我在Kubernetes的POD上运行了一个应用程序。 我想将一些输出文件日志存储在持久存储卷上。
为了做到这一点,我在NFS上创建了一个卷,并通过相关的卷声明将其绑定到POD。 当我尝试编写或加入共享文件夹时,我收到了“权限被拒绝”消息,因为NFS显然是只读的。
以下是我用来创建卷的json文件:
{
"kind": "PersistentVolume",
"apiVersion": "v1",
"metadata": {
"name": "task-pv-test"
},
"spec": {
"capacity": {
"storage": "10Gi"
},
"nfs": {
"server": <IPAddress>,
"path": "/export"
},
"accessModes": [
"ReadWriteMany"
],
"persistentVolumeReclaimPolicy": "Delete",
"storageClassName": "standard"
}
}
以下是POD配置文件
kind: Pod
apiVersion: v1
metadata:
name: volume-test
spec:
volumes:
- name: task-pv-test-storage
persistentVolumeClaim:
claimName: task-pv-test-claim
containers:
- name: volume-test
image: <ImageName>
volumeMounts:
- mountPath: /home
name: task-pv-test-storage
readOnly: false
有没有办法更改权限?
更新
以下是PVC和NFS配置:
PVC:
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
name: task-pv-test-claim
spec:
storageClassName: standard
accessModes:
- ReadWriteMany
resources:
requests:
storage: 3Gi
NFS CONFIG
{
"kind": "Pod",
"apiVersion": "v1",
"metadata": {
"name": "nfs-client-provisioner-557b575fbc-hkzfp",
"generateName": "nfs-client-provisioner-557b575fbc-",
"namespace": "default",
"selfLink": "/api/v1/namespaces/default/pods/nfs-client-provisioner-557b575fbc-hkzfp",
"uid": "918b1220-423a-11e8-8c62-8aaf7effe4a0",
"resourceVersion": "27228",
"creationTimestamp": "2018-04-17T12:26:35Z",
"labels": {
"app": "nfs-client-provisioner",
"pod-template-hash": "1136131967"
},
"ownerReferences": [
{
"apiVersion": "extensions/v1beta1",
"kind": "ReplicaSet",
"name": "nfs-client-provisioner-557b575fbc",
"uid": "3239b14a-4222-11e8-8c62-8aaf7effe4a0",
"controller": true,
"blockOwnerDeletion": true
}
]
},
"spec": {
"volumes": [
{
"name": "nfs-client-root",
"nfs": {
"server": <IPAddress>,
"path": "/Kubernetes"
}
},
{
"name": "nfs-client-provisioner-token-fdd2c",
"secret": {
"secretName": "nfs-client-provisioner-token-fdd2c",
"defaultMode": 420
}
}
],
"containers": [
{
"name": "nfs-client-provisioner",
"image": "quay.io/external_storage/nfs-client-provisioner:latest",
"env": [
{
"name": "PROVISIONER_NAME",
"value": "<IPAddress>/Kubernetes"
},
{
"name": "NFS_SERVER",
"value": <IPAddress>
},
{
"name": "NFS_PATH",
"value": "/Kubernetes"
}
],
"resources": {},
"volumeMounts": [
{
"name": "nfs-client-root",
"mountPath": "/persistentvolumes"
},
{
"name": "nfs-client-provisioner-token-fdd2c",
"readOnly": true,
"mountPath": "/var/run/secrets/kubernetes.io/serviceaccount"
}
],
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "Always"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 30,
"dnsPolicy": "ClusterFirst",
"serviceAccountName": "nfs-client-provisioner",
"serviceAccount": "nfs-client-provisioner",
"nodeName": "det-vkube-s02",
"securityContext": {},
"schedulerName": "default-scheduler",
"tolerations": [
{
"key": "node.kubernetes.io/not-ready",
"operator": "Exists",
"effect": "NoExecute",
"tolerationSeconds": 300
},
{
"key": "node.kubernetes.io/unreachable",
"operator": "Exists",
"effect": "NoExecute",
"tolerationSeconds": 300
}
]
},
"status": {
"phase": "Running",
"hostIP": <IPAddress>,
"podIP": "<IPAddress>,
"startTime": "2018-04-17T12:26:35Z",
"qosClass": "BestEffort"
}
}
我刚从nfs配置中删除了一些状态信息以缩短
答案 0 :(得分:4)
感谢白栋天的tip。 例如,如果pod securityContext设置为:
securityContext:
runAsUser: 1000
fsGroup: 1000
您将SSH到NFS主机并运行
chown 1000:1000 -R /some/nfs/path
如果您不知道user:group或许多吊舱会挂载它,则可以运行
chmod 777 -R /some/nfs/path
答案 1 :(得分:3)
如果为pod配置设置了正确的securityContext
,则可以确保以适当的权限挂载卷。
示例:
apiVersion: v1
kind: Pod
metadata:
name: demo
spec:
securityContext:
fsGroup: 2000
volumes:
- name: task-pv-test-storage
persistentVolumeClaim:
claimName: task-pv-test-claim
containers:
- name: demo
image: example-image
volumeMounts:
- name: task-pv-test-storage
mountPath: /data/demo
在上面的例子中,存储将安装在/data/demo
的2000组ID,由fsGroup
设置。您需要找出您正在使用的用户的组ID。为此,运行容器并键入id
并查找gid
。
要运行容器并获取id
类型的结果:docker run --rm -it example-image id
您可以在此处详细了解pod安全上下文:https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
答案 2 :(得分:0)
一种简单的方法是访问nfs存储,chmod 777,或者在卷测试容器中使用用户ID进行chown
答案 3 :(得分:0)
我对你如何完成任务感到有点困惑,无论如何,如果我理解你正确地尝试这个例子:
volumeClaimTemplates:
- metadata:
name: data
namespace: kube-system
labels:
k8s-app: something
monitoring: something
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi
然后也许init容器会做一些事情:
initContainers:
- name: prometheus-init
image: /something/bash-alpine:1.5
command:
- chown
- -R
- 65534:65534
- /data
volumeMounts:
- name: data
mountPath: /data
或者是您错过的volumeMounts:
volumeMounts:
- name: config-volume
mountPath: /etc/config
- name: data
mountPath: /data
我的最后一条评论是注意容器,我认为你只能在/tmp
写一下,还是仅仅用于CoreOS?我不得不这样看。
答案 4 :(得分:-1)
您是否检查了目录的权限?确保所有人都可以使用读取权限。