本地构建镜像latest引用问题

今天出现个奇怪问题，本地构建了镜像 docklet/hijob:latest, 部署到本地k8s的job时却提示

hijob-bgtvl docker-for-desktop 等待中：ErrImagePull 0 1 分钟
Failed to pull image "docklet/hijob": rpc error: code = Unknown desc = Error response from daemon: pull access denied for docklet/hijob, repository does not exist or may require 'docker login'

奇怪？镜像本地有啊（之前学到的是本地有就不去远端拉），邀请jianguo一起分析原因

$ kubectl describe pod/hijob-bgtvl
Name:           hijob-bgtvl
Namespace:      default
Node:           docker-for-desktop/192.168.65.3
Start Time:     Fri, 07 Sep 2018 12:26:20 +0800
Labels:         controller-uid=2b76495a-b256-11e8-ad25-025000000001
                job-name=hijob
.....
Volumes:
  default-token-wqxsg:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  default-token-wqxsg
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  <none>
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason                 Age                From                         Message
  ----     ------                 ----               ----                         -------
  Normal   Scheduled              5m                 default-scheduler            Successfully assigned hijob-bgtvl to docker-for-desktop
  Normal   SuccessfulMountVolume  5m                 kubelet, docker-for-desktop  MountVolume.SetUp succeeded for volume "default-token-wqxsg"
  Normal   Pulling                3m (x4 over 5m)    kubelet, docker-for-desktop  pulling image "docklet/hijob"
  Warning  Failed                 3m (x4 over 5m)    kubelet, docker-for-desktop  Failed to pull image "docklet/hijob": rpc error: code = Unknown desc = Error response from daemon: pull access denied for docklet/hijob, repository does not exist or may require 'docker login'
  Warning  Failed                 3m (x4 over 5m)    kubelet, docker-for-desktop  Error: ErrImagePull
  Normal   BackOff                3m (x6 over 5m)    kubelet, docker-for-desktop  Back-off pulling image "docklet/hijob"
  Warning  Failed                 20s (x18 over 5m)  kubelet, docker-for-desktop  Error: ImagePullBackOff
$

从log上看，肯定是去远端拉镜像了（我本地构建的，远端肯定没有！） 将镜像从docklet/hijob改成docklet/hijob:latest仍然报同样的错误，jianguo搜索了后建议打成别的tag，如try1:v1, 试了下竟然ok了，呵呵，看样子 问题还是出在latest tag的使用上

原因解析

https://kubernetes.io/docs/concepts/configuration/overview/#container-images

The default imagePullPolicy for a container is IfNotPresent, which causes the kubelet to pull an image only if it does not already exist locally. If you want the image to be pulled every time Kubernetes starts the container, specify imagePullPolicy: Always.
An alternative, but deprecated way to have Kubernetes always pull the image is to use the :latest tag, which will implicitly set the imagePullPolicy to Always.

Note: You should avoid using the :latest tag when deploying containers in production, because this makes it hard to track which version of the image is running and hard to roll back.
To make sure the container always uses the same version of the image, you can specify its digest (for example sha256:45b23dee08af5e43a7fea6c4cf9c25ccf269ee113168c19722f87876677c5cb2). This uniquely identifies a specific version of the image, so it will never be updated by Kubernetes unless you change the digest value.

解释的很清楚， 用latest， kubelet 就会去远端拉，因为他要保障你本地的latest与远端中心的latest同步一致

之后改善

• 慎用latest tag，特别是production环境（可能导致无法精确回滚）
• 本地可以用 docklet/hijob:local 作为本地latest，避免与latest产生冲突