K
Q

Pull images from an Azure container registry to a Kubernetes cluster

3/1/2021

I have followed this tutorial microsoft_website to pull images from an azure container. My yaml successfully creates a pod job, which can pull the image, BUT only when it runs on the agentpool node in my cluster.

For example, adding nodeName: aks-agentpool-33515997-vmss000000 to the yamlworks fine, but specifying a different node name, e.g. nodeName: aks-cpu1-33515997-vmss000000, the pod fails. The error message I get with describe pods is Failed to pull image and then kubelet Error: ErrImagePull.

What I'm missing?

Create secret:

kubectl create secret docker-registry <secret-name> \
--docker-server=<container-registry-name>.azurecr.io \
--docker-username=<service-principal-ID> \
--docker-password=<service-principal-password>
-- user1571823
azure
containers
kubernetes

Similar Questions

How to run Tensorflow - Spark jobs on Kubernetes using the Spark Operator?
Does OpenShift Online support deploying Custom Resource Definition (CRDs) of an Operator?
How to delete pods inside "default" namespace permanently. As when I delete only pods it is coming back because of "replication controller"
Cassandra Restore on K8s without schema backup
Trying to rewrite url for Grafana with Ingress

2 Answers

3/1/2021

Four things to check:

  • Is it a subscription issue? Are the nodes in different subscriptions?
  • Is it a rights issue? Does the service principle of the node have rights to pull the image.
  • Is it a network issue? Are the nodes on different subnets?
  • Is there something with the image size or configuration, that means that it cannot run on the other cluster.

Edit

New-AzAksNodePool has a parameter -DefaultProfile

It can be AzContext, AzureRmContext, AzureCredential

If this is different between your nodes it would explain the error

-- Shiraz Bhaiji
Source: StackOverflow
3/9/2021

As @user1571823 told solution to the problem is deleting the old image from the acr and creating/pushing a new one.
The problem was related to some sort of corruption in the image saved in the azure container registry (acr). The reason why one agent pool could pulled the image was actually because the image already existed in the VM.

Henceforth as @andov said it is good option to open an incident case to Azure support for AKS from your subscription, where AKS is deployed. The support team has full access to the AKS service backend and they can tell exactly what was causing your problem.

-- Malgorzata
Source: StackOverflow