Question

elasticsearch docker image出现Failed to created node environment错误：

[unknown] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Failed to create node environment

elasticsearch数据的持久量为/mnt/volume/elasticsearch-data。

我可以通过ssh进入远程计算机并运行chown 1000:1000 /mnt/volume/elasticsearch-data来解决此问题。但我不想手动进行。如何使用deployment.yaml文件解决此特权问题？

我已经了解到，在fsGroup: 1000中使用securityContext应该可以解决问题，但这对我不起作用。

deployment.yaml：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]

storage.yaml：

kind: PersistentVolume
apiVersion: v1
metadata:
  name: elasticsearch-pv-volume
  labels:
    type: local
    app: elasticsearch
spec:
  storageClassName: manual
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/volume/elasticsearch-data"
  persistentVolumeReclaimPolicy: Delete

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: elasticsearch-pv-claim
  labels:
    app: elasticsearch
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

Answer 1

open bug上似乎有关于hostPath卷权限的信息。要变通解决此问题，您应该创建一个initContainer，最初设置适当的权限：

piVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      initContainers:
        - name: set-permissions
          image: registry.hub.docker.com/library/busybox:latest
          command: ['sh', '-c', 'mkdir -p /usr/share/elasticsearch/data && chown 1000:1000 /usr/share/elasticsearch/data' ]
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]

通过设置fsGroup使您走上正确的轨道，但是当前正在做的是将 user 设置为1000并安装具有访问权限的卷组 1000。您应该更改的是使用runAsGroup: 1000而不是runAsUser: 1000。

如何在Kubernetes中的elasticsearch数据目录上执行chown 1000：1000

1 个答案: