AWS EKS Fargate - 无法使用 statefulset 挂载 EFS 卷

Question

我想在 AWS EKS Fargate 中运行 statefulSet 并使用它附加一个 EFS 卷，但是在使用 pod 安装卷时出现错误。 这些是我从描述 pod 中得到的错误。

QoS Class:                   BestEffort
Node-Selectors:              <none>
Tolerations:                 node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
                             node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
  Type     Reason          Age                From               Message
  ----     ------          ----               ----               -------
  Normal   LoggingEnabled  114s               fargate-scheduler  Successfully enabled logging for pod
  Normal   Scheduled       75s                fargate-scheduler  Successfully assigned default/app1 to fargate-10.0.2.123
  Warning  FailedMount     43s (x7 over 75s)  kubelet            MountVolume.SetUp failed for volume "efs-pv" : rpc error: code = Internal desc = Could not mount "fs-xxxxxxxxxxxxxxxxx:/" at "/var/lib/kubelet/pods/b799a6d6-fe9e-4f80-ac2d-8ccf8834d7c4/volumes/kubernetes.io~csi/efs-pv/mount": mount failed: exit status 1
Mounting command: mount
Mounting arguments: -t efs -o tls fs-xxxxxxxxxxxxxxxxx:/ /var/lib/kubelet/pods/b799a6d6-fe9e-4f80-ac2d-8ccf8834d7c4/volumes/kubernetes.io~csi/efs-pv/mount
Output: Failed to resolve "fs-xxxxxxxxxxxxxxxxx.efs.us-east-1.amazonaws.com" - check that your file system ID is correct, and ensure that the VPC has an EFS mount target for this file system ID.
See https://docs.aws.amazon.com/console/efs/mount-dns-name for more detail.
Attempting to lookup mount target ip address using botocore. Failed to import necessary dependency botocore, please install botocore first.
Warning: config file does not have fall_back_to_mount_target_ip_address_enabled item in section mount.. You should be able to find a new config file in the same folder as current config file /etc/amazon/efs/efs-utils.conf. Consider update the new config file to latest config file. Use the default value [fall_back_to_mount_target_ip_address_enabled = True].

如果有人使用 eks fargate 集群设置了 efs 卷，请查看它。我真的被困了很久了。

我设置了什么

• 创建了 EFS 卷
• CSIDriver 对象

apiVersion: storage.k8s.io/v1beta1
kind: CSIDriver
metadata:
  name: efs.csi.aws.com
spec:
  attachRequired: false

• 存储类

kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: efs-sc
provisioner: efs.csi.aws.com

• 持久卷

apiVersion: v1
kind: PersistentVolume
metadata:
  name: efs-pv
spec:
  capacity:
    storage: 5Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  storageClassName: efs-sc
  csi:
    driver: efs.csi.aws.com
    volumeHandle: <EFS filesystem ID>

• PersistentVolumeClaim

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: efs-claim
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: efs-sc
  resources:
    requests:
      storage: 5Gi

• Pod 配置

apiVersion: v1
kind: Pod
metadata:
  name: app1
spec:
  containers:
  - name: app1 
    image: busybox 
    command: ["/bin/sh"] 
    args: ["-c", "while true; do echo $(date -u) >> /data/out1.txt; sleep 5; done"]
    volumeMounts:
    - name: persistent-storage
      mountPath: /data
  volumes:
  - name: persistent-storage
    persistentVolumeClaim:
      claimName: efs-claim

Answer 1

一天后我和你有同样的问题，从那时起我就一直在不停地解决这个错误！您是否检查以确保您的 VPC 启用了 DNS 主机名？这就是为我解决的问题。

仅供参考，如果您使用 Fargate 并且想要更改此设置 - 我必须在更改 DNS 主机名标志后删除整个集群才能传播更改。我不确定您是否熟悉普通 ec2 实例的 DHCP 选项，但通常需要更新 ipconfig 以强制标志传播，但由于 fargate 是托管系统，我无法找到一种从节点本身这样做的方法。我创建了另一个帖子here试图回答那个问题。

另一个快速的 FYI：如果您的 pod 执行角色无权访问 EFS，您将需要添加一个允许访问的策略（我暂时只是使用默认的 AmazonElasticFileSystemFullAccess 角色以尝试让事情正常工作）。再一次，如果您还没有这样做，您将不得不重新启动整个集群才能传播此角色更改！