ISSUE TYPE
COMPONENT NAME
Kubernetes Service Plugin
CLOUDSTACK VERSION
CONFIGURATION
OS / ENVIRONMENT
CentOS 7.9
KVM
SUMMARY
When provision number of k8s in ACS, it will stalled by docker hub pull rate limit policy. The k8s instance installation will fail to complete. To workaround this problem, it require injecting the pull secret in the middle of provisioning.
I think ACS should cater private registry authentication for the bootstrapping, or allowing custom property to specify image repository URL, such as quay.io or self hosted anonymous mirror.
STEPS TO REPRODUCE
1. Create a k8s instance in ACS.
2. ssh into first controlplane node
3. watch ImagePullBackoff event
4. Patch the pull secret
5. Restart the backedoff Pod
6. Wait for all Pod in running state.
example workaround script
read -p "your docker.io login name: " DOCKER_IO_USERNAME
read -p "your docekr.io password: " DOCKER_IO_PASSWORD
for x in `kubectl get ns -o NAME|awk -F / '{print $2}'`;do
kubectl create secret docker-registry docker-secret --docker-server=docker.io --docker-username=${DOCKER_IO_USERNAME} --docker-password=${DOCKER_IO_PASSWORD} --docker-email=dummy -n $x
kubectl patch serviceaccount default -p '{"imagePullSecrets": [{"name": "docker-secret"}]}' -n $x
done
kubectl patch serviceaccount weave-net -p '{"imagePullSecrets": [{"name": "docker-secret"}]}' -n kube-system
kubectl patch serviceaccount kubernetes-dashboard -p '{"imagePullSecrets": [{"name": "docker-secret"}]}' -n kubernetes-dashboard
kubectl get pod -A | awk '{if ($4=="Init:ImagePullBackOff") print "kubectl delete pod " $2 " -n " $1;}' | sh
kubectl get pod -A | awk '{if ($4=="ImagePullBackOff") print "kubectl delete pod " $2 " -n " $1;}' | sh
kubectl get pod -A | awk '{if ($4=="Pending") print "kubectl delete pod " $2 " -n " $1;}' | sh
EXPECTED RESULTS
k8s instance created without human invention.
ACTUAL RESULTS
Require inject pull secrets manually.
ISSUE TYPE
COMPONENT NAME
CLOUDSTACK VERSION
CONFIGURATION
OS / ENVIRONMENT
CentOS 7.9
KVM
SUMMARY
When provision number of k8s in ACS, it will stalled by docker hub pull rate limit policy. The k8s instance installation will fail to complete. To workaround this problem, it require injecting the pull secret in the middle of provisioning.
I think ACS should cater private registry authentication for the bootstrapping, or allowing custom property to specify image repository URL, such as quay.io or self hosted anonymous mirror.
STEPS TO REPRODUCE
example workaround script
EXPECTED RESULTS
ACTUAL RESULTS