K8s 部署 postgresql 遇到 Operation not permitted(已解決)

Question

後續發現是 pvc 掛載路徑問題導致 /var/lib/postgresql/13/main 一直出現問題
解決方法 - 把 data pvc 掛載路徑加上 :z

:z 是一個 SELinux 的標記，用於指定該目錄的安全上下文，表示將這個目錄的 SELinux 安全上下文設置為共享，允許多個容器或進程訪問這個目錄。

k8s.yaml

kind: StatefulSet
apiVersion: apps/v1
metadata:
  name: pg-gvm-v1
  namespace: openvas
  creationTimestamp: '2025-01-14T09:30:03Z'
  labels:
    app: pg-gvm
    version: v1
  annotations:
    kubesphere.io/creator: admin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: pg-gvm
      version: v1
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: pg-gvm
        version: v1
      annotations:
        kubesphere.io/creator: admin
        kubesphere.io/imagepullsecrets: '{}'
        kubesphere.io/restartedAt: '2025-01-15T00:44:55.571Z'
        logging.kubesphere.io/logsidecar-config: '{}'
    spec:
      volumes:
        - name: volume-h8srnm
          persistentVolumeClaim:
            claimName: psql-data
        - name: volume-81efho
          persistentVolumeClaim:
            claimName: psql-socket
      containers:
        - name: pg-gvm
          image: 'registry.community.greenbone.net/community/pg-gvm:stable'
          command:
            - /usr/local/bin/entrypoint
            - /usr/local/bin/start-postgresql
          ports:
            - name: tcp-5432
              containerPort: 5432
              protocol: TCP
          resources: {}
          volumeMounts:
            - name: volume-h8srnm
              mountPath: '/var/lib/postgresql:z'
            - name: volume-81efho
              mountPath: /var/run/postgresql
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities: {}
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      dnsPolicy: ClusterFirst
      serviceAccountName: default
      serviceAccount: default
      securityContext: {}
      schedulerName: default-scheduler
  serviceName: pg-gvm
  podManagementPolicy: OrderedReady
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      partition: 0
  revisionHistoryLimit: 10
  persistentVolumeClaimRetentionPolicy:
    whenDeleted: Retain
    whenScaled: Retain

log

2025-01-15T08:45:32.687852100+08:00 The PostgreSQL server failed to start. Please check the log output:

2025-01-15T08:45:32.687903962+08:00 2025-01-15 00:45:02.452 UTC [23] LOG:  starting PostgreSQL 13.18 (Debian 13.18-0+deb11u1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 10.2.1-6) 10.2.1 20210110, 64-bit

2025-01-15T08:45:32.687910449+08:00 2025-01-15 00:45:02.454 UTC [23] LOG:  listening on Unix socket "/tmp/.s.PGSQL.5432"

2025-01-15T08:45:32.687913598+08:00 2025-01-15 00:45:02.463 UTC [24] LOG:  database system was shut down at 2024-12-05 13:18:48 UTC

2025-01-15T08:45:32.687916692+08:00 2025-01-15 00:45:02.468 UTC [23] LOG:  database system is ready to accept connections

2025-01-15T08:45:33.496531786+08:00 CREATE ROLE

2025-01-15T08:45:33.545454798+08:00 GRANT ROLE

2025-01-15T08:45:33.654249579+08:00 CREATE EXTENSION

2025-01-15T08:45:33.760693823+08:00 CREATE EXTENSION

2025-01-15T08:45:33.862124217+08:00 CREATE EXTENSION

2025-01-15T08:45:34.086925834+08:00 2025-01-15 00:45:34.086 UTC [149] LOG:  starting PostgreSQL 13.18 (Debian 13.18-0+deb11u1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 10.2.1-6) 10.2.1 20210110, 64-bit

2025-01-15T08:45:34.087088429+08:00 2025-01-15 00:45:34.087 UTC [149] LOG:  listening on IPv4 address "0.0.0.0", port 5432

2025-01-15T08:45:34.087095441+08:00 2025-01-15 00:45:34.087 UTC [149] LOG:  listening on IPv6 address "::", port 5432

2025-01-15T08:45:34.090245824+08:00 2025-01-15 00:45:34.090 UTC [149] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"

2025-01-15T08:45:34.097300942+08:00 2025-01-15 00:45:34.097 UTC [150] LOG:  database system was shut down at 2025-01-15 00:45:33 UTC

2025-01-15T08:45:34.102783097+08:00 2025-01-15 00:45:34.102 UTC [149] LOG:  database system is ready to accept connections

Answer 1

让【道友老李】来帮你解答，本回答参考gpt编写，并整理提供，如果还有疑问可以点击头像关注私信或评论。

如果答案让您满意，请采纳、关注，非常感谢！

根据您提供的信息，问题出现在无法更改/var/lib/postgresql和/var/run/postgresql的所有者。这是因为容器中的进程尝试以不允许的用户ID运行所致。 解决方法是在StatefulSet yaml文件中的容器定义中为容器添加适当的 securityContext 配置。您可以尝试将 runAsUser 和 runAsGroup 配置为合适的用户ID，以确保容器以正确的用户身份运行。 以下是一个示例代码片段，显示了如何在 StatefulSet 中为容器添加适当的 securityContext 配置：

containers:
  - name: pg-gvm
    image: 'registry.community.greenbone.net/community/pg-gvm:stable'
    securityContext:
      runAsUser: 999 # 更改为正确的用户ID
      runAsGroup: 999 # 更改为正确的组ID
    command: 
      - "/usr/local/bin/entrypoint"
    args:
      - "/usr/local/bin/start-postgresql"
    ports:
      - name: tcp-0
        containerPort: 5432
        protocol: TCP
    resources: {}
    volumeMounts:
      - name: volume-ei4972
        mountPath: /var/lib/postgresql
      - name: volume-cxxjl1
        mountPath: /var/run/postgresql
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    imagePullPolicy: IfNotPresent

请注意，在上面的示例代码中，我将 runAsUser 和 runAsGroup 配置为999，您需要根据您实际的环境和需求来设置正确的用户ID和组ID。 通过添加正确的 securityContext 配置，应该可以解决容器无法更改所有者的问题。希望这可以帮助您解决问题。