K8s 部署 PostgreSQL 遇到 Operation not permitted

Question

我正在做 K8s 部署 openvas(greenbone)，遇到了 postgresql 部署的錯誤
這是我的 k8s.yaml

kind: StatefulSet
apiVersion: apps/v1
metadata:
  name: pg-gvm-v1
  namespace: openvas
  creationTimestamp: '2025-01-14T02:07:54Z'
  labels:
    app: pg-gvm
    version: v1
  annotations:
    kubesphere.io/creator: admin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pg-gvm
      version: v1
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: pg-gvm
        version: v1
      annotations:
        kubesphere.io/creator: admin
        kubesphere.io/imagepullsecrets: '{}'
        kubesphere.io/restartedAt: '2025-01-14T03:14:25.202Z'
        logging.kubesphere.io/logsidecar-config: '{}'
    spec:
      volumes:
        - name: volume-ei4972
          persistentVolumeClaim:
            claimName: psql-data
        - name: volume-cxxjl1
          persistentVolumeClaim:
            claimName: psql-socket
      containers:
        - name: pg-gvm
          image: 'registry.community.greenbone.net/community/pg-gvm:stable'
          command:
            - /usr/local/bin/entrypoint
            - /usr/local/bin/start-postgresql
          ports:
            - name: tcp-0
              containerPort: 5432
              protocol: TCP
          resources: {}
          volumeMounts:
            - name: volume-ei4972
              mountPath: /var/lib/postgresql
            - name: volume-cxxjl1
              mountPath: /var/run/postgresql
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            runAsUser: 70
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      serviceAccountName: default
      serviceAccount: default
      securityContext: {}
      schedulerName: default-scheduler
  serviceName: pg-gvm
  podManagementPolicy: OrderedReady
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      partition: 0
  revisionHistoryLimit: 10
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Retain
    whenScaled: Retain

錯誤代碼:

2025-01-14T11:16:15.931658384+08:00 chown: changing ownership of '/var/lib/postgresql': Operation not permitted

2025-01-14T11:16:15.932439991+08:00 chown: changing ownership of '/var/run/postgresql': Operation not permitted

2025-01-14T11:16:15.933268886+08:00 chown: changing ownership of '/var/log/postgresql/postgresql-13-main.log': Operation not permitted

2025-01-14T11:16:15.933282270+08:00 chown: changing ownership of '/var/log/postgresql': Operation not permitted

2025-01-14T11:16:15.934244621+08:00 chown: changing ownership of '/etc/postgresql/13/main/start.conf': Operation not permitted

2025-01-14T11:16:15.934256627+08:00 chown: changing ownership of '/etc/postgresql/13/main/pg_hba.conf': Operation not permitted

2025-01-14T11:16:15.934259260+08:00 chown: changing ownership of '/etc/postgresql/13/main/environment': Operation not permitted

2025-01-14T11:16:15.934300020+08:00 chown: changing ownership of '/etc/postgresql/13/main/conf.d': Operation not permitted

2025-01-14T11:16:15.934305770+08:00 chown: changing ownership of '/etc/postgresql/13/main/postgresql.conf': Operation not permitted

2025-01-14T11:16:15.934308295+08:00 chown: changing ownership of '/etc/postgresql/13/main/pg_ctl.conf': Operation not permitted

2025-01-14T11:16:15.934310294+08:00 chown: changing ownership of '/etc/postgresql/13/main/pg_ident.conf': Operation not permitted

2025-01-14T11:16:15.934312211+08:00 chown: changing ownership of '/etc/postgresql/13/main': Operation not permitted

2025-01-14T11:16:15.934322592+08:00 chown: changing ownership of '/etc/postgresql/13': Operation not permitted

2025-01-14T11:16:15.934325194+08:00 chown: changing ownership of '/etc/postgresql': Operation not permitted

2025-01-14T11:16:15.935148936+08:00 chmod: changing permissions of '/var/lib/postgresql': Operation not permitted

2025-01-14T11:16:15.935667657+08:00 chmod: cannot access '/var/lib/postgresql/13/main': No such file or directory

2025-01-14T11:16:15.937698058+08:00 error: failed switching to "postgres": operation not permitted

請問是哪邊需要加上權限的部分嗎?
還是我的runAsUser:70 錯誤了?

Answer 1

让【道友老李】来帮你解答，本回答参考gpt编写，并整理提供，如果还有疑问可以点击头像关注私信或评论。

如果答案让您满意，请采纳、关注，非常感谢！

根据提供的信息，您遇到了在 Kubernetes 中部署 OpenVAS（Greenbone）时出现 PostgreSQL 部署错误的问题。错误信息显示 chown 命令无法更改文件所有者，提示 "Operation not permitted"。 这通常是由于容器中运行的进程没有足够的权限来更改文件的所有者。您可以尝试在 StatefulSet 的容器定义中为 PostgreSQL 的挂载路径添加更多权限。

1. 确保您使用的是能够提供必要权限的 PersistentVolumeClaim（PVC）定义。在您的 k8s.yaml 文件中，检查名为 psql-data 和 psql-socket 的 PVC 定义。
2. 在 StatefulSet 的容器定义中的 volumeMounts 部分，为挂载路径 /var/lib/postgresql 和 /var/run/postgresql 添加适当的权限设置。您可以使用 securityContext 部分来指定运行容器的用户和组。 例如，在您的容器定义中添加以下内容：

securityContext:
  runAsUser: 999
  runAsGroup: 999
  fsGroup: 999

这将使容器以 UserID 999 和 GroupID 999 的身份运行，并可以更改对应目录的所有者。 3. 应用更改并重新部署 StatefulSet：

kubectl apply -f your-k8s.yaml

请记得根据您的实际情况调整以上示例内容。希望这能帮助解决您的问题。如果问题仍然存在，请提供更多信息或日志以便更好地帮助您解决。