that credential into Kubernetes:
119117
-->
120-
## 创建一个基于现有凭证的 Secret {#registry-secret-existing-credentials}
118+
## 创建一个基于现有凭据的 Secret {#registry-secret-existing-credentials}
121119

122120
Kubernetes 集群使用 `kubernetes.io/dockerconfigjson` 类型的
123121
Secret 来通过镜像仓库的身份验证，进而提取私有镜像。
124122

125-
如果你已经运行了 `docker login` 命令，你可以复制该镜像仓库的凭证到 Kubernetes:
123+
如果你已经运行了 `docker login` 命令，你可以复制该镜像仓库的凭据到 Kubernetes:
126124

127125
```shell
128126
kubectl create secret generic regcred \
@@ -180,7 +178,7 @@ the base64 encoded string in the data was successfully decoded, but could not be
180178

181179
Create this Secret, naming it `regcred`:
182180
-->
183-
## 在命令行上提供凭证来创建 Secret {#create-a-secret-by-providing-credentials-on-the-command-line}
181+
## 在命令行上提供凭据来创建 Secret {#create-a-secret-by-providing-credentials-on-the-command-line}
184182

185183
创建 Secret，命名为 `regcred`：
186184

@@ -214,15 +212,15 @@ You have successfully set your Docker credentials in the cluster as a Secret cal
214212
* `<your-pword>` 是你的 Docker 密码。
215213
* `<your-email>` 是你的 Docker 邮箱。
216214

217-
这样你就成功地将集群中的 Docker 凭证设置为名为 `regcred` 的 Secret。
215+
这样你就成功地将集群中的 Docker 凭据设置为名为 `regcred` 的 Secret。
218216

217+
{{< note >}}
219218
<!--
220219
Typing secrets on the command line may store them in your shell history unprotected, and
221220
those secrets might also be visible to other users on your PC during the time that
222221
`kubectl` is running.
223222
-->
224-
{{< note >}}
225-
在命令行上键入 Secret 可能会将它们存储在你的 shell 历史记录中而不受保护，
223+
在命令行上键入 Secret 可能会将它们存储在你的 Shell 历史记录中而不受保护，
226224
并且这些 Secret 信息也可能在 `kubectl` 运行期间对你 PC 上的其他用户可见。
227225
{{< /note >}}
228226

@@ -246,8 +244,6 @@ The output is similar to this:
246244

247245
```yaml
248246
apiVersion: v1
249-
data:
250-
.dockerconfigjson: eyJodHRwczovL2luZGV4L ... J0QUl6RTIifX0=
251247
kind: Secret
252248
metadata:
253249
...
@@ -264,7 +260,7 @@ The value of the `.dockerconfigjson` field is a base64 representation of your Do
264260
To understand what is in the `.dockerconfigjson` field, convert the secret data to a
265261
readable format:
266262
-->
267-
`.dockerconfigjson` 字段的值是 Docker 凭证的 base64 表示。
263+
`.dockerconfigjson` 字段的值是 Docker 凭据的 base64 表示。
268264

269265
要了解 `dockerconfigjson` 字段中的内容，请将 Secret 数据转换为可读格式：
270266

@@ -306,7 +302,7 @@ You have successfully set your Docker credentials as a Secret called `regcred` i
306302
-->
307303
注意，Secret 数据包含与本地 `~/.docker/config.json` 文件类似的授权令牌。
308304

309-
这样你就已经成功地将 Docker 凭证设置为集群中的名为 `regcred` 的 Secret。
305+
这样你就已经成功地将 Docker 凭据设置为集群中的名为 `regcred` 的 Secret。
310306

311307
<!--
312308
## Create a Pod that uses your Secret
@@ -315,7 +311,7 @@ Here is a manifest for an example Pod that needs access to your Docker credentia
315311
-->
316312
## 创建一个使用你的 Secret 的 Pod {#create-a-pod-that-uses-your-secret}
317313

318-
下面是一个 Pod 配置清单示例，该示例中 Pod 需要访问你的 Docker 凭证 `regcred`：
314+
下面是一个 Pod 配置清单示例，该示例中 Pod 需要访问你的 Docker 凭据 `regcred`：
319315

