突然之间，我无法部署一些以前可以部署的映像。我得到了以下豆荚状态:
[root@webdev2 origin]# oc get pods
NAME READY STATUS RESTARTS AGE
arix-3-yjq9w 0/1 ImagePullBackOff 0 10m
docker-registry-2-vqstm 1/1 Running 0 2d
router-1-kvjxq 1/1 Running 0 2d
应用程序就是无法启动。吊舱并没有试图运行容器。从事件页面，我已经退下拉图像“172.30.84.25:5000/default/arix@sha256:d326。我已经验证了我可以用docker pull的标签拉图像。
我也查了上一个集装箱的日志。因为某种原因，它被关闭了。我觉得太空舱至少应该试着重启一下。
我已经没有办法解决这个问题了。我还可以检查什么?
你可以使用“描述pod”语法
OpenShift使用:
oc describe pod <pod-id>
对于香草Kubernetes:
kubectl describe pod <pod-id>
检查输出的事件。
在我的例子中，它显示back off pull image unreachableserver/nginx:1.14.22222
在这种情况下，镜像unreachableserver/nginx:1.14.22222不能从互联网上提取，因为没有Docker注册表unreachableserver，并且镜像nginx:1.14.22222不存在。
注意:如果你没有看到任何感兴趣的事件，并且pod已经处于'ImagePullBackOff'状态一段时间了(似乎超过60分钟)，你需要删除pod，并从新的pod中查看事件。
OpenShift使用:
oc delete pod <pod-id>
oc get pods
oc get pod <new-pod-id>
对于香草Kubernetes:
kubectl delete pod <pod-id>
kubectl get pods
kubectl get pod <new-pod-id>
样例输出:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 32s default-scheduler Successfully assigned rk/nginx-deployment-6c879b5f64-2xrmt to aks-agentpool-x
Normal Pulling 17s (x2 over 30s) kubelet Pulling image "unreachableserver/nginx:1.14.22222"
Warning Failed 16s (x2 over 29s) kubelet Failed to pull image "unreachableserver/nginx:1.14.22222": rpc error: code = Unknown desc = Error response from daemon: pull access denied for unreachableserver/nginx, repository does not exist or may require 'docker login': denied: requested access to the resource is denied
Warning Failed 16s (x2 over 29s) kubelet Error: ErrImagePull
Normal BackOff 5s (x2 over 28s) kubelet Back-off pulling image "unreachableserver/nginx:1.14.22222"
Warning Failed 5s (x2 over 28s) kubelet Error: ImagePullBackOff
其他调试步骤
try to pull the docker image and tag manually on your computer
Identify the node by doing a 'kubectl/oc get pods -o wide'
ssh into the node (if you can) that can not pull the docker image
check that the node can resolve the DNS of the docker registry by performing a ping.
try to pull the docker image manually on the node
If you are using a private registry, check that your secret exists and the secret is correct. Your secret should also be in the same namespace. Thanks swenzel
Some registries have firewalls that limit ip address access. The firewall may block the pull
Some CIs create deployments with temporary docker secrets. So the secret expires after a few days (You are asking for production failures...)
