minikube - x509：由未知机构签署的证书

Question

我正在使用

minikube

和

kubectl

为

RC

创建

mongo

。而且我用的是公司的VPN。

通过

RC

命令创建了

kubectl create -f ./rc/mongo-rc.yaml

。

使用

kubectl describe pod mongo-5zttk

命令时得到以下 kubernetes 事件：

...
Events:
  Type     Reason     Age                    From               Message
  ----     ------     ----                   ----               -------
  Normal   Scheduled  7m18s                  default-scheduler  Successfully assigned default/mongo-5zttk to minikube
  Normal   Pulling    5m42s (x4 over 7m17s)  kubelet, minikube  Pulling image "mongo"
  Warning  Failed     5m40s (x4 over 7m15s)  kubelet, minikube  Failed to pull image "mongo": rpc error: code = Unknown desc = Error response from daemon: Get https://registry-1.docker.io/v2/library/mongo/manifests/latest: Get https://auth.docker.io/token?scope=repository%3Alibrary%2Fmongo%3Apull&service=registry.docker.io: x509: certificate signed by unknown authority
  Warning  Failed     5m40s (x4 over 7m15s)  kubelet, minikube  Error: ErrImagePull
  Normal   BackOff    5m29s (x6 over 7m15s)  kubelet, minikube  Back-off pulling image "mongo"
  Warning  Failed     2m8s (x21 over 7m15s)  kubelet, minikube  Error: ImagePullBackOff

当我尝试使用

curl

访问 URL 时：

⚡  curl https://registry-1.docker.io/v2/library/mongo/manifests/latest
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"library/mongo","Action":"pull"}]}]}

我可以成功从 docker hub 注册表中提取

mongo:latest

镜像。

⚡  docker pull mongo:latest
latest: Pulling from library/mongo
Digest: sha256:efc408845bc917d0b7fd97a8590e9c8d3c314f58cee651bd3030c9cf2ce9032d
Status: Image is up to date for mongo:latest
docker.io/library/mongo:latest

环境信息：

• minikube版本：v1.14.1
• kubectl
  • 客户端版本：v1.18.8
  • 服务器版本：v1.19.2
• 操作系统：macOS 10.13.6

我已阅读文档：vpn_and_proxy/#x509-certificate-signed-by-unknown-authority。解决方案是向 IT 部门索要适当的 PEM 文件。如果无法获取 PEM 文件，有什么解决办法吗？例如使用一些命令标志：

--skip-verify-cert

？

更新：

mongo-rc.yaml

：

apiVersion: v1
kind: ReplicationController
metadata: 
  name: mongo
spec: 
  replicas: 1
  selector: 
    app: mongo
  template: 
    metadata: 
      labels:
        app: mongo
    spec: 
      containers: 
      - name: mongo
        image: mongo
        ports: 
        - containerPort: 27017
        env: 
        - name: MONGO_ROOT_PASSWORD
          value: "123456"

Answer 1

您应该能够使用

--insecure-registry

标志，但您可能必须重新创建 minikube 集群才能使其正常工作。

minikube start --insecure-registry="registry-1.docker.io"

Answer 2

尝试了很多东西，只有一个对我有用：

1. 在 shell 中输入 MK 容器，创建一个包含以下条目的文件（例如 /root/docker.sh）：

update-ca-certificates --fresh
openssl s_client -showcerts -verify 5 -connect k8s.gcr.io:443 < /dev/null 2>/dev/null | openssl x509 -outform PEM | tee ~/k8s.gcr.io.crt
openssl s_client -showcerts -verify 5 -connect registry-1.docker.io:443 < /dev/null 2>/dev/null | openssl x509 -outform PEM | tee ~/registry-1.docker.io.crt
openssl s_client -showcerts -verify 5 -connect auth.docker.io:443 < /dev/null 2>/dev/null | openssl x509 -outform PEM | tee ~/auth.docker.io.crt
cp ~/k8s.gcr.io.crt /usr/local/share/ca-certificates/
cp ~/registry-1.docker.io.crt /usr/local/share/ca-certificates/
cp ~/auth.docker.io.crt /usr/local/share/ca-certificates/
update-ca-certificates
# service docker restart

2. 执行一次，或者与docker start一起安全添加执行（/etc/init.d/docker）

...
case "$1" in
        start)
                # <add-following-line>
                /root/./docker.sh
                # </add-following-line>
                check_init
                fail_unless_root
                cgroupfs_mount
                ..

Answer 3

我也遇到了同样的问题，并且正在拉扯我的头发，因为所有建议的解决方案都不适合我

只需按照此操作 - https://minikube.sigs.k8s.io/docs/handbook/vpn_and_proxy/#x509-certificate-signed-by-unknown-authority