Kubernetes从私有镜像仓库拉取容器镜像时的身份验证方式

# 方法1：使用用户名密码创建
kubectl create secret docker-registry private-registry-auth \
  --docker-server=<registry-url> \
  --docker-username=<username> \
  --docker-password=<password> \
  --docker-email=<email>

# 方法2：使用已有的docker config文件
kubectl create secret generic private-registry-auth \
  --from-file=.dockerconfigjson=/path/to/.docker/config.json \
  --type=kubernetes.io/dockerconfigjson

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 3
  template:
    spec:
      imagePullSecrets:
      - name: private-registry-auth  # 引用之前创建的Secret
      containers:
      - name: app
        image: private-registry.example.com/mycompany/app:v1.0  # 私有镜像

# 可以将imagePullSecrets绑定到ServiceAccount
apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
imagePullSecrets:
- name: private-registry-auth  # 所有使用这个SA的Pod都会自动继承

# 然后在Pod中引用这个ServiceAccount
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  serviceAccountName: default  # 自动获得imagePullSecrets
  containers:
  - name: app
    image: private.registry/app:v1