elasticsearch.yml 在使用 Kubernetes ConfigMap 加載時是只讀的

Question

我試圖加載elasticsearch.yml使用文件ConfigMap同時使用Kubernetes安裝ElasticSearch。

kubectl create configmap elastic-config --from-file=./elasticsearch.yml

elasticsearch.yml文件被加載到容器中， root作為其所有者和只讀權限 ( https://github.com/kubernetes/kubernetes/issues/62099 )。 由於 ElasticSearch 不會以root所有權開始，因此 pod 會崩潰。

作為解決方法，我嘗試將ConfigMap掛載到不同的文件，然后使用initContainer將其復制到config目錄。 但是config目錄下的文件好像沒有更新。 有什么我遺漏的，或者有沒有其他方法可以做到這一點？

ElasticSearch Kubernetes StatefulSet：

apiVersion: apps/v1
kind: StatefulSet
metadata: 
  name: es-cluster
  labels:
    app: elasticservice
spec:
  serviceName: elasticsearch
  replicas: 1
  selector: 
    matchLabels:
      app: elasticsearch
  template:
    metadata:
      labels:
        app: elasticsearch
    spec:
      containers:
      - name: elasticsearch
        image: docker.elastic.co/elasticsearch/elasticsearch:6.5.4
        resources:
          limits:
            cpu: 1000m
          requests: 
            cpu: 100m
        ports:
        - containerPort: 9200
          name: rest
          protocol: TCP
        - containerPort: 9300
          name: inter-node
          protocol: TCP
        volumeMounts:
        - name: elastic-config-vol
          mountPath: /tmp/elasticsearch
        - name:  elastic-storage
          mountPath: /usr/share/elasticsearch/data
        env:
          - name: cluster.name
            value: docker-elastic
          - name: node.name
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: discovery.zen.ping.unicast.hosts
            value: "elastic-service"
          - name: discovery.zen.minimum_master_nodes
            value: "1"
          - name: node.master
            value: "true"
          - name: node.data
            value: "true"
          - name: ES_JAVA_OPTS
            value: "-Xmx256m -Xms256m"
      volumes:
        - name: elastic-config-vol
          configMap:
           name: elastic-config
           items:
           - key: elasticsearch.yml
             path: elasticsearch.yml
        - name: elastic-config-dir
          emptyDir: {}
        - name: elastic-storage
          emptyDir: {}
      initContainers:
        # elasticsearch will not run as non-root user, fix permissions
      - name: fix-vol-permission
        image: busybox
        command:
          - sh
          - -c
          - chown -R 1000:1000 /usr/share/elasticsearch/data
        securityContext:
          privileged: true
        volumeMounts:
          - name: elastic-storage
            mountPath: /usr/share/elasticsearch/data
      - name: fix-config-vol-permission
        image: busybox
        command:
          - sh
          - -c
          - cp /tmp/elasticsearch/elasticsearch.yml /usr/share/elasticsearch/config/elasticsearch.yml
        securityContext:
          privileged: true
        volumeMounts:
          - name: elastic-config-dir
            mountPath: /usr/share/elasticsearch/config
          - name: elastic-config-vol
            mountPath: /tmp/elasticsearch
      # increase default vm.max_map_count to 262144
      - name: increase-vm-max-map-count
        image: busybox
        command:
          - sysctl
          - -w
          - vm.max_map_count=262144
        securityContext: 
          privileged: true
      - name: increase-the-ulimit
        image: busybox
        command:
          - sh
          - -c
          - ulimit -n 65536
        securityContext:
          privileged: true

Answer 1

我用：

...
        volumeMounts:
        - name: config
          mountPath: /usr/share/elasticsearch/config/elasticsearch.yml
          subPath: elasticsearch.yml
      volumes:
      - name : config
        configMap:
          name: es-configmap

沒有任何權限問題，但您可以使用defaultMode設置權限