无法将秘密挂载到 /etc 中的卷

Question

我有一个 K8s 部署，它将一个秘密安装到 /etc/google-cloud-account 中，其中包含要从应用程序使用的 Google auth JSON 文件。当我尝试运行部署时，我的 pod 出现以下错误：

1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Normal  Created     Created container with docker id 36b85ec8415a; Security:[seccomp=unconfined]
1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Warning Failed      Failed to start container with docker id 36b85ec8415a with error: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system"
1m  1m  1   kubelet, gke-development-cluster-default-pool-17f531d7-sj4x             Warning FailedSync  Error syncing pod, skipping: failed to "StartContainer" for "api" with RunContainerError: "runContainer: Error response from daemon: rpc error: code = 2 desc = \"oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system\""

2m  13s 11  kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api}    Warning BackOff     Back-off restarting failed docker container

有问题的部署如下所示：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # ...
spec:
  replicas: {{ .Values.api.replicaCount }}
  template:
    # ...
    spec:
      containers:
        - name: {{ .Values.api.name }}
          # ...
          volumeMounts:
            - name: google-cloud-account
              mountPath: /etc/google-cloud-account
      volumes:
        - name: google-cloud-account
          secret:
            secretName: {{ template "fullname" . }}
            items:
              - key: google-cloud-credentials
                path: credentials.json

我不知道容器中的 /etc 如何成为只读文件系统，也不知道如何更改它。

Answer 1

事实证明错误是由另一个卷安装引起的。我把它留在了最后的代码中，但我的部署看起来更像下面这样：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # ...
spec:
  replicas: {{ .Values.api.replicaCount }}
  template:
    # ...
    spec:
      containers:
        - name: {{ .Values.api.name }}
          # ...
          volumeMounts:
            - name: google-cloud-account
              mountPath: /etc/google-cloud-account
            - name: odbc
              mountPath: /etc
      volumes:
        - name: google-cloud-account
          secret:
            secretName: {{ template "fullname" . }}
            items:
              - key: google-cloud-credentials
                path: credentials.json
        - name: odbc
          configMap:
            name: {{ template "fullname" . }}
            items:
              - key: odbc.ini
                path: odbc.ini

正在挂载 odbc 接管了整个 /etc 目录。为了修复它，我将 odbc volumeMount 更改为：

- name: odbc
  mountPath: /etc/odbc.ini
  subPath: odbc.ini

/etc 中的其他所有内容都完好无损。

Answer 2

are projected volumes的替代方法：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  # ...
spec:
  replicas: {{ .Values.api.replicaCount }}
  template:
    # ...
    spec:
      containers:
        - name: {{ .Values.api.name }}
          # ...
          volumeMounts:
            - name etc
              mountPath: /etc
            - name: google-cloud-account
              mountPath: /etc/google-cloud-account
            - name: odbc
              mountPath: /etc
      volumes:
        - name: config
          projected:
            sources:
            - secret:
                name: {{ template "fullname" . }}
                items:
                  - key: google-cloud-credentials
                    path: google-cloud-account/credentials.json
            - configMap:
                name: {{ template "fullname" . }}
                items:
                  - key: odbc.ini
                    path: odbc.ini

无法将秘密挂载到 /etc 中的卷

Can't mount secret to volume in /etc

kubernetes

google-kubernetes-engine

kubernetes-helm