docker - 容器中的 Kubernetes 权限被拒绝

Question

我的公司购买了一个我们尝试在 IBM 云上部署的软件，使用 kubernetes 并提供了私有(private) docker 存储库。部署后，总是会出现 Kubernetes 错误:“Back-off restarting failed container”。因此，我阅读了日志以了解容器重新启动的原因，这是错误:

Caused by: java.io.FileNotFoundException: /var/yseop-log/yseop-manager.log (Permission denied)

所以我推断我只需要更改 Kubernetes 文件中的权限。由于我使用的是部署，因此我尝试了以下 initContainer :

initContainers:
    - name: permission-fix
      image: busybox
      command: ['sh', '-c']
      args: ['chmod -R 777 /var']
      volumeMounts:
        - mountPath: /var/yseop-engine
          name: yseop-data
        - mountPath: /var/yseop-data/yseop-manager
          name: yseop-data
        - mountPath: /var/yseop-log
          name: yseop-data

这不起作用，因为我不允许以非 root 用户身份在只读文件夹上执行 chmod。
所以我尝试重新安装这些卷，但这也失败了，因为我不是 root 用户。
然后我发现以用户和组身份运行。为了找出我必须在我的安全上下文中写入的用户和组，我阅读了 dockerfile，这里是用户和组:

 USER 1001:0

所以我坚持我可以在我的部署文件中写这个:

  securityContext: 
      runAsUser: 1001  
      rusAsGroup: 0

显然，这也不起作用，因为我不允许作为第 0 组运行
所以我仍然不知道该怎么做才能正确部署这个图像。在 m 计算机上执行 docker pull 和 exec 时，该镜像可以正常工作，但不能在 Kubernetes 上工作。
这是我完整的卷文件:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    ibm.io/auto-create-bucket: "true"
    ibm.io/auto-delete-bucket: "false"
    ibm.io/bucket: ""
    ibm.io/secret-name: "cos-write-access"
    ibm.io/endpoint: https://s3.eu-de.cloud-object-storage.appdomain.cloud
  name: yseop-pvc
  namespace: ns
  labels:
    app: yseop-pvc
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  storageClassName: ibmc
  volumeMode: Filesystem 

这是我的完整部署文件:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: yseop-manager
  namespace: ns
spec:
  selector:
    matchLabels:
      app: yseop-manager
  template:
    metadata:
      labels:
        app: yseop-manager
    spec:
      securityContext: 
          runAsUser: 1001  
          rusAsGroup: 0
      initContainers:
        - name: permission-fix
          image: busybox
          command: ['sh', '-c']
          args: ['chmod -R 777 /var']
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      containers:
        - name: yseop-manager
          image:IMAGE
          imagePullPolicy: IfNotPresent
          env:
            - name: SECURITY_USERS_DEFAULT_ENABLED
              value: "true"
          ports:
            - containerPort: 8080
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: yseop-data
          persistentVolumeClaim:
            claimName: yseop-pvc

感谢您的帮助

Answer 1

您能否尝试在安全上下文中包含补充组 ID，例如

SecurityContext:
   runAsUser: 1001  
   fsGroup: 2000

默认 runAsGroup 为 0，即 root .下面的链接可能会对此提供更多见解。
https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
工作 Yaml 内容

apiVersion: apps/v1
kind: Deployment
metadata:
  name: yseop-manager
  namespace: ns
spec:
  selector:
    matchLabels:
      app: yseop-manager
  template:
    metadata:
      labels:
        app: yseop-manager
    spec:
      securityContext: 
          fsGroup: 2000 
      initContainers:
        - name: permission-fix
          image: busybox
          command: ['sh', '-c']
          args: ['chown -R root:2000 /var']
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      containers:
        - name: yseop-manager
          image:IMAGE
          imagePullPolicy: IfNotPresent
          securityContext:
             runAsUser: 1001
             runAsGroup: 2000
          env:
            - name: SECURITY_USERS_DEFAULT_ENABLED
              value: "true"
          ports:
            - containerPort: 8080
          volumeMounts:
            - mountPath: /var/yseop-engine
              name: yseop-data
            - mountPath: /var/yseop-data/yseop-manager
              name: yseop-data
            - mountPath: /var/yseop-log
              name: yseop-data
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: yseop-data
          persistentVolumeClaim:
            claimName: yseop-pvc