K
Q

Getting "containers with unready status: []" error in Kubernetes

2/7/2019

I'm trying to deploy a Kubernetes Pod in AKS (I'm new to Kubernetes, so at this stage, I just want to create a container, deploy to Kubernetes and connect to it).

My Yaml file is as follows:

apiVersion: v1
kind: Pod
spec: 
  containers:
    - name: dockertest20190205080020
      image: dockertest20190205080020.azurecr.io    
      ports:
      - containerPort: 443
metadata: 
  name: my-test

I've created the image in Azure Container Registry and, according to the CLI, successfully deployed it to Kubernetes.

After deploying, I used the following command:

kubectl get service

And it tells me there is no External IP to connect to. I then tried:

kubectl describe pod my-test

Which gave the following errors:

 Events:
   Warning  Failed   4m (x2221 over 8h)  kubelet, aks-nodepool1-27401563-2  Error: ImagePullBackOff
   Normal   BackOff  0s (x2242 over 8h)  kubelet, aks-nodepool1-27401563-2  Back-off pulling image "dockertest20190205080020.azurecr.io"

I then tried editing the deployment:

kubectl edit pods my-test

Which game me the error:

message: 'containers with unready status: [dockertest20190205080020]'

I'm not a little unsure what my next diagnostic step would be. I get the impression there's an issue with the container or the container registry, but I'm unsure how to determine what that may be.

--
azure
azure-aks
azure-container-registry
azure-kubernetes
kubernetes

Similar Questions

Elasticsearch query fails from Kubernetes pod but successful from curl request
404 hitting `metadata.google.internal` from K8s pod with Istio
How to fix "Kibana server is not ready yet" error when using AKS
How to access docker from my jenkins image running on my local Kubernetes instance
Resolving random name to random ip for in kubernetes pods

2 Answers

2/13/2019

I'm not sure if you know there is something wrong in your yaml file, or it just shows as you want for security. But I would show you here:

apiVersion: v1
kind: Pod
spec: 
  containers:
    - name: dockertest20190205080020
      image: dockertest20190205080020.azurecr.io/image_name_and_version   
      ports:
      - containerPort: 443
metadata: 
  name: my-test

Also, as the error that you got shows, you don't have the permission to pull the image from your ACR.

On my side, I would be better to use a secret for pulling all the image from the ACR. You can create a service principal to achieve it. The steps would be like here:

#!/bin/bash

ACR_NAME=myacrinstance
SERVICE_PRINCIPAL_NAME=acr-service-principal

# Populate the ACR login server and resource id.
ACR_LOGIN_SERVER=$(az acr show --name $ACR_NAME --query loginServer --output tsv)
ACR_REGISTRY_ID=$(az acr show --name $ACR_NAME --query id --output tsv)

# Create acrpull role assignment with a scope of the ACR resource.
SP_PASSWD=$(az ad sp create-for-rbac --name $SERVICE_PRINCIPAL_NAME --role acrpull --scopes $ACR_REGISTRY_ID --query password --output tsv)

# Get the service principal client id.
CLIENT_ID=$(az ad sp show --id http://$SERVICE_PRINCIPAL_NAME --query appId --output tsv)

# Output used when creating Kubernetes secret.
echo "Service principal ID: $CLIENT_ID"
echo "Service principal password: $SP_PASSWD"

# Create the secret 
kubectl create secret docker-registry acr-auth --docker-server <acr-login-server> --docker-username <service-principal-ID> --docker-password <service-principal-password>

Then you can change your yaml file like this:

apiVersion: v1
kind: Pod
spec: 
  containers:
    - name: dockertest20190205080020
      image: dockertest20190205080020.azurecr.io/image_name_and_version   
      ports:
      - containerPort: 443
  imagePullSecrets:
  - name: acr-auth
metadata: 
  name: my-test
-- Charles Xu
Source: StackOverflow
2/7/2019

What happens here (most likely) - your AKS doesnt have permissions to pull images frmo you ACR (that's the default behaviour). You need to grant those (link):

#!/bin/bash

AKS_RESOURCE_GROUP=myAKSResourceGroup
AKS_CLUSTER_NAME=myAKSCluster
ACR_RESOURCE_GROUP=myACRResourceGroup
ACR_NAME=myACRRegistry

# Get the id of the service principal configured for AKS
CLIENT_ID=$(az aks show --resource-group $AKS_RESOURCE_GROUP --name $AKS_CLUSTER_NAME --query "servicePrincipalProfile.clientId" --output tsv)

# Get the ACR registry resource id
ACR_ID=$(az acr show --name $ACR_NAME --resource-group $ACR_RESOURCE_GROUP --query "id" --output tsv)

# Create role assignment
az role assignment create --assignee $CLIENT_ID --role acrpull --scope $ACR_ID

Alternative is to just use a docker login secret (that article mentions that as well).

Example image in ACR: enter image description here

image name would be

clrtacr.azurecr.io/dns:tag (or without tag for latest)

-- 4c74356b41
Source: StackOverflow