Using OpenKruise to Pull Images in Advance

The time required for starting a container on a node is greatly affected by the image pull speed. In scenarios where applications need to be quickly started, long-time image pulling will slow down container startup. To speed up container startup, you can pull images to the nodes in advance. When a container is started, the pre-pulled images on the nodes can be used directly.

You can deploy the OpenKruise add-on in the cluster and leverage its image pre-pulling capability. To do so, you need to create an ImagePullJob or ImageListPullJob in the cluster to automatically pre-pull specified images to the nodes. ImagePullJob and ImageListPullJob are CRDs provided by Kruise. Kruise automatically creates a NodeImage for each node to record the images to be pre-pulled to the node. You can create an ImagePullJob to specify the node to which an image is to be pulled in advance.

Prerequisites

A CCE cluster has been created, and the OpenKruise add-on has been installed. For details, see OpenKruise.
kubeconfig has been configured on the CCE cluster nodes. For details, see Accessing a Cluster Using kubectl.

Procedure

Step 1: Pre-pull Images

Select either of the following methods as needed:

Pre-pull a single image: ImagePullJob
Pre-pull multiple images: ImageListPullJob

An ImagePullJob can pre-pull a single image to a specified node.

Create the image-pull.yaml file and add the following information into it:

apiVersion: apps.kruise.io/v1beta1
kind: ImagePullJob
metadata:
  name: image-pull-demo
  namespace: default
spec:
  image: nginx:1.9.1   # [Required] Image name in the format of name:tag
  parallelism: 10      # [Optional] Maximum number of nodes to which images can be concurrently pulled. The default value is 1.
  selector:            # [Optional] List of node names or label selector (only one of them can be set)
    names:
      - node-1
      - node-2
    matchLabels:
      node-type: xxx
# podSelector:        # [Optional] podSelector is used to match pods and pull images to the nodes where these pods are running. This parameter cannot be set together with selector.
#   matchLabels:
#     pod-label: xxx
#   matchExpressions:
#   - key: pod-label
#     operator: In
#     values:
#       - xxx
  completionPolicy:
    type: Always                  # [Optional] The default value is Always.
    activeDeadlineSeconds: 1200   # [Optional] There is no default value. This parameter is only valid when type is set to Always.
    ttlSecondsAfterFinished: 300  # [Optional] There is no default value. This parameter is only valid when type is set to Always.
  pullPolicy:                    # [Optional] The default value is backoffLimit=3, timeoutSeconds=600.
    backoffLimit: 3
    timeoutSeconds: 300

The involved parameters are described in the table below.

Parameter	Description
image	(Required) Complete image name in the format of name:tag.
parallelism	Maximum number of nodes to which images can be concurrently pulled. The default value is 1.
selector	Name or label of a specified node. The two modes cannot be used at the same time. If selector is not specified, all nodes are selected.
selector.names	List of node names. This parameter and matchLabels do not take effect at the same time.
selector.matchLabels	Node label. You can enter multiple labels, which must all be matched.
selector.podSelector	This parameter pre-pulls images to the matched node where the pods are running. It cannot be configured together with selector.
completionPolicy	Image pre-pulling solution.
completionPolicy.type	Image pre-pulling policy. The options are as follows: Always: No matter whether the image is successfully pulled, the job ends. Never: The image is pre-pulled again on the matched node every day.
completionPolicy.activeDeadlineSeconds	Timeout duration of the image pulling job. This parameter is valid only when type is set to Always. After the timeout duration expires, the job is forcibly terminated.
completionPolicy.ttlSecondsAfterFinished	Time when the ImagePullJob is automatically deleted after the job is complete. This parameter is valid only when type is set to Always.
pullPolicy	Image pulling policy.
pullPolicy.backoffLimit	Number of retries after an image pulling failure. The default value is 3.
pullPolicy.timeoutSeconds	Timeout duration for a single pull, in seconds. The default value is 600.

(Optional) Configure the image pulling secret only when the image is a private image. Configure the pullSecrets parameter under spec.
```
spec:
  pullSecrets:
    - secret-name1
    - secret-name2
```
ImagePullJobs are namespace-level resources. You need to create the resources in the namespace where the image pulling secret is located.

(Optional) Configure the image pulling policy.

spec:
  imagePullPolicy: Always

Policy	Description
Always	The system always attempts to pull an image from the image repository regardless of whether an image with the same name exists on the node.
IfNotPresent	The image is pulled only when it does not exist on the local node.

