dynamic - Kubernetes Hostpath 外部供应商 - PVC 待定

Question

我按照说明 here 使用 kubeadm 设置了一个单节点 K8S 集群:

集群已启动，所有系统 pod 都运行良好:

[root@umeshworkstation hostpath-provisioner]# kubectl get pods -n kube-system
NAME                                        READY     STATUS    RESTARTS   AGE
calico-etcd-n988r                           1/1       Running   10         6h
calico-node-n1wmk                           2/2       Running   10         6h
calico-policy-controller-1777954159-bd8rn   1/1       Running   0          6h
etcd-umeshworkstation                       1/1       Running   1          6h
kube-apiserver-umeshworkstation             1/1       Running   1          6h
kube-controller-manager-umeshworkstation    1/1       Running   1          6h
kube-dns-3913472980-2ptjj                   0/3       Pending   0          6h
kube-proxy-1d84l                            1/1       Running   1          6h
kube-scheduler-umeshworkstation             1/1       Running   1          6h

然后我从 kubernetes-incubator 下载了 Hostpath 外部供应商代码并在同一节点上本地构建它。用于配置器的 docker 镜像构建成功，我什至可以使用 pod.yaml 从同一位置实例化配置器 pod。 pods 运行良好:

[root@umeshworkstation hostpath-provisioner]# kubectl describe pod hostpath-provisioner
Name:           hostpath-provisioner
Namespace:      default
Node:           umeshworkstation/172.17.24.123
Start Time:     Tue, 09 May 2017 23:44:41 -0400
Labels:         <none>
Annotations:    <none>
Status:         Running
IP:             192.168.8.65
Controllers:    <none>
Containers:
  hostpath-provisioner:
    Container ID:       docker://c600cfa7a2f5f958ad24e83372a1276a91b41cb67773b9605af4a0ae021ec914
    Image:              hostpath-provisioner:latest
    Image ID:           docker://sha256:f6def41ba7c096701c65bf0c0aba6ff31e030573e1a900e378432491ecc5c556
    Port:
    State:              Running
      Started:          Tue, 09 May 2017 23:44:45 -0400
    Ready:              True
    Restart Count:      0
    Environment:
      NODE_NAME:         (v1:spec.nodeName)
    Mounts:
      /tmp/hostpath-provisioner from pv-volume (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-7wwvj (ro)
Conditions:
  Type          Status
  Initialized   True
  Ready         True
  PodScheduled  True
Volumes:
  pv-volume:
    Type:       HostPath (bare host directory volume)
    Path:       /tmp/hostpath-provisioner
  default-token-7wwvj:
    Type:       Secret (a volume populated by a Secret)
    SecretName: default-token-7wwvj
    Optional:   false
QoS Class:      BestEffort
Node-Selectors: <none>
Tolerations:    node.alpha.kubernetes.io/notReady=:Exists:NoExecute for 300s
                node.alpha.kubernetes.io/unreachable=:Exists:NoExecute for 300s
Events:         <none>

然后我按照项目主页的说明创建了存储类，并且存储类创建良好:

[root@umeshworkstation hostpath-provisioner]# kubectl describe sc example-hostpath
Name:           example-hostpath
IsDefaultClass: No
Annotations:    <none>
Provisioner:    example.com/hostpath
Parameters:     <none>
Events:         <none>

下一步是使用同一位置的 claim.yaml 创建 PVC，但 PVC 仍处于 Pending 状态，并且 describe 显示它无法找到供应商 example.com/hostpath:

[root@umeshworkstation hostpath-provisioner]# kubectl describe pvc
Name:           hostpath
Namespace:      default
StorageClass:   example-hostpath
Status:         Pending
Volume:
Labels:         <none>
Annotations:    volume.beta.kubernetes.io/storage-class=example-hostpath
                volume.beta.kubernetes.io/storage-provisioner=example.com/hostpath
Capacity:
Access Modes:
Events:
  FirstSeen     LastSeen        Count   From                            SubObjectPath   Type            Reason                  Message
  ---------     --------        -----   ----                            -------------   --------        ------                  -------
  2h            11s             874     persistentvolume-controller                     Normal          ExternalProvisioning    cannot find provisioner "example.com/hostpath", expecting that a volume for the claim is provisioned either manually or via external software

因此，PVC 一直处于待处理状态。

我错过了什么吗？

Answer 1

我已经解决了这个问题。感谢@jaxxstorm 帮助我朝着正确的方向前进。

当我检查配置器 pod 日志时，我可以看到它无法访问 API 服务器来列出 StorageClass、PVC 或 PV，因为它是使用默认服务帐户创建的，它没有访问这些 API 的权限。

解决方案是创建一个单独的服务帐户、pod 安全策略、集群角色和集群角色绑定(bind)，如 NFS external provisioner here 中所述。

在此之后，我可以看到我的 PVC 绑定(bind)到显示挂载的卷和主机路径

[root@umeshworkstation hostpath-provisioner]# kubectl get pvc
NAME       STATUS    VOLUME                                     CAPACITY   ACCESSMODES   STORAGECLASS       AGE
hostpath   Bound     pvc-8179c8d6-36db-11e7-9ed4-005056a21a50   1Mi        RWX           example-hostpath   1m

[root@umeshworkstation hostpath-provisioner]# ls /tmp/hostpath-provisioner/
pvc-8179c8d6-36db-11e7-9ed4-005056a21a50