無法將密碼安裝到/ etc中

我有一個K8s部署，它將一個祕密裝入/etc/google-cloud-account，其中包含要從應用程序使用的Google auth JSON文件。當我嘗試運行部署，我從我的莢收到以下錯誤：無法將密碼安裝到/ etc中

1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Normal Created  Created container with docker id 36b85ec8415a; Security:[seccomp=unconfined] 
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning Failed  Failed to start container with docker id 36b85ec8415a with error: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d603b2b203/merged/etc/google-cloud-account: read-only file system" 
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x    Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "api" with RunContainerError: "runContainer: Error response from daemon: rpc error: code = 2 desc = \"oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d603b2b203/merged/etc/google-cloud-account: read-only file system\"" 

2m 13s 11 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning BackOff  Back-off restarting failed docker container

有關部署的樣子：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
     volumes: 
     - name: google-cloud-account 
      secret: 
      secretName: {{ template "fullname" . }} 
      items: 
       - key: google-cloud-credentials 
       path: credentials.json

我不知道該怎麼/etc容器會一個只讀文件系統，不知道如何改變它。

來源

2017-06-14 Dave Long

只是嘗試將其安裝在其他地方。 GKE在引擎蓋下使用了CoreOS，我很確定;這是一個只讀的FS，所以你應該安裝在/ usr/local /下，這應該是R/W – MrE

@MER看到我的答案在下面。這與另一個卷裝有關。 –

事實證明，錯誤是由另一個卷裝載導致的。我離開它的最終代碼的，但我的部署看起來更像如下：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
      - name: odbc 
       mountPath: /etc 
     volumes: 
     - name: google-cloud-account 
      secret: 
      secretName: {{ template "fullname" . }} 
      items: 
       - key: google-cloud-credentials 
       path: credentials.json 
     - name: odbc 
      configMap: 
      name: {{ template "fullname" . }} 
      items: 
       - key: odbc.ini 
       path: odbc.ini

安裝odbc接手整個/etc目錄。爲了解決這個問題，我改變了odbcvolumeMount到：

- name: odbc 
    mountPath: /etc/odbc.ini 
    subPath: odbc.ini

其中左側一切/etc完整別人。

來源

2017-06-15 01:52:53

的替代Dave Long's answer是projected volumes：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name etc 
       mountPath: /etc 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
      - name: odbc 
       mountPath: /etc 
     volumes: 
     - name: config 
      projected: 
      sources: 
      - secret: 
       name: {{ template "fullname" . }} 
       items: 
        - key: google-cloud-credentials 
        path: google-cloud-account/credentials.json 
      - configMap: 
       name: {{ template "fullname" . }} 
       items: 
        - key: odbc.ini 
        path: odbc.ini

來源

2017-10-09 20:07:10 schnatterer

無法將密碼安裝到/ etc中

回答

相關問題