kubernetes - 无法将 secret 装载到/etc 中的卷

Question

我有一个 K8s 部署，它将一个 secret 安装到 /etc/google-cloud-account 中，其中包含要从应用程序使用的 Google 身份验证 JSON 文件。当我尝试运行部署时，我的 pod 出现以下错误:

1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Normal  Created     Created container with docker id 36b85ec8415a; Security:[seccomp=unconfined]
1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Warning Failed      Failed to start container with docker id 36b85ec8415a with error: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system"
1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x             Warning FailedSync  Error syncing pod, skipping: failed to "StartContainer" for "api" with RunContainerError: "runContainer: Error response from daemon: rpc error: code = 2 desc = \"oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system\""

2m  13s 11  kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Warning BackOff     Back-off restarting failed docker container

有问题的部署看起来像:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # ...
spec:
  replicas: {{ .Values.api.replicaCount }}
  template:
    # ...
    spec:
      containers:
        - name: {{ .Values.api.name }}
          # ...
          volumeMounts:
            - name: google-cloud-account
              mountPath: /etc/google-cloud-account
      volumes:
        - name: google-cloud-account
          secret:
            secretName: {{ template "fullname" . }}
            items:
              - key: google-cloud-credentials
                path: credentials.json

我不知道容器中的 /etc 是只读文件系统，也不知道如何更改它。

Answer 1

Dave Long's answer 的替代品是projected volumes :

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # ...
spec:
  replicas: {{ .Values.api.replicaCount }}
  template:
    # ...
    spec:
      containers:
        - name: {{ .Values.api.name }}
          # ...
          volumeMounts:
            - name etc
              mountPath: /etc
            - name: google-cloud-account
              mountPath: /etc/google-cloud-account
            - name: odbc
              mountPath: /etc
      volumes:
        - name: config
          projected:
            sources:
            - secret:
                name: {{ template "fullname" . }}
                items:
                  - key: google-cloud-credentials
                    path: google-cloud-account/credentials.json
            - configMap:
                name: {{ template "fullname" . }}
                items:
                  - key: odbc.ini
                    path: odbc.ini