Question

我们有以下部署yaml：

---
apiVersion: apps/v1beta2
kind: Deployment
metadata:
  name: {{DEP_ENVIRONMENT}}-{{SERVICE_NAME}}
  namespace: {{DEP_ENVIRONMENT}}
  labels:
    app: {{DEP_ENVIRONMENT}}-{{SERVICE_NAME}}
spec:
  replicas: {{NUM_REPLICAS}}
  selector:
    matchLabels:
      app: {{DEP_ENVIRONMENT}}-{{SERVICE_NAME}}
  template:
    metadata:
      labels:
        app: {{DEP_ENVIRONMENT}}-{{SERVICE_NAME}}
    spec:
      # [START volumes]
      volumes:
        - name: {{CLOUD_DB_INSTANCE_CREDENTIALS}}
          secret:
            secretName: {{CLOUD_DB_INSTANCE_CREDENTIALS}}
      # [END volumes]
      containers:
      # [START proxy_container]
      - name: cloudsql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.11
        command: ["/cloud_sql_proxy",
                  "-instances=<PROJECT_ID>:{{CLOUD_DB_CONN_INSTANCE}}=tcp:3306",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        # [START cloudsql_security_context]
        securityContext:
          runAsUser: 2  # non-root user
          allowPrivilegeEscalation: false
        # [END cloudsql_security_context]
        volumeMounts:
          - name: {{CLOUD_DB_INSTANCE_CREDENTIALS}}
            mountPath: /secrets/cloudsql
            readOnly: true
      # [END proxy_container]
      - name: {{DEP_ENVIRONMENT}}-{{SERVICE_NAME}}
        image: {{IMAGE_NAME}}
        ports:
        - containerPort: 80
        env:
        - name: CLOUD_DB_HOST
          value: 127.0.0.1
        - name: DEV_CLOUD_DB_USER
          valueFrom:
            secretKeyRef:
              name: {{CLOUD_DB_DB_CREDENTIALS}}
              key: username
        - name: DEV_CLOUD_DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: {{CLOUD_DB_DB_CREDENTIALS}}
              key: password
      # [END cloudsql_secrets]
        lifecycle:
          postStart:
            exec:
              command: ["/bin/sh", "-c", "supervisord"]

最后一个lifecycle块是新的，导致数据库连接被拒绝。没有lifecycle块，此配置可以正常工作。我确定这里有些愚蠢的东西我想念了，但是我一生无法弄清它到底是什么。

注意：我们仅尝试像这样启动Supervisor，以解决在尝试正常启动Supervisor时遇到的巨大问题。

Answer 1

生命周期挂钩旨在用作简短的前台命令。您无法从它们启动后台守护程序，该后台守护程序必须是容器的主要command。

Kubernetes postStart似乎破坏了部署中的所有内容

1 个答案: