Helm / Kubernetes - 状态集和权限

Question

我一直看到这个错误：

Events:
  FirstSeen LastSeen    Count   From        SubObjectPath   Type        Reason      Message
  --------- --------    -----   ----        -------------   --------    ------      -------
  12s       2s      12  {statefulset }          Warning     FailedCreate    create Pod pgset-0 in StatefulSet pgset failed error: pods "pgset-0" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{26}: 26 is not an allowed group]

我创建了一个名为 "pgset-sa" 的 ServiceAccount，并授予它集群管理员角色。我一直在研究其他方法来让它工作（包括编辑 scc restricted），但不断收到 fsGroup 的错误，指出它不是允许的组。我错过了什么？

apiVersion: apps/v1beta1
kind: StatefulSet
metadata:
  name: "{{.Values.ContainerName}}"
  labels:
    name: "{{.Values.ReplicaName}}"
    app: "{{.Values.ContainerName}}"
    chart: "{{.Chart.Name}}-{{.Chart.Version}}"
  annotations:
    "helm.sh/created": {{.Release.Time.Seconds | quote }}
spec:
  selector:
    matchLabels:
      app: "{{.Values.ContainerName}}"
  serviceName: "{{.Values.ContainerName}}"
  replicas: 2
  template:
    metadata:
      labels:
        app: "{{.Values.ContainerName}}"
    spec:
      serviceAccount: "{{.Values.ContainerServiceAccount}}"
      securityContext:
        fsGroup: 26
      terminationGracePeriodSeconds: 10
      containers:
      - name: {{.Values.ContainerName}}
        image: "{{.Values.PostgresImage}}"
        ports:
        - containerPort: 5432
          name: postgres
        resources:
          requests:
            cpu: {{default "100m" .Values.Cpu}}
            memory: {{default "100M" .Values.Memory}}
        env:
        - name: PGHOST
          value: /tmp
        - name: PG_PRIMARY_USER
          value: primaryuser
        - name: PG_MODE
          value: set
        - name: PG_PRIMARY_HOST
          value: "{{.Values.PrimaryName}}"
        - name: PG_PRIMARY_PORT
          value: "5432"
        - name: PG_PRIMARY_PASSWORD
          value: "{{.Values.PrimaryPassword}}"
        - name: PG_USER
          value: testuser
        - name: PG_PASSWORD
          value: "{{.Values.UserPassword}}"
        - name: PG_DATABASE
          value: userdb
        - name: PG_ROOT_PASSWORD
          value: "{{.Values.RootPassword}}"
        volumeMounts:
        - name: pgdata
          mountPath: "/pgdata"
          readOnly: false
      volumes:
      - name: pgdata
        persistentVolumeClaim:
          claimName: {{.Values.PVCName}}

Answer 1

看看这篇标题为：Managing Security Context Constraints.

的文档

必须为与 statefulset 关联的服务帐户授予足以允许 pod 的安全上下文约束（在本例中，该约束要么恰好允许 fsGroup 26，要么允许任何 fsGroup）。

Helm / Kubernetes - 状态集和权限

Helm / Kubernetes - Statefulset & Permissions

postgresql

containers

kubernetes

kubernetes-helm

statefulset