用k8s创建完pod后，发现无法访问demo应用，查了一下pods状态，发现都在containercreationg状态中。

[root@localhost ca]# kubectl get pods
NAME                                    READY     STATUS              RESTARTS   AGE
mysql-1kr8z   0/1       ContainerCreating   0          10m

通过查看日志/var/log/message

Nov  4 10:06:30 localhost kubelet: E1104 10:06:30.038630    4071 docker_manager.go:2159] Failed to create pod infra container: ErrImagePull; Skipping pod "mysql-1kr8z_default(0a9219c7-dfd6-11e8-86a6-000c29c038c1)": image pull failed for registry.access.redhat.com/rhel7/pod-infrastructure:latest, this may be because there are no credentials on this request.  details: (open /etc/docker/certs.d/registry.access.redhat.com/redhat-ca.crt: no such file or directory)
 

从日志中可以看出拉取registry.access.redhat.com/rhel7/pod-infrastructure:latest镜像的时候出错了.因为在/etc/rhsm/ca没有找到证书.

解决办法是:手动安装证书.执行以下两条命令.

wget http://mirror.centos.org/centos/7/os/x86_64/Packages/python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm

rpm2cpio python-rhsm-certificates-1.19.10-1.el7_4.x86_64.rpm | cpio -iv --to-stdout ./etc/rhsm/ca/redhat-uep.pem | tee /etc/rhsm/ca/redhat-uep.pem

然后会发现证书已经生成.

手动拉取镜像:docker pull registry.access.redhat.com/rhel7/pod-infrastructure:latest

kubectl get pods会发现pod状态已经已经变成running.