将云 SQL 凭据挂载到 Kubernetes 中的容器时出现问题

Question

我正在尝试迁移到Cloud SQL（Postgres）。我在 Kubernetes 中有以下部署，遵循了以下说明 https://cloud.google.com/sql/docs/mysql/connect-container-engine：

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: menu-service
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: menu-service
    spec:
      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials
        - name: cloudsql
          emptyDir:
        - name: ssl-certs
          hostPath:
            path: /etc/ssl/certs
      containers:
      - image: gcr.io/cloudsql-docker/gce-proxy:1.11
        name: cloudsql-proxy
        command: ["/cloud_sql_proxy", "--dir=/cloudsql",
                  "-instances=tabb-168314:europe-west2:production=tcp:5432",
                  "-credential_file=/secrets/cloudsql/credentials.json"]
        volumeMounts:
          - name: cloudsql-instance-credentials
            mountPath: /secrets/cloudsql
            readOnly: true
          - name: ssl-certs
            mountPath: /etc/ssl/certs
          - name: cloudsql
            mountPath: /cloudsql
      - name: menu-service
        image: eu.gcr.io/tabb-168314/menu-service:develop
        imagePullPolicy: Always
        env:
        - name: MICRO_BROKER
          value: "nats"
        - name: MICRO_BROKER_ADDRESS
          value: "nats.staging:4222"
        - name: MICRO_REGISTRY
          value: "kubernetes"
        - name: ENV
          value: "staging"
        - name: PORT
          value: "8080"
        - name: POSTGRES_HOST
          value: "127.0.0.1:5432"
        - name: POSTGRES_USER
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: username
        - name: POSTGRES_PASS
          valueFrom:
            secretKeyRef:
              name: cloudsql-db-credentials
              key: password
        - name: POSTGRES_DB
          value: "menus"
        ports:
        - containerPort: 8080

但不幸的是，我在尝试更新部署时收到此错误：

MountVolume.SetUp failed for volume "kubernetes.io/secret/69b0ec99-baaf-11e7-82b8-42010a84010c-cloudsql-instance-credentials" (spec.Name: "cloudsql-instance-credentials") pod "69b0ec99-baaf-11e7-82b8-42010a84010c" (UID: "69b0ec99-baaf-11e7-82b8-42010a84010c") with: secrets "cloudsql-instance-credentials" not found
Error syncing pod, skipping: timeout expired waiting for volumes to attach/mount for pod "staging"/"menu-service-1982520680-qzwzn". list of unattached/unmounted volumes=[cloudsql-instance-credentials]

我在这里错过了什么吗？

Answer 1

您（至少）缺少启动此 Pod 所需的秘密之一，即 cloudsql-instance-credentials 。

从 https://cloud.google.com/sql/docs/mysql/connect-container-engine：

您需要两个密钥才能使容器引擎应用程序能够访问云 SQL 实例中的数据：

• cloudsql-instance-credentials密钥包含服务帐户。
• cloudsql-db-credentials密钥提供代理用户帐户和密码。（我认为您已经创建了这个，我看不到有关此的错误消息）

要创建密钥，请执行以下操作：

创建包含服务帐户的密钥，该帐户启用对云 SQL 的身份验证：

kubectl create secret generic cloudsql-instance-credentials 
                   --from-file=credentials.json=[PROXY_KEY_FILE_PATH]

[...]

上面的链接还介绍了如何为此创建 GCP 服务帐号（如果您尚未创建）。