容器之间的Kubernetes卷-权限被拒绝

Question

我有两个容器：一个是gcloud/gsutil和clickhouse(基于debian/buster-slim，在Dockerfile中没有设置额外的用户或权限(和git-sync容器。我在一个共享音量的Pod中并排运行它们。我在共享卷的git-sync容器中提取了带有sh脚本的存储库。以下是清单：

apiVersion: v1
kind: Pod
metadata:
name: ...
namespace: ...
annotations:
...
labels:
...
spec:
serviceAccountName: airflow
automountServiceAccountToken: true
volumes:
- name: sql
emptyDir: {}
containers:
- name: base
securityContext:
runAsUser: 65533
runAsGroup: 65533
imagePullPolicy: Always
image: clickhouse-client-gcloud:20.6.4.44
volumeMounts:
- name: sql
mountPath: /opt/sql
resources:
requests:
memory: "4000Mi"
cpu: "4"
limits:
memory: "8000Mi"
cpu: "4"
env:
- name: GS_SERVICE_ACCOUNT
valueFrom:
secretKeyRef:
name: ...
key: service_account.json
- name: git-sync
securityContext:
runAsUser: 65533
runAsGroup: 65533
image: k8s.gcr.io/git-sync/git-sync:v3.3.1
imagePullPolicy: Always
volumeMounts:
- name: sql
mountPath: /tmp/git/
resources:
requests:
memory: 300Mi
cpu: 500m
limits:
memory: 600Mi
cpu: 1000m
envFrom:
- configMapRef:
name: ...
- secretRef:
name: ...

所以，我在一个容器中有gcloud和clickhouse客户端，在另一个容器里有sh/sql脚本，它们彼此共享容量。第二个容器中有.sh脚本：

echo $GS_SERVICE_ACCOUNT >> service_account.json 
gcloud auth activate-service-account --key-file=service_account.json

文件结构：

opt/
- cloud_client
- sql
-- git-repo
--- sql
---- 00.raw
----- 01.current.sh

当我运行pod时，对于客户端容器，我有下一个命令和参数：

cmds=["sh"],
arguments=["/opt/sql/git-repo/sql/00.raw/01.current.sh", f"{get_current_parsing_day()}"]

但我得到了：

sh: 0: Can't open /opt/sql/git-repo/sql/00.raw/01.current.sh

如果我使用sleep运行客户端容器，使用/bin/bash在内部连接，并运行sh /opt/sql/git-repo/sql/00.raw/01.current.sh，则文件创建失败。

cannot create service_account.json: Permission denied

如果我继续，cd到那个存储库并运行sh 01.current.sh，那么我会得到gsutil错误：

WARNING: Could not setup log file in /.config/gcloud/logs, (Error: Could not create directory [/.config/gcloud/logs/2021.06.11]: Permission denied.
Please verify that you have permissions to write to the parent directory.)
ERROR: gcloud crashed (ValueError): No key could be detected.
If you would like to report this issue, please run the following command:
gcloud feedback
To check gcloud for common problems, please run the following command:
gcloud info --run-diagnostics

但密钥文件就在那里，它是为服务帐户创建并包含JSON的。。。

我似乎有权限问题，但我不明白该如何解决？我想从两个容器执行文件/脚本，并允许它们写入主容器。

Answer 1

问题出现在securityContext中，我运行了两个容器，但没有作为root运行(尽管这不是一个好的做法(，但这个uid没有在容器本身中定义。

securityContext:
runAsUser: 65533
runAsGroup: 65533

当我删除并重新启动它时，一切都解决了。