GitLab CI/CD、Kubernetes 和私有卷

如何解决GitLab CI/CD、Kubernetes 和私有卷

我有一个使用数据库的应用程序。我想设置一个 GitLab CI/CD 管道来将我的应用程序部署到 Kubernetes 集群。我现在的问题是我似乎无法让持久存储工作。我的思考过程如下：

创建持久卷 -> 创建持久卷声明 -> 将该 PVC 挂载到我运行数据库的 pod

我遇到了一个问题，即 PV 是系统范围的配置，因此 GitLab 似乎无法创建一个。如果我设法在部署之前制作 PV，GitLab 只允许我使用特定命名空间中的对象。这意味着 PVC 不会在我的管道运行时看到我创建的 PV。

ma​​nifest.yaml

apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-sql0001
  labels:
    type: amazoneEBS
spec:
  capacity: 
    storage: 15Gi
  accessModes:
    - ReadWriteOnce
  awsElasticBlockStore:
    volumeID: <volume ID>
    fsType: ext4
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sql-pvc
  labels:
    type: amazoneEBS
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 15Gi
  selector:
    matchLabels:
      type: "amazoneEBS"

kubectl 错误

kubectl apply -f manifest.yaml
persistentvolumeclaim/sql-pvc created
Error from server (Forbidden): error when retrieving current configuration of:
Resource: "/v1,Resource=persistentvolumes",GroupVersionKind: "/v1,Kind=PersistentVolume"
Name: "pv-sql0001",Namespace: ""
from server for: "manifest.yaml": persistentvolumes "pv-sql0001" is forbidden: User "system:serviceaccount:namespace:namespace-service-account" cannot get resource "persistentvolumes" in API group "" at the cluster scope

我尝试了@Rakesh Gupta 帖子中推荐的内容，但仍然遇到相同的错误。除非我误会了。

eddy@DESKTOP-1MHAKBA:~$ kubectl describe  ClusterRole  stateful-site-26554211-CR --namespace=stateful-site-26554211-pr
Name:         stateful-site-26554211-CR
Labels:       <none>
Annotations:  <none>
PolicyRule:
  Resources                      Non-Resource URLs  Resource Names  Verbs
  ---------                      -----------------  --------------  -----
  namespaces                     []                 []              [list watch create]
  nodes                          []                 []              [list watch create]
  persistentvolumes              []                 []              [list watch create]
  storageclasses.storage.k8s.io  []                 []              [list watch create]

eddy@DESKTOP-1MHAKBA:~$ kubectl describe  ClusterRoleBinding  stateful-site-26554211-CRB --namespace=stateful-site-26554211-production
Name:         stateful-site-26554211-CRB
Labels:       <none>
Annotations:  <none>
Role:
  Kind:  ClusterRole
  Name:  stateful-site-26554211-CR
Subjects:
  Kind            Name                                               Namespace
  ----            ----                                               ---------
  ServiceAccount  stateful-site-26554211-production-service-account  stateful-site-26554211-production

任何有关我应该如何执行此操作的见解将不胜感激。我可能只是做错了这一切，也许有更好的方法。我会随时回答任何问题。

解决方法

您需要创建一个 ServiceAccount、ClusterRole 和 ClusterRoleBinding，因为 PV、PVC、Nodes 是集群范围的对象。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: <name of your cluster role>
rules:
- apiGroups: [""]
  resources:
  - nodes
  - persistentvolumes
  - namespaces
  verbs: ["list","watch","create"]
- apiGroups: ["storage.k8s.io"]
  resources:
  - storageclasses
  verbs: ["list","create"]
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: <name of your cluster role binding>
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: <name of your cluster role which should be matched with the previous one>
subjects:
  - kind: ServiceAccount
    name: <service account name>

参考：https://stackoverflow.com/a/60617584/2777988

如果这不起作用，您可以尝试从您的 yaml 中删除“PersistentVolume”部分。看起来您的设置不允许 PersistentVolume 创建。但是，PVC 可能会反过来创建 PV。