无法将密码安装到/ etc中

我有一个K8s部署，它将一个秘密装入/etc/google-cloud-account，其中包含要从应用程序使用的Google auth JSON文件。当我尝试运行部署，我从我的荚收到以下错误：无法将密码安装到/ etc中

1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Normal Created  Created container with docker id 36b85ec8415a; Security:[seccomp=unconfined] 
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning Failed  Failed to start container with docker id 36b85ec8415a with error: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d603b2b203/merged/etc/google-cloud-account: read-only file system" 
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x    Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "api" with RunContainerError: "runContainer: Error response from daemon: rpc error: code = 2 desc = \"oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d603b2b203/merged/etc/google-cloud-account: read-only file system\"" 

2m 13s 11 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning BackOff  Back-off restarting failed docker container

有关部署的样子：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
     volumes: 
     - name: google-cloud-account 
      secret: 
      secretName: {{ template "fullname" . }} 
      items: 
       - key: google-cloud-credentials 
       path: credentials.json

我不知道该怎么/etc容器会一个只读文件系统，不知道如何改变它。

来源

2017-06-14 Dave Long

只是尝试将其安装在其他地方。 GKE在引擎盖下使用了CoreOS，我很确定;这是一个只读的FS，所以你应该安装在/ usr/local /下，这应该是R/W – MrE

@MER看到我的答案在下面。这与另一个卷装有关。 –

事实证明，错误是由另一个卷装载导致的。我离开它的最终代码的，但我的部署看起来更像如下：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
      - name: odbc 
       mountPath: /etc 
     volumes: 
     - name: google-cloud-account 
      secret: 
      secretName: {{ template "fullname" . }} 
      items: 
       - key: google-cloud-credentials 
       path: credentials.json 
     - name: odbc 
      configMap: 
      name: {{ template "fullname" . }} 
      items: 
       - key: odbc.ini 
       path: odbc.ini

安装odbc接手整个/etc目录。为了解决这个问题，我改变了odbcvolumeMount到：

- name: odbc 
    mountPath: /etc/odbc.ini 
    subPath: odbc.ini

其中左侧一切/etc完整别人。

来源

2017-06-15 01:52:53

的替代Dave Long's answer是projected volumes：

apiVersion: extensions/v1beta1 
kind: Deployment 
metadata: 
    # ... 
spec: 
    replicas: {{ .Values.api.replicaCount }} 
    template: 
    # ... 
    spec: 
     containers: 
     - name: {{ .Values.api.name }} 
      # ... 
      volumeMounts: 
      - name etc 
       mountPath: /etc 
      - name: google-cloud-account 
       mountPath: /etc/google-cloud-account 
      - name: odbc 
       mountPath: /etc 
     volumes: 
     - name: config 
      projected: 
      sources: 
      - secret: 
       name: {{ template "fullname" . }} 
       items: 
        - key: google-cloud-credentials 
        path: google-cloud-account/credentials.json 
      - configMap: 
       name: {{ template "fullname" . }} 
       items: 
        - key: odbc.ini 
        path: odbc.ini

来源

2017-10-09 20:07:10 schnatterer

无法将密码安装到/ etc中

回答

相关问题