存儲虛假 SSL 證書的意外錯誤：無法創建 PEM 證書

Question

-------------------------------------------------------------------------------
NGINX Ingress controller
  Release:       0.26.1
  Build:         git-2de5a893a
  Repository:    https://github.com/kubernetes/ingress-nginx
  nginx version: openresty/1.15.8.2

-------------------------------------------------------------------------------

W0719 06:58:01.543840       6 flags.go:243] SSL certificate chain completion is disabled (--enable-ssl-chain-completion=false)
W0719 06:58:01.544045       6 client_config.go:541] Neither --kubeconfig nor --master was specified.  Using the inClusterConfig.  This might not work.
I0719 06:58:01.544341       6 main.go:182] Creating API client for https://10.233.0.1:443
I0719 06:58:01.558257       6 main.go:226] Running in Kubernetes cluster version v1.16 (v1.16.3) - git (clean) commit b3cbbae08ec52a7fc73d334838e18d17e8512749 - platform linux/amd64
F0719 06:58:01.857260       6 ssl.go:389] unexpected error storing fake SSL Cert: could not create PEM certificate file /etc/ingress-controller/ssl/default-fake-certificate.pem: open /etc/ingress-controller/ssl/default-fake-certificate.pem: permission denied

1.我的ingress-controller有3個副本，但是2個副本正常，1個副本異常。

我是中國人，我會說一點英文。歡迎幫忙解答

Answer 1

MountVolume.SetUp 卷“ingress-nginx-token-w8mq2”失敗：無法同步秘密緩存：等待條件超時

NAME                             READY   STATUS             RESTARTS   AGE
ingress-nginx-controller-7p77g   1/1     Running            0          3h19m
ingress-nginx-controller-9cwzt   0/1     CrashLoopBackOff   2          12m
ingress-nginx-controller-qbww8   1/1     Running            0          3h19m

Answer 2

如果我正確理解您的問題，您可以通過在 yaml 文件的SecurityContext中添加runAsUser指令來解決它。 看例子yaml：

securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
  fsGroupChangePolicy: "OnRootMismatch"

在這里你可以找到關於 Kuberenetes 安全上下文的完整指南。 您需要輸入有權創建證書的用戶 ID。

也可以看看：

• 堆棧上的類似問題
• 與此問題相關的文章和可能的解決方案