頭盔/ Kubernetes-狀態和權限

Question

我一直看到此錯誤：

Events:
  FirstSeen LastSeen    Count   From        SubObjectPath   Type        Reason      Message
  --------- --------    -----   ----        -------------   --------    ------      -------
  12s       2s      12  {statefulset }          Warning     FailedCreate    create Pod pgset-0 in StatefulSet pgset failed error: pods "pgset-0" is forbidden: unable to validate against any security context constraint: [fsGroup: Invalid value: []int64{26}: 26 is not an allowed group]

我創建了一個名為“ pgset-sa”的ServiceAccount，並將其授予集群管理員角色。 我一直在研究使它起作用的其他方法（包括限制scc的編輯），但是不斷從fsGroup收到錯誤消息，指出它不是允許的組。 我想念什么？

apiVersion: apps/v1beta1
kind: StatefulSet
metadata:
  name: "{{.Values.ContainerName}}"
  labels:
    name: "{{.Values.ReplicaName}}"
    app: "{{.Values.ContainerName}}"
    chart: "{{.Chart.Name}}-{{.Chart.Version}}"
  annotations:
    "helm.sh/created": {{.Release.Time.Seconds | quote }}
spec:
  selector:
    matchLabels:
      app: "{{.Values.ContainerName}}"
  serviceName: "{{.Values.ContainerName}}"
  replicas: 2
  template:
    metadata:
      labels:
        app: "{{.Values.ContainerName}}"
    spec:
      serviceAccount: "{{.Values.ContainerServiceAccount}}"
      securityContext:
        fsGroup: 26
      terminationGracePeriodSeconds: 10
      containers:
      - name: {{.Values.ContainerName}}
        image: "{{.Values.PostgresImage}}"
        ports:
        - containerPort: 5432
          name: postgres
        resources:
          requests:
            cpu: {{default "100m" .Values.Cpu}}
            memory: {{default "100M" .Values.Memory}}
        env:
        - name: PGHOST
          value: /tmp
        - name: PG_PRIMARY_USER
          value: primaryuser
        - name: PG_MODE
          value: set
        - name: PG_PRIMARY_HOST
          value: "{{.Values.PrimaryName}}"
        - name: PG_PRIMARY_PORT
          value: "5432"
        - name: PG_PRIMARY_PASSWORD
          value: "{{.Values.PrimaryPassword}}"
        - name: PG_USER
          value: testuser
        - name: PG_PASSWORD
          value: "{{.Values.UserPassword}}"
        - name: PG_DATABASE
          value: userdb
        - name: PG_ROOT_PASSWORD
          value: "{{.Values.RootPassword}}"
        volumeMounts:
        - name: pgdata
          mountPath: "/pgdata"
          readOnly: false
      volumes:
      - name: pgdata
        persistentVolumeClaim:
          claimName: {{.Values.PVCName}}

Answer 1

看一下標題為： 管理安全上下文約束的文檔。

必須為與有狀態集關聯的服務帳戶授予一個安全上下文約束，該約束應足以允許Pod（在這種情況下，該容器要么完全允許fsGroup 26，要么允許任何fsGroup）。