如何在 Kubernetes 的 elasticsearch 数据目录上做 chown 1000:1000

Question

我收到 Failed to created node environment 错误，带有 elasticsearch docker 映像：

[unknown] uncaught exception in thread [main]
org.elasticsearch.bootstrap.StartupException: java.lang.IllegalStateException: Failed to create node environment

elasticsearch 数据的持久化卷位于 /mnt/volume/elasticsearch-data。

我可以通过ssh 进入远程机器并运行chown 1000:1000 /mnt/volume/elasticsearch-data 来解决这个问题。但我不想手动进行。如何使用deployment.yaml 文件解决此权限问题？

我读过在securityContext 中使用fsGroup: 1000 应该可以解决问题，但它对我不起作用。

deployment.yaml：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]

storage.yaml：

kind: PersistentVolume
apiVersion: v1
metadata:
  name: elasticsearch-pv-volume
  labels:
    type: local
    app: elasticsearch
spec:
  storageClassName: manual
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteMany
  hostPath:
    path: "/mnt/volume/elasticsearch-data"
  persistentVolumeReclaimPolicy: Delete

---
kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: elasticsearch-pv-claim
  labels:
    app: elasticsearch
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 5Gi

Answer 1

open bug 上似乎有关于 hostPath 卷的权限。要解决此问题，您应该创建一个 initContainer 最初设置适当的权限：

piVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: elasticsearch
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      initContainers:
        - name: set-permissions
          image: registry.hub.docker.com/library/busybox:latest
          command: ['sh', '-c', 'mkdir -p /usr/share/elasticsearch/data && chown 1000:1000 /usr/share/elasticsearch/data' ]
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      containers:
        - name: elasticsearch
          image: me-name/elasticsearch:6.7
          imagePullPolicy: "IfNotPresent"
          ports:
            - containerPort: 9200
          envFrom:
            - configMapRef:
                name: elasticsearch-config
          volumeMounts:
            - mountPath: /usr/share/elasticsearch/data
              name: elasticsearch-volume
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
        capabilities:
          add:
            - IPC_LOCK
            - SYS_RESOURCE
      volumes:
        - name: elasticsearch-volume
          persistentVolumeClaim:
            claimName: elasticsearch-pv-claim
      lifecycle:
        postStart:
          exec:
            command: ["/bin/sh", "-c", "sysctl -w vm.max_map_count=262144"]

通过设置 fsGroup，您在正确的轨道上，但您当前正在做的是将 user 设置为 1000 并安装卷以​​访问 组 1000。您应该更改的是使用runAsGroup: 1000 而不是runAsUser: 1000。