Pod 访问已经存在的 PVC 子目录

Question

我有一个使用 git-sync 图像的部署创建的 pod，并将该卷挂载到 PVC

kind: Deployment
metadata:
  name: config
  namespace: test
spec:
  replicas: 1
  selector:
    matchLabels:
      demo: config
  template:
    metadata:
      labels:
        demo: config
    spec:
      containers:
        - args:
            - '-ssh'
            - '-repo=git@domain.com:org/repo.git'
            - '-dest=conf'
            - '-branch=master'
            - '-depth=1'
          image: 'k8s.gcr.io/git-sync:v3.1.1'
          name: git-sync
          securityContext:
            runAsUser: 65533
          volumeMounts:
            - mountPath: /etc/git-secret
              name: git-secret
              readOnly: true
            - mountPath: /config
              name: cus-config
      securityContext:
        fsGroup: 65533
      volumes:
        - name: git-secret
          secret:
            defaultMode: 256
            secretName: git-creds
        - name: cus-config
          persistentVolumeClaim:
            claimName: cus-config

部署后查看pod，得到了这样一个文件路径
/tmp/git/conf/subdirA/some.Files
然后我从另一个部署创建了第二个 pod，并想将 tmp/git/conf/subdirA 安装在第二个 pod 上。这是我的第二个部署脚本的示例。

kind: Deployment
metadata:
  name: test-mount-config
  namespace: test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
        - image: 'nginx:1.7.9'
          name: nginx
          ports:
            - containerPort: 80
          volumeMounts:
            - mountPath: /root/conf
              name: config
              subPath: tmp/git/conf/subdirA
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: cus-config

这是我的 PVC

kind: PersistentVolumeClaim
metadata:
  annotations:
    volume.beta.kubernetes.io/storage-class: conf
  name: config
  namespace: test
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 10Mi
---
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: conf
  namespace: test
provisioner: spdbyz
reclaimPolicy: Retain

我已经读过 PVC 上的子路径，但每次我检查第二个 pod 上的文件夹 /root/conf 时，里面什么都没有。
关于如何在另一个 pod 上挂载特定 PVC 子目录的任何想法？

Answer 1

关于如何使用 PV/PVC

在 PODs 之间共享文件内容的非常基本的示例

首先创建一个持久卷参考下面带有hostPath配置的yaml示例

apiVersion: v1
kind: PersistentVolume
metadata:
  name: my-pv-1
  labels:
    pv: my-pv-1
spec:
  capacity:
    storage: 1Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /var/log/mypath

$ kubectl create -f pv.yaml
persistentvolume/my-pv-1 created

第二个 使用下面的 yaml 示例创建持久卷声明

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: my-pvc-claim-1
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
  selector:
    matchLabels:
      pv: my-pv-1


$ kubectl create -f pvc.yaml
persistentvolumeclaim/my-pvc-claim-1 created

验证 pv 和 pvc STATUS 是否设置为 BOUND

$ kubectl get persistentvolume
NAME      CAPACITY   ACCESS MODES   RECLAIM POLICY   STATUS   CLAIM                  STORAGECLASS   REASON   AGE
my-pv-1   1Gi        RWX            Retain           Bound    default/my-pvc-claim-1                         62s

$ kubectl get persistentvolumeclaims
NAME             STATUS   VOLUME    CAPACITY   ACCESS MODES   STORAGECLASS   AGE
my-pvc-claim-1   Bound    my-pv-1   1Gi        RWX                           58

第三次 使用所需的 pvc PODs 参考下面的示例 yaml，其中卷安装在两个 pods nginx-1 和 nginx-2 上。

apiVersion: v1
kind: Pod
metadata:
  name: nginx-1
spec:
  containers:
  - image: nginx
    name: nginx-1
    volumeMounts:
    - mountPath: /var/log/mypath
      name: test-vol
      subPath: TestSubPath
  volumes:
  - name: test-vol
    persistentVolumeClaim:
        claimName: my-pvc-claim-1


$ kubectl create -f nginx-1.yaml
pod/nginx-1 created


$ kubectl get pods -o wide
NAME             READY   STATUS    RESTARTS   AGE   IP            NODE         NOMINATED NODE   READINESS GATES
nginx-1   1/1     Running   0          35s   10.244.3.53   k8s-node-3   <none>           <none>

创建第二个 POD 并使用相同的 PVC

apiVersion: v1
kind: Pod
metadata:
  name: nginx-2
spec:
  containers:
  - image: nginx
    name: nginx-2
    volumeMounts:
    - mountPath: /var/log/mypath
      name: test-vol
      subPath: TestSubPath
  volumes:
  - name: test-vol
    persistentVolumeClaim:
        claimName: my-pvc-claim-1


$ kubectl create -f nginx-2.yaml
pod/nginx-2 created


$ kubectl get pods -o wide
NAME             READY   STATUS    RESTARTS   AGE   IP            NODE         NOMINATED NODE   READINESS GATES
nginx-1   1/1     Running   0          55s   10.244.3.53   k8s-node-3   <none>           <none>
nginx-2   1/1     Running   0          35s   10.244.3.54   k8s-node-3   <none>           <none>

通过连接到容器 1 进行测试并写入挂载路径上的文件。

root@nginx-1:/# df -kh
Filesystem      Size  Used Avail Use% Mounted on
overlay          12G  7.3G  4.4G  63% /
tmpfs            64M     0   64M   0% /dev
tmpfs           3.9G     0  3.9G   0% /sys/fs/cgroup
/dev/vda1        12G  7.3G  4.4G  63% /etc/hosts
shm              64M     0   64M   0% /dev/shm
tmpfs           3.9G   12K  3.9G   1% /run/secrets/kubernetes.io/serviceaccount
tmpfs           3.9G     0  3.9G   0% /proc/acpi
tmpfs           3.9G     0  3.9G   0% /proc/scsi
tmpfs           3.9G     0  3.9G   0% /sys/firmware
root@nginx-1:/# cd /var/log/mypath/
root@nginx-1:/var/log/mypath# date >> date.txt
root@nginx-1:/var/log/mypath# date >> date.txt
root@nginx-1:/var/log/mypath# cat date.txt
Thu Jan 30 10:44:42 UTC 2020
Thu Jan 30 10:44:43 UTC 2020

现在 连接第二个 POD/container 它应该会看到第一个文件，如下所示

$ kubectl exec -it nginx-2 -- /bin/bash
root@nginx-2:/# cat /var/log/mypath/date.txt
Thu Jan 30 10:44:42 UTC 2020
Thu Jan 30 10:44:43 UTC 2020

Pod 访问已经存在的 PVC 子目录

Pod access PVC subdirectory that already existed

kubernetes

kubernetes-pvc

amazon-eks