本地构建镜像latest引用问题
今天出现个奇怪问题，本地构建了镜像 docklet/hijob:latest, 部署到本地k8s的job时却提示
hijob-bgtvl docker-for-desktop 等待中：ErrImagePull 0 1 分钟
Failed to pull image "docklet/hijob": rpc error: code = Unknown desc = Error response from daemon: pull access denied for docklet/hijob, repository does not exist or may require 'docker login'
奇怪？镜像本地有啊（之前学到的是本地有就不去远端拉），邀请jianguo一起分析原因
$ kubectl describe pod/hijob-bgtvl
Name: hijob-bgtvl
Namespace: default
Node: docker-for-desktop/192.168.65.3
Start Time: Fri, 07 Sep 2018 12:26:20 +0800
Labels: controller-uid=2b76495a-b256-11e8-ad25-025000000001
job-name=hijob
.....
Volumes:
default-token-wqxsg:
Type: Secret (a volume populated by a Secret)
SecretName: default-token-wqxsg
Optional: false
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute for 300s
node.kubernetes.io/unreachable:NoExecute for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 5m default-scheduler Successfully assigned hijob-bgtvl to docker-for-desktop
Normal SuccessfulMountVolume 5m kubelet, docker-for-desktop MountVolume.SetUp succeeded for volume "default-token-wqxsg"
Normal Pulling 3m (x4 over 5m) kubelet, docker-for-desktop pulling image "docklet/hijob"
Warning Failed 3m (x4 over 5m) kubelet, docker-for-desktop Failed to pull image "docklet/hijob": rpc error: code = Unknown desc = Error response from daemon: pull access denied for docklet/hijob, repository does not exist or may require 'docker login'
Warning Failed 3m (x4 over 5m) kubelet, docker-for-desktop Error: ErrImagePull
Normal BackOff 3m (x6 over 5m) kubelet, docker-for-desktop Back-off pulling image "docklet/hijob"
Warning Failed 20s (x18 over 5m) kubelet, docker-for-desktop Error: ImagePullBackOff
$
从log上看，肯定是去远端拉镜像了（我本地构建的，远端肯定没有！） 将镜像从docklet/hijob改成docklet/hijob:latest仍然报同样的错误，jianguo搜索了后建议打成别的tag，如try1:v1, 试了下竟然ok了，呵呵，看样子 问题还是出在latest tag的使用上
原因解析
https://kubernetes.io/docs/concepts/configuration/overview/#container-images
The default imagePullPolicy for a container is IfNotPresent, which causes the kubelet to pull an image only if it does not already exist locally. If you want the image to be pulled every time Kubernetes starts the container, specify imagePullPolicy: Always.
An alternative, but deprecated way to have Kubernetes always pull the image is to use the :latest tag, which will implicitly set the imagePullPolicy to Always.
Note: You should avoid using the :latest tag when deploying containers in production, because this makes it hard to track which version of the image is running and hard to roll back.
To make sure the container always uses the same version of the image, you can specify its digest (for example sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2). This uniquely identifies a specific version of the image, so it will never be updated by Kubernetes unless you change the digest value.
解释的很清楚， 用latest， kubelet 就会去远端拉，因为他要保障你本地的latest与远端中心的latest同步一致
之后改善
- 慎用latest tag，特别是production环境（可能导致无法精确回滚）
- 本地可以用
docklet/hijob:local作为本地latest，避免与latest产生冲突
