无法挂载到 Kubernetes 中的 nfs pod

Question

社区。我需要有关 Kubernetes 中 NFS pod 的配置方面的帮助。我无法连接到 NFS pod。看不懂，有什么问题。需要帮忙。我尝试使用命令连接：

mount --options port=2052 --types nfs 10.110.183.188:/upload /upload

并在我的计算机上收到 Connection timeout 错误。当我尝试使用此命令从另一个 pod 连接到 NFS 时，我得到了

mount: /upload: cannot mount 10.110.183.188:/upload read-only.

kubectl describe to NFS pod 写这个：

Serving /exports
Serving /
rpcinfo: can't contact rpcbind: : RPC: Unable to receive; errno = Connection refused
Starting rpcbind
exportfs: / does not support NFS export
NFS started

这是我对 NFS pod 的配置

kind: PersistentVolume
apiVersion: v1
metadata:
  name: webpp-nfs
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 3Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/webpp-data/nfs"
    type: Directory
---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: webpp-nfs
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 3Gi
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: webpp-upload-nfs-server
spec:
  replicas: 1
  selector:
    matchLabels:
      role: webpp-upload-nfs-server
  template:
    metadata:
      labels:
        role: webpp-upload-nfs-server
    spec:
      containers:
      - name: webpp-upload-nfs-server
        image: gcr.io/google_containers/volume-nfs:latest
        ports:
          - name: nfs
            containerPort: 2052
          - name: mountd
            containerPort: 32771
        securityContext:
          privileged: true
        volumeMounts:
          - mountPath: /exports
            name: storage
      nodeSelector:
        env: stateful
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: webpp-nfs
---
apiVersion: v1
kind: Service
metadata:
  name: webpp-upload-nfs-server
spec:
  ports:
    - name: nfs
      port: 2052
      nodePort: 2052
    - name: mountd
      port: 32771
      nodePort: 32771
  type: NodePort
  selector:
    role: webpp-upload-nfs-server

这是 pod 连接到 NFS 的配置

apiVersion: apps/v1
kind: Deployment
metadata:
  name: $CI_ENVIRONMENT_SLUG-webpp-$CI_COMMIT_REF_SLUG
spec:
  selector:
    matchLabels:
      app: webpp-$CI_COMMIT_REF_SLUG
  replicas: 1
  template:
    metadata:
      labels:
        app: webpp-$CI_COMMIT_REF_SLUG
    spec:
      nodeSelector:
        env: apps
      containers:
      - name: nginx-$CI_COMMIT_REF_SLUG
        image: nginx:latest
        ports:
         - containerPort: 80
        volumeMounts:
        - name: shared-files
          mountPath: /app
        - mountPath: /etc/nginx/conf.d/default.conf
          name: nginx-config
          subPath: s1-kube.conf

      - name: app-$CI_COMMIT_REF_SLUG
        image: git.webpp.ru:4567/webpp/webpp:$CI_COMMIT_REF_SLUG
        ports:
        - containerPort: 9000
        imagePullPolicy: Always
        volumeMounts:
        - mountPath: /upload
          name: upload
        lifecycle:
          postStart:
            exec:
              command: ["bash", "/start.sh"]

      imagePullSecrets:
        - name: git.webpp.ru
      volumes:
        - name: shared-files
          emptyDir: {}
        - name: nginx-config
          configMap:
            name: nginx-$CI_COMMIT_REF_SLUG
        - name: upload
          persistentVolumeClaim:
            claimName: webpp-nfs
---
apiVersion: v1
kind: Service
metadata:
  name: webpp-$CI_COMMIT_REF_SLUG
  labels:
    app: webpp-$CI_COMMIT_REF_SLUG
spec:
  ports:
  - port: 80
    protocol: TCP
  selector:
    app: webpp-$CI_COMMIT_REF_SLUG
---
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: webpp-$CI_COMMIT_REF_SLUG
  annotations:
    nginx.ingress.kubernetes.io/proxy-buffers: "50m"
    nginx.ingress.kubernetes.io/proxy-buffer-size: "50m"
    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
    nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "50m"
spec:
  rules:
  - host: $CI_COMMIT_REF_SLUG.webpp.wpp.zone
    http:
      paths:
      - path: "/"
        backend:
          serviceName: webpp-$CI_COMMIT_REF_SLUG
          servicePort: 80

pod 的 svc 看起来像这样

NAME                      TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)                         AGE
webpp-db-service          NodePort    10.100.169.28    <none>        3306:3304/TCP                   347d
webpp-develop             ClusterIP   10.101.10.54     <none>        80/TCP                          8h
webpp-feature-2334        ClusterIP   10.102.208.56    <none>        80/TCP                          9h
webpp-upload-nfs-server   NodePort    10.110.183.188   <none>        2052:2052/TCP,32771:32771/TCP   255d

Pod 看起来像这样

NAME                                                           READY   STATUS    RESTARTS   AGE
review-develop-3zknud-webpp-develop-754d56c654-v8hwx           0/2     Pending   0          8h
review-feature-23-3smwjk-webpp-feature-2334-695959494f-4hgfj   2/2     Running   0          7h43m
webpp-db-769757b69c-kh4c4                                      1/1     Running   6          41d
webpp-upload-nfs-server-594c6fbb6d-c2r22                       1/1     Running   0          7h45m

我尝试从 pod review-feature-23-3smwjk-webpp-feature-2334-695959494f-4hgfj 连接到 nfs pod webpp-upload-nfs-server-594c6fbb6d-c2r22。

Answer 1

mount --options port=2052 --types nfs 10.110.183.188:/upload /upload

可能有防火墙阻止您访问端口2052。仅供参考，如果您正在运行 NFSv4，allowed 的端口是 111 和 2049

*mount: /upload: cannot mount 10.110.183.188:/upload read-only.

这更像是用词不当：

rpcinfo: can't contact rpcbind: : RPC: Unable to receive; errno = Connection refused

看起来 /upload 确实没有导出到您的 webpp-upload-nfs-server 容器中。

我检查了图像，它在文件系统中看起来不错：

/exports *(rw,fsid=0,insecure,no_root_squash)
/ *(rw,fsid=0,insecure,no_root_squash)

您正在尝试从NFS:/uploads 进行挂载，但您正在导出NFS:/exports。所以你可以试试：

mount --options port=2052 --types nfs 10.110.183.188:/exports /upload

✌️

Answer 2

我不确定您要达到的目标。如果您尝试将一些文件保存到hostPath 卷，那么您不需要 PV 或 PVC。您可以使用hostPath 卷将文件保存在主机上。

如果您想使用 PVC 来控制对主机卷的分配和访问，那么您不需要webpp-upload-nfs-server（部署和服务）。只需创建 PV 和 PVC 对象并将 PVC 直接挂载到目标 pod 中即可。

你正在做的事情很圆。您正在为主机路径创建 PV 和 PVC。然后将该主机路径转换为 ​​NFS 共享。 您错过了必须创建另一个 PV 和 PVC 才能使用 NFS 共享的部分。最后，将该 PVC 挂载到目标部署中。