Kubernetes部署只读文件系统错误 [英] Kubernetes deployment read-only filesystem error
问题描述
我在Kubernetes上部署Airflow时遇到错误(正是此版本的Airflow
I am facing an error while deploying Airflow on Kubernetes (precisely this version of Airflow https://github.com/puckel/docker-airflow/blob/1.8.1/Dockerfile) regarding writing permissions onto the filesystem.
豆荚的日志上显示的错误是:
The error displayed on the logs of the pod is:
sed: couldn't open temporary file /usr/local/airflow/sed18bPUH: Read-only file system
sed: -e expression #1, char 131: unterminated `s' command
sed: -e expression #1, char 118: unterminated `s' command
Initialize database...
sed: couldn't open temporary file /usr/local/airflow/sedouxZBL: Read-only file system
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/airflow/configuration.py", line 769, in
....
with open(TEST_CONFIG_FILE, 'w') as f:
IOError: [Errno 30] Read-only file system: '/usr/local/airflow/unittests.cfg'
似乎文件系统是只读的,但我不明白为什么.我不确定这是否是 Kubernetes配置错误(我是否需要针对Pod的特殊RBAC?不知道)还是 Dockerfile 问题.
It seems that the filesystem is read-only but I do not understand why it is. I am not sure if it is a Kubernetes misconfiguration (do I need a special RBAC for pods ? No idea) or if it is a problem with the Dockerfile.
部署文件如下所示:
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
name: airflow
namespace: test
spec:
replicas: 1
revisionHistoryLimit: 3
strategy:
type: RollingUpdate
rollingUpdate:
maxUnavailable: 0
maxSurge: 1
template:
metadata:
labels:
app: airflow
spec:
restartPolicy: Always
containers:
- name: webserver
image: davideberdin/docker-airflow:0.0.4
imagePullPolicy: Always
resources:
limits:
cpu: 1
memory: 1Gi
requests:
cpu: 50m
memory: 128Mi
securityContext: #does not have any effect
runAsUser: 0 #does not have any effect
ports:
- name: airflow-web
containerPort: 8080
args: ["webserver"]
volumeMounts:
- name: airflow-config-volume
mountPath: /usr/local/airflow
readOnly: false #does not have any effect
- name: airflow-logs
mountPath: /usr/local/logs
readOnly: false #does not have any effect
volumes:
- name: airflow-config-volume
secret:
secretName: airflow-config-secret
- name: airflow-parameters-volume
secret:
secretName: airflow-parameters-secret
- name: airflow-logs
emptyDir: {}
有什么想法可以使文件系统可写吗?容器以 USER airflow 的身份运行,但我认为该用户具有root特权.
Any idea how I can make the filesystem writable? The container is running as USER airflow but I think that this user has root privileges.
推荐答案
volumeMounts:
- name: airflow-config-volume
mountPath: /usr/local/airflow
volumes:
- name: airflow-config-volume
secret:
secretName: airflow-config-secret
是您问题的根源,有两个原因:首先,您已破坏了气流用户的由airflow
拥有的目录.
Is the source of your problems, for two reasons: first, you have smashed the airflow user's home directory by volume mounting your secret onto the image directly into a place where the image expects a directory owned by airflow
.
另外,尽管我必须启动一个集群以确认100%,但我很确定Secret
卷已装入-并且我认为他们的ConfigMap
朋友-已被读取-仅对Pod文件系统的投影;这种怀疑肯定符合您的经验.毫无疑问,对这些卷的更改不会传播回到kubernetes集群中,所以为什么假装否则.
Separately, while I would have to fire up a cluster to confirm 100%, I am pretty sure that Secret
volume mounts -- and I think their ConfigMap
friends -- are read-only projections into the Pod filesystems; that suspicion certainly appears to match your experience. There is certainly no expectation that changes to those volumes propagate back up into the kubernetes cluster, so why pretend otherwise.
If you want to continue to attempt such a thing, you do actually have influence over the defaultMode
of the files projected into that volumeMount
, so you could set them to 0666
, but caveat emptor for sure. The short version is, by far, not to smash $AIRFLOW_HOME
with a volume mount.
这篇关于Kubernetes部署只读文件系统错误的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!