无法从AWS私有注册表部署docker镜像

Question

我正在尝试从AWS Elastic容器注册表中托管的docker镜像中推送应用程序，并且在尝试推送时从cloudfoundry API获取500个错误代码。我做错了什么或者目前API只是一个问题？任何帮助表示赞赏。

使用推送命令（替换真实路线，应用程序和图像名称）：

cf push dockerized-app --docker-image 300401118676.dkr.ecr.eu-central-1.amazonaws.com/my/image:latest --docker-username AWS --hostname my-dockerized-app -i 1 -m 1024M -k 1024M

cf-cli版本：cf version 6.34.1+bbdf81482.2018-01-17

这是我获得的标准日志输出：

Using docker repository password from environment variable CF_DOCKER_PASSWORD.
Pushing app dockerized-app to org ORG / space SPACE as [email protected]...
Getting app info...
Creating app with these attributes...
+ name:              dockerized-app
+ docker image:      300401118676.dkr.ecr.eu-central-1.amazonaws.com/my/image:latest
+ docker username:   AWS
+ disk quota:        1G
+ instances:         1
+ memory:            1G
  routes:
+   my-dockerized-app.scapp.io

Creating app dockerized-app...
Unexpected Response
Response code: 500
CC code:       0
CC error code: 
Request ID:    f0789965-19b1-4178-5cce-e42ff671a99b::6eb55c40-70de-4011-ad30-ee60aab54d82
Description:   {
  "error_code": "UnknownError",
  "description": "An unknown error occurred.",
  "code": 10001
}

FAILED

以下是设置-v标志的相关日志输出

Creating app with these attributes...
+ name:              dockerized-app
+ docker image:      300401118676.dkr.ecr.eu-central-1.amazonaws.com/my/image:latest
+ docker username:   AWS
+ disk quota:        1G
+ instances:         1
+ memory:            1G
  routes:
+   my-dockerized-app.scapp.io

Creating app dockerized-app...
REQUEST: [2018-02-27T18:39:28+01:00]
POST /v2/apps HTTP/1.1
Host: api.lyra-836.appcloud.swisscom.com
Accept: application/json
Authorization: [PRIVATE DATA HIDDEN]
Content-Type: application/json
User-Agent: cf/6.34.1+bbdf81482.2018-01-17 (go1.9.2; amd64 darwin)
{
  "disk_quota": 1024,
  "docker_credentials": {
    "password": "[PRIVATE DATA HIDDEN]",
    "username": "AWS"
  },
  "docker_image": "300401118676.dkr.ecr.eu-central-1.amazonaws.com/my/image:latest",
  "instances": 1,
  "memory": 1024,
  "name": "dockerized-app",
  "space_guid": "07cead83-7db5-477e-83ca-f7bbee10e557"
}


RESPONSE: [2018-02-27T18:39:28+01:00]
HTTP/1.1 500 Internal Server Error
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Length: 99
Content-Type: application/json;charset=utf-8
Date: Tue, 27 Feb 2018 17:39:28 GMT
Expires: 0
Pragma: no-cache
Server: nginx
Strict-Transport-Security: max-age=16070400; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Vcap-Request-Id: 6c6acb3a-4ead-4f88-5d2c-e7d7f846b2af::0e919224-e372-46f1-8d70-19bf30f85145
X-Xss-Protection: 1; mode=block
{
  "code": 10001,
  "description": "An unknown error occurred.",
  "error_code": "UnknownError"
}


Unexpected Response
Response code: 500
CC code:       0
CC error code: 
Request ID:    6c6acb3a-4ead-4f88-5d2c-e7d7f846b2af::0e919224-e372-46f1-8d70-19bf30f85145
Description:   {
  "error_code": "UnknownError",
  "description": "An unknown error occurred.",
  "code": 10001
}

在我看来像docker注册表用户名和密码就好了（是的，他们工作）。

Answer 1

从运营商的角度来看，通过使用Amazon Elastic Container Registry签名的令牌（大约2000个字符），您似乎达到了CloudFoundry的1000个字符的密码限制：

/var/vcap/sys/log/cloud_controller_ng/cloud_controller_ng.log.5.gz: 
{"timestamp":1526311559.8367982,"message":"Request failed: 500: 
{\"error_code\"=>\"UnknownError\", \"description\"=>\"An unknown 
error occurred.\", \"code\"=>10001, \"test_mode_info\"=> 
{\"description\"=>\"docker_password can be up to 1,000 characters\", 
...

我们向CC团队提出了这个问题：https://github.com/cloudfoundry/cloud_controller_ng/issues/1141

Answer 2

我不确定您的提供商目前正在运行什么版本的Cloud Foundry，但是对私有docker注册表（即使用HTTPS和基本身份验证的注册管理机构）的支持需要相当新版本的Cloud Foundry。

它肯定适用于API版本2.103及更高版本，因为我们现在正在Meshcloud上运行，我们让客户成功使用私有注册表;-)

$ cf api
api endpoint:   https://api.cf.eu-de-netde.msh.host
api version:    2.103.0

免责声明：我是Meshcloud的联合创始人。