我有一个 K8s 部署,它将一个秘密挂载到/etc/google-cloud-account
包含要从应用程序使用的 Google auth JSON 文件中。当我尝试运行部署时,我的 pod 出现以下错误:
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Normal Created Created container with docker id 36b85ec8415a; Security:[seccomp=unconfined]
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning Failed Failed to start container with docker id 36b85ec8415a with error: Error response from daemon: rpc error: code = 2 desc = "oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system"
1m 1m 1 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x Warning FailedSync Error syncing pod, skipping: failed to "StartContainer" for "api" with RunContainerError: "runContainer: Error response from daemon: rpc error: code = 2 desc = \"oci runtime error: could not synchronise with container process: mkdir /var/lib/docker/overlay/b4aa81194f72ccb54d88680e766a921ea26f7a4df0f4b32d6030123896b2b203/merged/etc/google-cloud-account: read-only file system\""
2m 13s 11 kubelet, gke-development-cluster-default-pool-17f531d7-sj4x spec.containers{api} Warning BackOff Back-off restarting failed docker container
有问题的部署如下所示:
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
# ...
spec:
replicas: {{ .Values.api.replicaCount }}
template:
# ...
spec:
containers:
- name: {{ .Values.api.name }}
# ...
volumeMounts:
- name: google-cloud-account
mountPath: /etc/google-cloud-account
volumes:
- name: google-cloud-account
secret:
secretName: {{ template "fullname" . }}
items:
- key: google-cloud-credentials
path: credentials.json
我不知道/etc
容器中的只读文件系统如何,也不知道如何更改它。