320316
{{< codenew file="pods/private-reg-pod.yaml" >}}
321317

@@ -345,8 +341,8 @@ Kubernetes should get the credentials from a Secret named `regcred`.
345341

346342
Create a Pod that uses your Secret, and verify that the Pod is running:
347343
-->
348-
要从私有仓库拉取镜像，Kubernetes 需要凭证。
349-
配置文件中的 `imagePullSecrets` 字段表明 Kubernetes 应该通过名为 `regcred` 的 Secret 获取凭证。
344+
要从私有仓库拉取镜像，Kubernetes 需要凭据。
345+
配置文件中的 `imagePullSecrets` 字段表明 Kubernetes 应该通过名为 `regcred` 的 Secret 获取凭据。
350346

351347
创建使用了你的 Secret 的 Pod，并检查它是否正常运行：
352348

@@ -355,6 +351,40 @@ kubectl apply -f my-private-reg-pod.yaml
355351
kubectl get pod private-reg
356352
```
357353

354+
{{< note >}}
355+
<!--
356+
In case the Pod fails to start with the status `ImagePullBackOff`, view the Pod events:
357+
-->
358+
如果 Pod 以状态 `ImagePullBackOff` 启动失败，查看 Pod 事件：
359+
360+
```shell
361+
kubectl describe pod private-reg
362+
```
363+
364+
<!--
365+
If you then see an event with the reason set to `FailedToRetrieveImagePullSecret`,
366+
Kubernetes can't find a Secret with name (`regcred`, in this example).
367+
If you specify that a Pod needs image pull credentials, the kubelet checks that it can
368+
access that Secret before attempting to pull the image.
369+
-->
370+
如果你看到一个原因设为 `FailedToRetrieveImagePullSecret` 的事件，
371+
那么 Kubernetes 找不到指定名称（此例中为 `regcred`）的 Secret。
372+
如果你指定 Pod 需要拉取镜像凭据，kubelet 在尝试拉取镜像之前会检查是否可以访问该 Secret。
373+
374+
<!--
375+
Make sure that the Secret you have specified exists, and that its name is spelled properly.
376+
-->
377+
确保你指定的 Secret 存在，并且其名称拼写正确。
378+
379+
```shell
380+
Events:
381+
... Reason ... Message
382+
------ -------
383+
... FailedToRetrieveImagePullSecret ... Unable to retrieve some image pull secrets (<regcred>); attempting to pull the image may not succeed.
384+
```
385+
386+
{{< /note >}}
387+
358388
## {{% heading "whatsnext" %}}
359389

360390
<!--
@@ -365,10 +395,9 @@ kubectl get pod private-reg
365395
* See [kubectl create secret docker-registry](/docs/reference/generated/kubectl/kubectl-commands/#-em-secret-docker-registry-em-).
366396
* See the `imagePullSecrets` field within the [container definitions](/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers) of a Pod
367397
-->
368-
369398
* 进一步了解 [Secret](/zh-cn/docs/concepts/configuration/secret/)
370399
* 或阅读 {{< api-reference page="config-and-storage-resources/secret-v1" >}} 的 API 参考
371400
* 进一步了解[使用私有仓库](/zh-cn/docs/concepts/containers/images/#using-a-private-registry)
372-
* 进一步了解[为服务账户添加拉取镜像凭证](/zh-cn/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account)
373-
* 查看 [kubectl 创建 docker-registry 凭证](/docs/reference/generated/kubectl/kubectl-commands/#-em-secret-docker-registry-em-)
374-
* 查看 Pod [容器定义](/zh-cn/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers)中的 `imagePullSecrets` 字段。
401+
* 进一步了解[为服务账户添加拉取镜像凭据](/zh-cn/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account)
402+
* 查看 [kubectl 创建 docker-registry 凭据](/docs/reference/generated/kubectl/kubectl-commands/#-em-secret-docker-registry-em-)
403+
* 查看 Pod [容器定义](/zh-cn/docs/reference/kubernetes-api/workload-resources/pod-v1/#containers)中的 `imagePullSecrets` 字段

0 commit comments

Comments
 (0)