使用谷歌云 sdk 在 GCS 存储桶上上传数据时，Kube.netes cronjob 出现错误

Question

**Yaml for kubernetes that is first used to create raft backup and then upload into gas bucket**

apiVersion: batch/v1beta1
kind: CronJob
metadata:
  labels:
    app.kubernetes.io/component: raft-backup
    numenapp: raft-backup
  name: raft-backup
  namespace: raft-backup
spec:
  concurrencyPolicy: Forbid
  failedJobsHistoryLimit: 3
  jobTemplate:
    spec:
      template:
        metadata:
          annotations:
            vault.security.banzaicloud.io/vault-addr: https://vault.vault-internal.net:8200
          labels:
            app.kubernetes.io/component: raft-backup
        spec:
          containers:
          - args:
              - |
                SA_TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token);
                export VAULT_TOKEN=$(vault write -field=token auth/kubernetes/login jwt=$SA_TOKEN role=raft-backup);
                vault operator raft snapshot save /share/vault-raft.snap;
                echo "snapshot is success"
            command: ["/bin/sh", "-c"]
            env:
            - name: VAULT_ADDR
              value: https://vault.vault-internl.net:8200
            image: vault:1.10.9
            imagePullPolicy: Always
            name: snapshot
            volumeMounts:
            - mountPath: /share
              name: share
          - args:
            - -ec
            - sleep 500
            - "until [ -f /share/vault-raft.snap ]; do sleep 5; done;\ngsutil cp /share/vault-raft.snap\
              \ gs://raft-backup/vault_raft_$(date +\"\
              %Y%m%d_%H%M%S\").snap;\n"
            command:
            - /bin/sh
            image: gcr.io/google.com/cloudsdktool/google-cloud-cli:latest
            imagePullPolicy: IfNotPresent
            name: upload
            securityContext:
              allowPrivilegeEscalation: false
            volumeMounts:
            - mountPath: /share
              name: share
          restartPolicy: OnFailure
          securityContext:
            fsGroup: 1000
            runAsGroup: 1000
            runAsUser: 1000
          serviceAccountName: raft-backup
          volumes:
          - emptyDir: {}
            name: share
  schedule: '*/3 * * * *'
  startingDeadlineSeconds: 60
  successfulJobsHistoryLimit: 3
  suspend: false

在上传 pod 中运行 gsutil 命令时出错

$ gsutil Traceback（最近调用最后一次）：文件“/usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/configurations/named_configs.py”，第 172 行，在 ActiveConfig 中返回 ActiveConfig(force_create=True) 文件“ /usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/configurations/named_configs.py”，第 492 行，在 ActiveConfig config_name = _CreateDefaultConfig(force_create) 文件“/usr/lib/google-cloud-sdk/lib/ googlecloudsdk/core/configurations/named_configs.py”，第 640 行，在 _CreateDefaultConfig file_utils.MakeDir(paths.named_config_directory) 文件“/usr/lib/google-cloud-sdk/lib/googlecloudsdk/core/util/files.py”中，第 125 行，在 MakeDir os.makedirs(path, mode=mode) 文件“/usr/bin/../lib/google-cloud-sdk/platform/bundledpythonunix/lib/python3.9/os.py”中，第 215 行，在 makedirs makedirs(head, exist_ok=exist_ok) 文件“/usr/bin/../lib/google-cloud-sdk/platform/bundledpythonunix/lib/python3.9/os.py”，第 215 行，在 makedirs makedirs (head, exist_ok=exist_ok) 文件“/usr/bin/../lib/google-cloud-sdk/platform/bundl edpythonunix/lib/python3.9/os.py”，第 225 行，在 makedirs mkdir(name, mode) OSError: [Errno 30] Read-only file system: '/home/cloudsdk/.config' $ command terminated with exit代码 137

Answer 1

OSError: [Errno 30] Read-only file system: '/home/cloudsdk/.config' $ command terminated with exit code 137

看来你没有在你的 cronJob 中给予足够的许可。

尝试改变：

securityContext:
  fsGroup: 1000
  runAsGroup: 1000
  runAsUser: 1000

经过：

securityContext:
  privileged: true

告诉我它是否有效，我们可以讨论它。

编辑完整的回复：

使用此apiVersion: batch/v1而不是apiVersion: batch/v1beta1