kubernetes - 作业无效 : `selector` not auto-generated

Question

我有无效的 kubectl 作业。我正在调试它并将其解压缩到 yaml 文件中，我可以看到:

apiVersion: batch/v1
kind: Job
metadata:
  creationTimestamp: 2020-03-19T21:40:11Z
  labels:
    app: vault-unseal-app
    job-name: vault-unseal-vault-unseal-1584654000
  name: vault-unseal-vault-unseal-1584654000
  namespace: infrastructure
  ownerReferences:
  - apiVersion: batch/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: CronJob
    name: vault-unseal-vault-unseal
    uid: c9965fdb-4fbb-11e9-80d7-061cf1426d5a
  resourceVersion: "163413544"
  selfLink: /apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000
  uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
spec:
  backoffLimit: 0
  completions: 1
  parallelism: 1
  selector:
    matchLabels:
      app: vault-unseal-app
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: vault-unseal-app
        job-name: vault-unseal-vault-unseal-1584654000
    spec:
      containers:
      - env:
        - name: VAULT_ADDR
          value: http://vault-vault:8200
        - name: VAULT_SKIP_VERIFY
          value: "1"
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              key: vault_token
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_0
          valueFrom:
            secretKeyRef:
              key: unseal_key_0
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_1
          valueFrom:
            secretKeyRef:
              key: unseal_key_1
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_2
          valueFrom:
            secretKeyRef:
              key: unseal_key_2
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_3
          valueFrom:
            secretKeyRef:
              key: unseal_key_3
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_4
          valueFrom:
            secretKeyRef:
              key: unseal_key_4
              name: vault-unseal-vault-unseal
        image: blockloop/vault-unseal
        imagePullPolicy: Always
        name: vault-unseal
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      nodeSelector:
        nodePool: ci
      restartPolicy: OnFailure
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 5
status:
  conditions:
  - lastProbeTime: 2020-03-19T21:49:11Z
    lastTransitionTime: 2020-03-19T21:49:11Z
    message: Job has reached the specified backoff limit
    reason: BackoffLimitExceeded
    status: "True"
    type: Failed
  failed: 1
  startTime: 2020-03-19T21:40:11Z

当我跑 kubectl create -f my_file.yaml ，我收到此错误:

The Job "vault-unseal-vault-unseal-1584654000" is invalid: spec.selector: Invalid value: v1.LabelSelector{MatchLabels:map[string]string{"controller-uid":"35262878-07bb-11eb-9b2c-0abca2a23428", "app":"vault-unseal-app"}, MatchExpressions:[]v1.LabelSelectorRequirement(nil)}: `selector` not auto-generated

有人可以建议如何解决这个问题吗？
更新:
经测试删除 .spec.selector我收到错误: error: jobs.batch "vault-unseal-vault-unseal-1584654000" is invalid这就是我的配置在没有 .spec.selector 的情况下的样子:

