无法提取映像"xx.azurecr.io/xx:latest":rpc错误:代码=未知desc =来自守护程序的错误响应:未授权:需要认证 [英] Failed to pull image "xx.azurecr.io/xx:latest": rpc error: code = Unknown desc = Error response from daemon: unauthorized: authentication required
问题描述
我的ACR和AKS在具有相同订阅的同一Azure目录中.
My ACR and AKS are on same Azure Directory with same subscription.
在授予ACR Pull访问我的服务主体后，什么都没有起作用，仍然出现此错误.
After giving ACR Pull access to my Service Principal, nothing worked and still getting this error.
错误:-无法提取图片"xx.azurecr.io/xx:latest":rpc错误: 代码=未知desc =来自守护程序的错误响应:获取 https://xx.azurecr.io/v2/xx/manifests/latest:未经授权: 需要验证
Error :- Failed to pull image "xx.azurecr.io/xx:latest": rpc error: code = Unknown desc = Error response from daemon: Get https://xx.azurecr.io/v2/xx/manifests/latest: unauthorized: authentication required
推荐答案
从错误消息中，它表明您没有身份验证以将映像拉到Azure容器注册表中.
From the error message, it shows you do not authenticate to pull the image in your Azure Container Registry.
对于AKS，有两种方法可以获取从Azure容器注册表中提取映像的权限.
For AKS, there are two ways to get permission to pull the image from the Azure Container Registry.
One is that grant the permission to the service principal which AKS cluster used. You can get the details in Grant AKS access to ACR. In this way, you just need only one service principal.
另一个是将权限授予与AKS使用的服务主体不同的新服务主体.然后，使用服务主体创建一个秘密以提取映像.您可以在
The other one is that grant the permission to a new service principal which differs from the one that AKS used. Then you create a secret with the service principal to pull the image. You can get the details in Access with Kubernetes Secret.
它们是两种不同的方式，因此您应确保步骤中没有错误.要检查服务主体的角色分配，请使用如下CLI命令:
They are two different ways, so you should make sure that there is no mistake in your steps. To check the role assignment for the service principal, the CLI command like this:
az role assignment list --assignee $SP_ID --role acrpull --scope $ACR_ID
SP_ID取决于您使用的方式.
The SP_ID dependants on the way which you have used.
这篇关于无法提取映像"xx.azurecr.io/xx:latest":rpc错误:代码=未知desc =来自守护程序的错误响应:未授权:需要认证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
