Kubernetes在initContainer和Container中使用相同的volumeMount

Question

我正在尝试在我的容器之一中以非 root 用户身份安装一个卷。我正在尝试使用 initContainer 中的方法来设置正确的用户，但是当我尝试启动配置时，我收到“未绑定的立即 PersistedVolumneClaims”错误。我怀疑这是因为该卷安装在我的 initContainer 和容器中，但我不确定为什么会出现问题：我可以看到 initContainer 接受声明，但我本以为它退出时会释放它，让普通容器接受索赔。有什么想法或替代方案可以以非 root 用户身份安装目录吗？我确实尝试使用 securityContext/fsGroup，但这似乎没有效果。下面的 /var/rdf4j 目录是作为 root 挂载的目录。

配置：

apiVersion: v1
kind: PersistentVolume
metadata:
  name: triplestore-data-storage-dir
  labels:
    type: local
spec:
  capacity:
    storage: 10Gi
  accessModes:
    - ReadWriteMany
  storageClassName: local-storage
  volumeMode: Filesystem
  persistentVolumeReclaimPolicy: Delete
  hostPath:
    path: /run/desktop/mnt/host/d/workdir/k8s-data/triplestore
    type: DirectoryOrCreate
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: triplestore-data-storage
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  storageClassName: local-storage
  volumeName: "triplestore-data-storage-dir"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: triplestore
  labels:
    app: demo
    role: triplestore
spec:
  selector:
    matchLabels:
      app: demo
      role: triplestore
  replicas: 1
  template:
    metadata:
      labels:
        app: demo
        role: triplestore
    spec:
      containers:
        - name: triplestore
          image: eclipse/rdf4j-workbench:amd64-3.5.0
          imagePullPolicy: Always
          ports:
            - name: http
              protocol: TCP
              containerPort: 8080
          resources:
            requests:
              cpu: 100m
              memory: 200Mi
          volumeMounts:
            - name: storage
              mountPath: /var/rdf4j
      initContainers:
        - name: take-data-dir-ownership
          image: eclipse/rdf4j-workbench:amd64-3.5.0
          command:
            - chown
            - -R
            - 100:65533
            - /var/rdf4j
          volumeMounts:
            - name: storage
              mountPath: /var/rdf4j
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: "triplestore-data-storage"

kubectl 获取 PVC

NAME                       STATUS   VOLUME                         CAPACITY   ACCESS MODES   STORAGECLASS    AGE
triplestore-data-storage   Bound    triplestore-data-storage-dir   10Gi       RWX            local-storage   13s

kubectl 获取光伏

NAME                           CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                              STORAGECLASS    REASON   AGE
triplestore-data-storage-dir   10Gi       RWX            Delete           Bound    default/triplestore-data-storage   local-storage            17s

kubectl 获取事件

LAST SEEN   TYPE      REASON              OBJECT                             MESSAGE
21s         Warning   FailedScheduling    pod/triplestore-6d6876f49-2s84c    0/1 nodes are available: 1 pod has unbound immediate PersistentVolumeClaims.
19s         Normal    Scheduled           pod/triplestore-6d6876f49-2s84c    Successfully assigned default/triplestore-6d6876f49-2s84c to docker-desktop
3s          Normal    Pulled              pod/triplestore-6d6876f49-2s84c    Container image "eclipse/rdf4j-workbench:amd64-3.5.0" already present on machine
3s          Normal    Created             pod/triplestore-6d6876f49-2s84c    Created container take-data-dir-ownership
3s          Normal    Started             pod/triplestore-6d6876f49-2s84c    Started container take-data-dir-ownership
2s          Warning   BackOff             pod/triplestore-6d6876f49-2s84c    Back-off restarting failed container
46m         Normal    Pulled              pod/triplestore-6d6876f49-9n5kt    Container image "eclipse/rdf4j-workbench:amd64-3.5.0" already present on machine
79s         Warning   BackOff             pod/triplestore-6d6876f49-9n5kt    Back-off restarting failed container
21s         Normal    SuccessfulCreate    replicaset/triplestore-6d6876f49   Created pod: triplestore-6d6876f49-2s84c
21s         Normal    ScalingReplicaSet   deployment/triplestore             Scaled up replica set triplestore-6d6876f49 to 1

