Question

我正在尝试迁移到Cloud SQL（Postgres）。我在Kubernetes中进行了以下部署，遵循了这些说明https://cloud.google.com/sql/docs/mysql/connect-container-engine：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: menu-service
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: menu-service
    spec:
      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials
        - name: cloudsql
          emptyDir:
        - name: ssl-certs
          hostPath:
            path: /etc/ssl/certs
      containers:
      - image: gcr.io/cloudsql-docker/gce-proxy:1.11
        name: cloudsql-proxy
        command: ["/cloud_sql_proxy", "--dir=/cloudsql",
                  "-instances=tabb-168314:europe-west2:production=tcp:5432",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        volumeMounts:
          - name: cloudsql-instance-credentials
            mountPath: /secrets/cloudsql
            readOnly: true
          - name: ssl-certs
            mountPath: /etc/ssl/certs
          - name: cloudsql
            mountPath: /cloudsql
      - name: menu-service
        image: eu.gcr.io/tabb-168314/menu-service:develop
        imagePullPolicy: Always
        env:
        - name: MICRO_BROKER
          value: "nats"
        - name: MICRO_BROKER_ADDRESS
          value: "nats.staging:4222"
        - name: MICRO_REGISTRY
          value: "kubernetes"
        - name: ENV
          value: "staging"
        - name: PORT
          value: "8080"
        - name: POSTGRES_HOST
          value: "127.0.0.1:5432"
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: username
        - name: POSTGRES_PASS
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: password
        - name: POSTGRES_DB
          value: "menus"
        ports:
        - containerPort: 8080

但不幸的是，我在尝试更新部署时遇到此错误：

MountVolume.SetUp failed for volume "kubernetes.io/secret/69b0ec99-baaf-11e7-82b8-42010a84010c-cloudsql-instance-credentials" (spec.Name: "cloudsql-instance-credentials") pod "69b0ec99-baaf-11e7-82b8-42010a84010c" (UID: "69b0ec99-baaf-11e7-82b8-42010a84010c") with: secrets "cloudsql-instance-credentials" not found
Error syncing pod, skipping: timeout expired waiting for volumes to attach/mount for pod "staging"/"menu-service-1982520680-qzwzn". list of unattached/unmounted volumes=[cloudsql-instance-credentials]

我错过了什么吗？

Answer 1

你缺少（至少）启动这个Pod所需的一个秘密，即cloudsql-instance-credentials。

来自https://cloud.google.com/sql/docs/mysql/connect-container-engine：

您需要两个秘密才能使Container Engine应用程序访问Cloud SQL实例中的数据：


cloudsql-instance-credentials机密包含服务帐户。

cloudsql-db-credentials机密提供代理用户帐户和密码。（我认为你创建了这个，我无法看到关于这个的错误信息）


创建秘密：

创建包含服务帐户的密码，该帐户启用对Cloud SQL的身份验证：
kubectl create secret generic cloudsql-instance-credentials \
                   --from-file=credentials.json=[PROXY_KEY_FILE_PATH]
[...]

上面的链接还介绍了如果您没有创建GCP服务帐户，如何为此目的创建GCP服务帐户。

将Cloud SQL凭据安装到Kubernetes中的容器

1 个答案: