突破Docker Hub限制：awx-on-k3s私有容器registry部署与配置

突破Docker Hub限制awx-on-k3s私有容器registry部署与配置【免费下载链接】awx-on-k3sAn example implementation of AWX on single node K3s using AWX Operator, with easy-to-use simplified configuration with ownership of data and passwords.项目地址: https://gitcode.com/gh_mirrors/aw/awx-on-k3sDocker Hub的拉取限制常常让开发者头疼不已特别是在使用awx-on-k3s部署AWX时频繁的镜像拉取很容易触发Docker Hub的速率限制导致部署失败或中断。本文将详细介绍如何在awx-on-k3s项目中部署和配置私有容器registry彻底解决Docker Hub限制问题让你的AWX部署更加顺畅和自主。为什么需要私有容器registry当你按照awx-on-k3s仓库的步骤部署AWX时对Docker Hub的拉取请求会被识别为免费匿名账户因此每6小时只能请求200次。当出现429 Too Many Requests消息时说明已超出限制。此时部署一个私有容器registry就成了理想的解决方案它不仅能突破Docker Hub的限制还能让你完全掌控自己的镜像数据和访问权限。私有容器registry部署步骤准备必要文件首先生成自签名证书注意不能指定IP地址REGISTRY_HOSTregistry.example.com openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -out ./registry/tls.crt -keyout ./registry/tls.key -subj /CN${REGISTRY_HOST}/O${REGISTRY_HOST} -addext subjectAltName DNS:${REGISTRY_HOST}修改registry/ingress.yaml中的hosts和host字段将registry.example.com替换为你的域名... - hosts: - registry.example.com secretName: registry-secret-tls rules: - host: registry.example.com ...生成htpasswd字符串用于容器registry的用户认证$ kubectl run htpasswd -it --restartNever --image httpd:2.4 --rm -- htpasswd -nbB reguser Registry123! reguser:$2y$05$VLMvcWCPF0VUuHi0BXBz7eoXGZ6KRl1gataiqTXz4DdSVIXGloKiq pod htpasswd deleted将生成的htpasswd字符串替换到registry/configmap.yaml中... htpasswd: |- reguser:$2y$05$VLMvcWCPF0VUuHi0BXBz7eoXGZ6KRl1gataiqTXz4DdSVIXGloKiq ...创建Persistent Volumes所需的目录sudo mkdir -p /data/registry部署私有容器registry执行以下命令部署私有容器registrykubectl apply -k registry部署完成后检查registry命名空间下的资源$ kubectl -n registry get all,ingress NAME READY STATUS RESTARTS AGE pod/registry-7457f6c64b-sxqfp 1/1 Running 0 9s NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE service/registry-service ClusterIP 10.43.15.228 none 5000/TCP 9s NAME READY UP-TO-DATE AVAILABLE AGE deployment.apps/registry 1/1 1 1 9s NAME DESIRED CURRENT READY AGE replicaset.apps/registry-7457f6c64b 1 1 1 9s NAME CLASS HOSTS ADDRESS PORTS AGE ingress.networking.k8s.io/registry-ingress none registry.example.com 192.168.0.221 80, 443现在你的容器registry可以通过指定的主机名如registry.example.com使用了。私有容器registry测试Docker测试将你的registry添加为不安全的registry并重启Docker守护进程sudo tee /etc/docker/daemon.json EOF { insecure-registries : [registry.example.com] } EOF sudo systemctl restart docker登录到你的容器registry$ docker login registry.example.com Username: reguser Password: WARNING! Your password will be stored unencrypted in /home/********/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/engine/reference/commandline/login/#credentials-store Login Succeeded测试镜像推送和拉取# 从docker.io拉取镜像 docker pull docker.io/docker/whalesay:latest # 标记为私有registry上的镜像 docker tag docker.io/docker/whalesay:latest registry.example.com/reguser/whalesay:latest # 推送到私有registry docker push registry.example.com/reguser/whalesay:latest # 删除本地镜像 docker image rm docker.io/docker/whalesay:latest docker image rm registry.example.com/reguser/whalesay:latest # 从私有registry拉取镜像 docker pull registry.example.com/reguser/whalesay:latest # 运行测试容器 docker run -it --rm registry.example.com/reguser/whalesay:latest cowsay hoge深入了解Registry使用reg工具可以更深入地管理容器registry# 安装reg sudo curl -fSL https://github.com/genuinetools/reg/releases/download/v0.16.1/reg-linux-amd64 -o /usr/local/bin/reg sudo chmod x /usr/local/bin/reg # 列出registry中的仓库和标签 reg ls -k registry.example.com reg tags -k registry.example.com/reguser/whalesay # 删除registry中的标签 reg rm -k registry.example.com/reguser/whalesay:latest配置AWX或K3s使用私有容器registry这个私有registry不仅可以用作AWX的Execution Environment存储库还可以作为K3s的私有registry。配置步骤创建registries.yaml并重启K3ssudo tee /etc/rancher/k3s/registries.yaml EOF configs: registry.example.com: auth: username: reguser password: Registry123! tls: insecure_skip_verify: true EOF # 安全重启K3s服务不会影响正在运行的资源 sudo systemctl restart k3s检查应用的配置sudo $(which k3s) crictl info # 使用jq查看 sudo $(which k3s) crictl info | jq .config.registry如果希望Kubernetes能够直接从这个私有registry拉取镜像除了在registries.yaml中写入凭据外还可以为Pod手动创建imagePullSecrets。关于如何使用ImagePullSecrets另一篇关于Docker Hub速率限制的指南中有详细解释。测试配置使用需要身份验证的私有仓库中的镜像启动Pod$ kubectl run whalesay -it --restartNever --image registry.example.com/reguser/whalesay:latest --rm -- cowsay hoge ______ hoge ------ \ \ \ ## . ## ## ## ## ## ## ## /___/ ~~~ {~~ ~~~~ ~~~ ~~~~ ~~ ~ / - ~~~ \______ o __/ \ \ __/ \____\______/ pod whalesay deleted通过以上步骤你已经成功部署并配置了awx-on-k3s的私有容器registry彻底突破了Docker Hub的限制。现在你可以更自由地管理和使用容器镜像确保AWX部署和运行的稳定性。如果你在使用过程中遇到任何问题可以参考项目中的tips/troubleshooting.md文档获取帮助。同时tips/dockerhub-rate-limit.md中也提供了更多关于处理Docker Hub速率限制的方法。希望这篇指南能帮助你顺利搭建自己的私有容器registry享受更顺畅的AWX部署体验 【免费下载链接】awx-on-k3sAn example implementation of AWX on single node K3s using AWX Operator, with easy-to-use simplified configuration with ownership of data and passwords.项目地址: https://gitcode.com/gh_mirrors/aw/awx-on-k3s创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考