kubectl 描述 pods/triplestore-6d6876f49-tw8r8

Name:         triplestore-6d6876f49-tw8r8
Namespace:    default
Priority:     0
Node:         docker-desktop/192.168.65.4
Start Time:   Mon, 17 Jan 2022 10:17:20 -0500
Labels:       app=demo
              pod-template-hash=6d6876f49
              role=triplestore
Annotations:  <none>
Status:       Pending
IP:           10.1.2.133
IPs:
  IP:           10.1.2.133
Controlled By:  ReplicaSet/triplestore-6d6876f49
Init Containers:
  take-data-dir-ownership:
    Container ID:  docker://89e7b1e3ae76c30180ee5083624e1bf5f30b55fd95bf1c24422fabe41ae74408
    Image:         eclipse/rdf4j-workbench:amd64-3.5.0
    Image ID:      docker-pullable://registry.com/publicrepos/docker_cache/eclipse/rdf4j-workbench@sha256:14621ad610b0d0269dedd9939ea535348cc6c147f9bd47ba2039488b456118ed
    Port:          <none>
    Host Port:     <none>
    Command:
      chown
      -R
      100:65533
      /var/rdf4j
    State:          Waiting
      Reason:       CrashLoopBackOff
    Last State:     Terminated
      Reason:       Error
      Exit Code:    1
      Started:      Mon, 17 Jan 2022 10:22:59 -0500
      Finished:     Mon, 17 Jan 2022 10:22:59 -0500
    Ready:          False
    Restart Count:  6
    Environment:    <none>
    Mounts:
      /var/rdf4j from storage (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-s8wdv (ro)
Containers:
  triplestore:
    Container ID:
    Image:          eclipse/rdf4j-workbench:amd64-3.5.0
    Image ID:
    Port:           8080/TCP
    Host Port:      0/TCP
    State:          Waiting
      Reason:       PodInitializing
    Ready:          False
    Restart Count:  0
    Requests:
      cpu:        100m
      memory:     200Mi
    Environment:  <none>
    Mounts:
      /var/rdf4j from storage (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-s8wdv (ro)
Conditions:
  Type              Status
  Initialized       False
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  storage:
    Type:       PersistentVolumeClaim (a reference to a PersistentVolumeClaim in the same namespace)
    ClaimName:  triplestore-data-storage
    ReadOnly:   false
  kube-api-access-s8wdv:
    Type:                    Projected (a volume that contains injected data from multiple sources)
    TokenExpirationSeconds:  3607
    ConfigMapName:           kube-root-ca.crt
    ConfigMapOptional:       <nil>
    DownwardAPI:             true
QoS Class:                   Burstable
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason            Age                    From               Message
  ----     ------            ----                   ----               -------
  Warning  FailedScheduling  6m24s                  default-scheduler  0/1 nodes are available: 1 pod has unbound immediate PersistentVolumeClaims.
  Normal   Scheduled         6m13s                  default-scheduler  Successfully assigned default/triplestore-6d6876f49-tw8r8 to docker-desktop
  Normal   Pulled            4m42s (x5 over 6m12s)  kubelet            Container image "eclipse/rdf4j-workbench:amd64-3.5.0" already present on machine
  Normal   Created           4m42s (x5 over 6m12s)  kubelet            Created container take-data-dir-ownership
  Normal   Started           4m42s (x5 over 6m12s)  kubelet            Started container take-data-dir-ownership
  Warning  BackOff           70s (x26 over 6m10s)   kubelet            Back-off restarting failed container

解决方案

事实证明，问题在于 initContainer 没有以 root 身份运行，而是以容器的默认用户身份运行，因此没有运行该chown命令的权限。在链接的 SO 评论中，这是对答案的第一个评论，响应是 initContainer 以 root 身份运行 - 这显然在较新版本的 kubernetes 中发生了变化。不过，有一个解决方案，您可以将securityContext容器设置为以 root 身份运行，授予其运行chown命令的权限，并成功允许以非 root 用户身份挂载卷。这是 initContainer 的最终配置。

initContainers:
  - name: take-data-dir-ownership
    image: eclipse/rdf4j-workbench:amd64-3.5.0
    securityContext:
      runAsUser: 0
    command:
      - chown
      - -R
      - 100:65533
      - /var/rdf4j
    volumeMounts:
      - name: storage
        mountPath: /var/rdf4j

Answer 1

1 pod has unbound immediate PersistentVolumeClaims.- 此错误意味着 pod 无法绑定到其计划运行的节点上的 PVC。当 PVC 绑定到的 PV 引用的位置在 pod 计划运行的节点上无效时，就会发生这种情况。kubectl get nodes -o wide如果您可以将, kubectl describe pvc triplestore-data-storage,的完整输出发布kubectl describe pv triplestore-data-storage-dir到问题中，将会很有帮助。

同时使用时PVC/PV是可选的hostPath，您可以尝试一下下面的规范，看看pod是否可以上线：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: triplestore
  labels:
    app: demo
    role: triplestore
spec:
  selector:
    matchLabels:
      app: demo
      role: triplestore
  replicas: 1
  template:
    metadata:
      labels:
        app: demo
        role: triplestore
    spec:
      containers:
      - name: triplestore
        image: eclipse/rdf4j-workbench:amd64-3.5.0
        imagePullPolicy: IfNotPresent
        ports:
        - name: http
          protocol: TCP
          containerPort: 8080
        resources:
          requests:
            cpu: 100m
            memory: 200Mi
        volumeMounts:
        - name: storage
          mountPath: /var/rdf4j
      initContainers:
      - name: take-data-dir-ownership
        image: eclipse/rdf4j-workbench:amd64-3.5.0
        imagePullPolicy: IfNotPresent
        securityContext:
          runAsUser: 0
        command:
          - chown
          - -R
          - 100:65533
          - /var/rdf4j
        volumeMounts:
          - name: storage
            mountPath: /var/rdf4j
      volumes:
        - name: storage
          hostPath:
            path: /run/desktop/mnt/host/d/workdir/k8s-data/triplestore
            type: DirectoryOrCreate