Kubernetes 主机路径外部供应商 - PVC 待处理

Question

我已经按照说明 here:

使用 kubeadm 设置了一个单节点 K8S 集群

集群已启动，所有系统 pods 都运行正常：

[root@umeshworkstation hostpath-provisioner]# kubectl get pods -n kube-system
NAME                                        READY     STATUS    RESTARTS   AGE
calico-etcd-n988r                           1/1       Running   10         6h
calico-node-n1wmk                           2/2       Running   10         6h
calico-policy-controller-1777954159-bd8rn   1/1       Running   0          6h
etcd-umeshworkstation                       1/1       Running   1          6h
kube-apiserver-umeshworkstation             1/1       Running   1          6h
kube-controller-manager-umeshworkstation    1/1       Running   1          6h
kube-dns-3913472980-2ptjj                   0/3       Pending   0          6h
kube-proxy-1d84l                            1/1       Running   1          6h
kube-scheduler-umeshworkstation             1/1       Running   1          6h

然后我从 kubernetes-incubator 下载了 Hostpath 外部供应商代码，并在同一节点上本地构建它。 docker 构建的 provisioner 映像已成功构建，我什至可以在同一位置使用 pod.yaml 实例化 provisioner pod。吊舱运行很好：

[root@umeshworkstation hostpath-provisioner]# kubectl describe pod hostpath-provisioner
Name:           hostpath-provisioner
Namespace:      default
Node:           umeshworkstation/172.17.24.123
Start Time:     Tue, 09 May 2017 23:44:41 -0400
Labels:         <none>
Annotations:    <none>
Status:         Running
IP:             192.168.8.65
Controllers:    <none>
Containers:
  hostpath-provisioner:
    Container ID:       docker://c600cfa7a2f5f958ad24e83372a1276a91b41cb67773b9605af4a0ae021ec914
    Image:              hostpath-provisioner:latest
    Image ID:           docker://sha256:f6def41ba7c096701c65bf0c0aba6ff31e030573e1a900e378432491ecc5c556
    Port:
    State:              Running
      Started:          Tue, 09 May 2017 23:44:45 -0400
    Ready:              True
    Restart Count:      0
    Environment:
      NODE_NAME:         (v1:spec.nodeName)
    Mounts:
      /tmp/hostpath-provisioner from pv-volume (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from default-token-7wwvj (ro)
Conditions:
  Type          Status
  Initialized   True
  Ready         True
  PodScheduled  True
Volumes:
  pv-volume:
    Type:       HostPath (bare host directory volume)
    Path:       /tmp/hostpath-provisioner
  default-token-7wwvj:
    Type:       Secret (a volume populated by a Secret)
    SecretName: default-token-7wwvj
    Optional:   false
QoS Class:      BestEffort
Node-Selectors: <none>
Tolerations:    node.alpha.kubernetes.io/notReady=:Exists:NoExecute for 300s
                node.alpha.kubernetes.io/unreachable=:Exists:NoExecute for 300s
Events:         <none>

然后我按照项目主页的说明创建了存储 class，并且存储 class 创建得很好：

[root@umeshworkstation hostpath-provisioner]# kubectl describe sc example-hostpath
Name:           example-hostpath
IsDefaultClass: No
Annotations:    <none>
Provisioner:    example.com/hostpath
Parameters:     <none>
Events:         <none>

下一步是使用 claim.yaml 从同一位置创建 PVC，但 PVC 仍处于挂起状态，并且描述显示它无法找到供应商示例。com/hostpath:

[root@umeshworkstation hostpath-provisioner]# kubectl describe pvc
Name:           hostpath
Namespace:      default
StorageClass:   example-hostpath
Status:         Pending
Volume:
Labels:         <none>
Annotations:    volume.beta.kubernetes.io/storage-class=example-hostpath
                volume.beta.kubernetes.io/storage-provisioner=example.com/hostpath
Capacity:
Access Modes:
Events:
  FirstSeen     LastSeen        Count   From                            SubObjectPath   Type            Reason                  Message
  ---------     --------        -----   ----                            -------------   --------        ------                  -------
  2h            11s             874     persistentvolume-controller                     Normal          ExternalProvisioning    cannot find provisioner "example.com/hostpath", expecting that a volume for the claim is provisioned either manually or via external software

PVC因此一直处于Pending状态。

我是不是漏掉了什么？

Answer 1

我已经找到问题了。感谢@jaxxstorm 帮助我朝着正确的方向前进。

当我检查 provisioner pod 日志时，我发现它无法访问 API 服务器以列出 StorageClass、PVC 或 PV，因为它是使用默认服务帐户创建的，没有访问权限这些 APIs.

解决方案是创建单独的服务帐户、pod 安全策略、集群角色和集群角色绑定，如 NFS external provisioner here

所述

在此之后我可以看到我的 PVC 绑定到显示挂载的卷和主机路径

[root@umeshworkstation hostpath-provisioner]# kubectl get pvc
NAME       STATUS    VOLUME                                     CAPACITY   ACCESSMODES   STORAGECLASS       AGE
hostpath   Bound     pvc-8179c8d6-36db-11e7-9ed4-005056a21a50   1Mi        RWX           example-hostpath   1m

[root@umeshworkstation hostpath-provisioner]# ls /tmp/hostpath-provisioner/
pvc-8179c8d6-36db-11e7-9ed4-005056a21a50

Kubernetes 主机路径外部供应商 - PVC 待处理

Kubernetes Hostpath External Provisioner - PVC Pending

dynamic

provisioning

kubernetes