Deploy resources.
```
kubectl apply -f image-pull.yaml
```

An ImageListPullJob can pre-pull multiple images to a specified node. The parameters are basically the same as those of an ImagePullJob.

Create the image-list-pull.yaml file and add the following information into it:

apiVersion: apps.kruise.io/v1beta1
kind: ImageListPullJob
metadata:
  name: image-list-pull-demo
  namespace: default
spec:
  images:
  - nginx:1.9.1    # [Required] Image name list
  - busybox:1.29.2
  parallelism: 10      # [Optional] Maximum number of nodes to which images can be concurrently pulled. The default value is 1.
  selector:            # [Optional] List of node names or label selector (only one of them can be set)
    names:
    - node-1
    - node-2
    matchLabels:
      node-type: xxx
# podSelector:        # [Optional] podSelector is used to match pods and pull images to the nodes where these pods are running. This parameter cannot be set together with selector.
#   matchLabels:
#     pod-label: xxx
#   matchExpressions:
#   - key: pod-label
#     operator: In
#     values:
#       - xxx
  completionPolicy:
    type: Always                  # [Optional] The default value is Always.
    activeDeadlineSeconds: 1200   # [Optional] There is no default value. This parameter is only valid when type is set to Always.
    ttlSecondsAfterFinished: 300  # [Optional] There is no default value. This parameter is only valid when type is set to Always.
  pullPolicy:                    # [Optional] The default value is backoffLimit=3, timeoutSeconds=600.
    backoffLimit: 3
    timeoutSeconds: 300

The involved parameters are described in the table below.

Parameter	Description
images	(Required) List of image name in the format of name:tag.
parallelism	Maximum number of nodes to which images can be concurrently pulled. The default value is 1.
selector	Name or label of a specified node. The two modes cannot be used at the same time. If selector is not specified, all nodes are selected.
selector.names	List of node names. This parameter and matchLabels do not take effect at the same time.
selector.matchLabels	Node label. You can enter multiple labels, which must all be matched.
selector.podSelector	This parameter pre-pulls images to the matched node where the pods are running. It cannot be configured together with selector.
completionPolicy	Image pre-pulling solution.
completionPolicy.type	Image pre-pulling policy. The value can be Always or Never. Always: No matter whether the image is successfully pulled, the job ends. Never: The image is pre-pulled again on the matched node every day.
completionPolicy.activeDeadlineSeconds	Timeout duration of the image pulling job. This parameter is valid only when type is set to Always. After the timeout duration expires, the job is forcibly terminated.
completionPolicy.ttlSecondsAfterFinished	Time when the ImagePullJob is automatically deleted after the job is complete. This parameter is valid only when type is set to Always.
pullPolicy	Image pulling policy.
pullPolicy.backoffLimit	Number of retries after an image pulling failure. The default value is 3.
pullPolicy.timeoutSeconds	Timeout duration for a single pull, in seconds. The default value is 600.

(Optional) Configure the image pulling secret only when the image is a private image. Configure the pullSecrets parameter under spec.
```
spec:
  pullSecrets:
    - secret-name1
    - secret-name2
```
ImageListPullJobs are namespace-level resources. You need to create the resources in the namespace where the image pulling secret is located.

(Optional) Configure the image pulling policy.

spec:
  imagePullPolicy: Always

Policy	Description
Always	The system always attempts to pull an image from the image repository regardless of whether an image with the same name exists on the node.
IfNotPresent	The image is pulled only when it does not exist on the local node.

Deploy resources.
```
kubectl apply -f image-list-pull.yaml
```

Step 2: View Image Pre-pulling

View the image pre-pulling job.

kubectl get imagepulljob

Information similar to the following is displayed:

NAME              TOTAL   ACTIVE   SUCCEED   FAILED   AGE     MESSAGE
image-pull-demo   4       0        4         0        9m49s   job has completed

View details about the image pre-pulling job. In the status field, you can see how many images are successfully pulled or failed to be pulled. If any image failed to be pulled, you can also see the corresponding node in the status field.
```
kubectl get imagepulljob image-pull-demo -o yaml
```
View details about the image pre-pulling failure through the NodeImage resource.
```
kubectl get nodeimage <node-name> -o yaml
```

Parent Topic: Container

Previous topic: Containerizing and Using QingTian Enclave on CCE

Next topic: Permission

Using OpenKruise to Pull Images in Advance

Prerequisites

Procedure

Step 1: Pre-pull Images

Step 2: View Image Pre-pulling

What is your overall rating for this page?