虚拟机通过宿主机代理实现从外网拉取镜像的方法

先看一下配置前的效果，在拉取镜像时等待了1分钟，毫无进展

root@Y76-K8s-Master01:~# docker pull nginx
Using default tag: latest
latest: Pulling from library/nginx
ea235d1ccf77: Retrying in 1 second 
e29cef106877: Retrying in 1 second 
e9bf20d5335e: Retrying in 1 second 
1394e86b8f58: Waiting 
7b2b3e0f512f: Waiting 
6a11b5a77155: Waiting 
fb6d6e4aad9c: Waiting

 接下来我们进行配置，打开宿主机上的代理软件（步骤略，切记需要让代理软件允许局域网链接），在宿主机上查看代理软件监听端口

# netstat -ntl |grep 7890
tcp4       0      0  127.0.0.1.7890                                127.0.0.1.60486                               ESTABLISHED
tcp4       0      0  127.0.0.1.60486                               127.0.0.1.7890                                ESTABLISHED
tcp4       0      0  127.0.0.1.7890                                127.0.0.1.60440                               ESTABLISHED
tcp4       0      0  127.0.0.1.60440                               127.0.0.1.7890                                ESTABLISHED
tcp4       0      0  127.0.0.1.7890                                127.0.0.1.60407                               ESTABLISHED
tcp4       0      0  127.0.0.1.60407                               127.0.0.1.7890                                ESTABLISHED
tcp4       0      0  127.0.0.1.7890                                127.0.0.1.59913                               ESTABLISHED
tcp4       0      0  127.0.0.1.59913                               127.0.0.1.7890                                ESTABLISHED
tcp4       0      0  127.0.0.1.60458                               127.0.0.1.7890                                TIME_WAIT  
tcp4       0      0  127.0.0.1.60526                               127.0.0.1.7890                                TIME_WAIT  
tcp4       0      0  127.0.0.1.60508                               127.0.0.1.7890                                TIME_WAIT  
udp4       0      0  127.0.0.1.7890                                *.*                                                      

虚拟机端测试是否访问宿主机端口

root@Y76-K8s-Master01:~# ping 172.164.17.100
PING 172.164.17.100 (172.164.17.100): 56 data bytes
64 bytes from 172.164.17.100: icmp_seq=0 ttl=128 time=0.784 ms
64 bytes from 172.164.17.100: icmp_seq=1 ttl=128 time=1.253 ms
^C--- 172.164.17.100 ping statistics ---
2 packets transmitted, 2 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.784/1.018/1.253/0.235 ms
root@Y76-K8s-Master01:~# telnet 172.164.17.100 7890
Trying 172.164.17.100...
Connected to 172.164.17.100.
Escape character is '^]'.

 虚拟机能正常访问到宿主机端口，接下来在虚拟机系统内配置Proxy

root@Y76-K8s-Master01:/usr/lib/systemd/system# pwd
/usr/lib/systemd/system
root@Y76-K8s-Master01:/usr/lib/systemd/system# vim docker.service 
# 在[Service]处添加以下两行信息，将流量代理给宿主机的7890端口出外网
Environment="HTTPS_PROXY=http://172.164.17.100:7890"
Environment="HTTP_PROXY=http://172.164.17.100:7890"

root@Y76-K8s-Master01:/usr/lib/systemd/system# systemctl daemon-reload 
root@Y76-K8s-Master01:/usr/lib/systemd/system# systemctl restart docker 
root@Y76-K8s-Master01:/usr/lib/systemd/system# time docker pull nginx 
Using default tag: latest
latest: Pulling from library/nginx
ea235d1ccf77: Pull complete 
e29cef106877: Pull complete 
e9bf20d5335e: Pull complete 
1394e86b8f58: Pull complete 
7b2b3e0f512f: Pull complete 
6a11b5a77155: Pull complete 
fb6d6e4aad9c: Pull complete 
Digest: sha256:67682bda769fae1ccf5183192b8daf37b64cae99c6c3302650f6f8bf5f0f95df
Status: Downloaded newer image for nginx:latest
docker.io/library/nginx:latest

real    0m7.408s
user    0m0.028s
sys     0m0.014s

 到这里就可以完成让docker通过宿主机的7890端口出外网拉取镜像了，此种方法适用于K8S中使用Containerd去拉取镜像，但需注意的是，在Containerd中配置代理，可能会导致Pod无法正常进行健康检查，例如 就绪探针下的配置是访问某个IP得到返回值来判断健康检查是否能正常通过。原因在于，配置了Proxy转发后，访问是通过宿主机的7890端口去进行寻址的，而宿主机开启了此端口，意味着从7890端口出去的流量是直接面向internet的。

解决方法：在Containerd下进行地址排除，过滤掉K8S中的网段不通过宿主机的7890端口作为出口地址

# 在Containerd.service下的[Service]配置以下内容
Environment="HTTPS_PROXY=http://172.164.17.100:7890"
Environment="HTTP_PROXY=http://172.164.17.100:7890"
Environment="NO_PROXY=localhost,127.0.0.1,172.16.0.0/12,10.96.0.0/12,10.244.0.0/16"