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: batch/v1
kind: Job
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"batch/v1","kind":"Job","metadata":{"annotations":{},"creationTimestamp":"2020-03-19T21:40:11Z","labels":{"controller-uid":"35e63c20-6a2a-11ea-b577-069afd6d30d4","job-name":"vault-unseal-vault-unseal-1584654000"},"name":"vault-unseal-vault-unseal-1584654000","namespace":"infrastructure","ownerReferences":[{"apiVersion":"batch/v1beta1","blockOwnerDeletion":true,"controller":true,"kind":"CronJob","name":"vault-unseal-vault-unseal","uid":"c9965fdb-4fbb-11e9-80d7-061cf1426d5a"}],"resourceVersion":"163427805","selfLink":"/apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000","uid":"35e63c20-6a2a-11ea-b577-069afd6d30d4"},"spec":{"backoffLimit":20,"completions":1,"parallelism":1,"selector":{"matchLabels":{"controller-uid":"35e63c20-6a2a-11ea-b577-069afd6d30d4"}},"template":{"metadata":{"creationTimestamp":null,"labels":{"controller-uid":"35e63c20-6a2a-11ea-b577-069afd6d30d4","job-name":"vault-unseal-vault-unseal-1584654000"}},"spec":{"containers":[{"env":[{"name":"VAULT_ADDR","value":"http://vault-vault:8200"},{"name":"VAULT_SKIP_VERIFY","value":"1"},{"name":"VAULT_TOKEN","valueFrom":{"secretKeyRef":{"key":"vault_token","name":"vault-unseal-vault-unseal"}}},{"name":"VAULT_UNSEAL_KEY_0","valueFrom":{"secretKeyRef":{"key":"unseal_key_0","name":"vault-unseal-vault-unseal"}}},{"name":"VAULT_UNSEAL_KEY_1","valueFrom":{"secretKeyRef":{"key":"unseal_key_1","name":"vault-unseal-vault-unseal"}}},{"name":"VAULT_UNSEAL_KEY_2","valueFrom":{"secretKeyRef":{"key":"unseal_key_2","name":"vault-unseal-vault-unseal"}}},{"name":"VAULT_UNSEAL_KEY_3","valueFrom":{"secretKeyRef":{"key":"unseal_key_3","name":"vault-unseal-vault-unseal"}}},{"name":"VAULT_UNSEAL_KEY_4","valueFrom":{"secretKeyRef":{"key":"unseal_key_4","name":"vault-unseal-vault-unseal"}}}],"image":"blockloop/vault-unseal","imagePullPolicy":"Always","name":"vault-unseal","resources":{},"terminationMessagePath":"/dev/termination-log","terminationMessagePolicy":"File"}],"dnsPolicy":"ClusterFirst","nodeSelector":{"nodePool":"devs"},"restartPolicy":"OnFailure","schedulerName":"default-scheduler","securityContext":{},"terminationGracePeriodSeconds":5}}},"status":{"conditions":[{"lastProbeTime":"2020-03-19T21:49:11Z","lastTransitionTime":"2020-03-19T21:49:11Z","message":"Job has reached the specified backoff limit","reason":"BackoffLimitExceeded","status":"True","type":"Failed"}],"failed":1,"startTime":"2020-03-19T21:40:11Z"}}
  creationTimestamp: 2020-03-19T21:40:11Z
  labels:
    controller-uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
    job-name: vault-unseal-vault-unseal-1584654000
  name: vault-unseal-vault-unseal-1584654000
  namespace: infrastructure
  ownerReferences:
  - apiVersion: batch/v1beta1
    blockOwnerDeletion: true
    controller: true
    kind: CronJob
    name: vault-unseal-vault-unseal
    uid: c9965fdb-4fbb-11e9-80d7-061cf1426d5a
  resourceVersion: "163442526"
  selfLink: /apis/batch/v1/namespaces/infrastructure/jobs/vault-unseal-vault-unseal-1584654000
  uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
spec:
  backoffLimit: 100
  completions: 1
  parallelism: 1
  template:
    metadata:
      creationTimestamp: null
      labels:
        controller-uid: 35e63c20-6a2a-11ea-b577-069afd6d30d4
        job-name: vault-unseal-vault-unseal-1584654000
    spec:
      containers:
      - env:
        - name: VAULT_ADDR
          value: http://vault-vault:8200
        - name: VAULT_SKIP_VERIFY
          value: "1"
        - name: VAULT_TOKEN
          valueFrom:
            secretKeyRef:
              key: vault_token
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_0
          valueFrom:
            secretKeyRef:
              key: unseal_key_0
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_1
          valueFrom:
            secretKeyRef:
              key: unseal_key_1
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_2
          valueFrom:
            secretKeyRef:
              key: unseal_key_2
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_3
          valueFrom:
            secretKeyRef:
              key: unseal_key_3
              name: vault-unseal-vault-unseal
        - name: VAULT_UNSEAL_KEY_4
          valueFrom:
            secretKeyRef:
              key: unseal_key_4
              name: vault-unseal-vault-unseal
        image: blockloop/vault-unseal
        imagePullPolicy: Always
        name: vault-unseal
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      nodeSelector:
        nodePool: devs
      restartPolicy: OnFailure
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 5
status:
  conditions:
  - lastProbeTime: 2020-03-19T21:49:11Z
    lastTransitionTime: 2020-03-19T21:49:11Z
    message: Job has reached the specified backoff limit
    reason: BackoffLimitExceeded
    status: "True"
    type: Failed
  failed: 1
  startTime: 2020-03-19T21:40:11Z

Answer 1

看起来您没有使用 selector默认情况下，系统会自动为您生成。请记住，创建作业时推荐的选项是不要填写 selector .它更有可能创建重复的标签+选择器。因此，您应该使用自动生成的，以确保唯一性并使您免于手动管理的必要性。
official docs用一个例子更详细地解释这一点。请注意以下部分:

Normally, when you create a Job object, you do not specify.spec.selector. The system defaulting logic adds this field when theJob is created. It picks a selector value that will not overlap withany other jobs.

和:

You need to specify manualSelector: true in the new Job since youare not using the selector that the system normally generates for youautomatically.

如果你想使用手动选择器，你需要设置: .spec.manualSelector: true在工作规范中。这样 API 服务器就不会自动生成标签，您可以自己设置它们。
编辑:
请记住 spec.Completions spec.Selector和 spec.Template是不可变字段，不允许更新。为了在那里进行更改，您需要创建一个新作业。
关于 Writing a Job spec 的官方文档将帮助您了解什么应该和什么不应该放入作业规范。请注意，尽管:

In addition to required fields for a Pod, a pod template in a Job mustspecify appropriate labels (see pod selector) and an appropriaterestart policy.

建议不要像我之前解释的那样指定 pod 选择器/标签，以免创建重复的标签+选择器。