Kubernetes Sidecar容器创建失败：InitContainerRestartPolicyForbidden求助

环境信息 #

• Kubernetes版本：

$ kubectl version
Client Version: v1.28.2
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.28.6

所用Pod配置 #

apiVersion: v1
kind: Pod
metadata:
  name: sidecar
spec:
  initContainers:
  - command:
    - tail
    - -f
    - /dev/null
    image: alpine
    name: sidecar
    restartPolicy: Always
  containers:
  - image: alpine
    name: main
    command:
    - tail
    - -f
    - /dev/null

已执行的特性门控启用操作 #

1. 在控制平面组件配置中添加特性门控参数：

$ sudo grep feature /etc/kubernetes/manifests/*
/etc/kubernetes/manifests/kube-apiserver.yaml:    - --feature-gates=SidecarContainers=true
/etc/kubernetes/manifests/kube-controller-manager.yaml:    - --feature-gates=SidecarContainers=true
/etc/kubernetes/manifests/kube-scheduler.yaml:    - --feature-gates=SidecarContainers=true

2. 修改kubelet的systemd配置文件/etc/systemd/system/kubelet.service.d/10-kubeadm.conf，尝试启用注释中的特性配置，但未生效：

# Note: This dropin only works with kubeadm and kubelet v1.11+
[Service]
Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf"
Environment="KUBELET_CONFIG_ARGS=--config=/var/lib/kubelet/config.yaml"
# This is a file that "kubeadm init" and "kubeadm join" generates at runtime, populating the KUBELET_KUBEADM_ARGS variable dynamically
EnvironmentFile=-/var/lib/kubelet/kubeadm-flags.env
# This is a file that the user can use for overrides of the kubelet args as a last resort. Preferably, the user should use
# the .NodeRegistration.KubeletExtraArgs object in the configuration files instead. KUBELET_EXTRA_ARGS should be sourced from this file.
EnvironmentFile=-/etc/default/kubelet
ExecStart=
ExecStart=/usr/bin/kubelet $KUBELET_KUBECONFIG_ARGS $KUBELET_CONFIG_ARGS $KUBELET_KUBEADM_ARGS $KUBELET_EXTRA_ARGS
#KUBELET_EXTRA_ARGS=--feature-gates=SidecarContainers=true
#Environment="KUBELET_KUBECONFIG_ARGS=--bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --feature-gates=SidecarContainers=true"

错误信息 #

部署Pod后出现如下错误：

$ kubectl get pod sidecar
NAME      READY   STATUS                                RESTARTS   AGE
sidecar   0/2     InitContainerRestartPolicyForbidden   0          2m52s

Pod事件详情：

$ kubectl describe pod sidecar |tail -5
Events:
  Type     Reason                               Age    From               Message
  ----     ------                               ----   ----               -------
  Warning  InitContainerRestartPolicyForbidden  3m24s  kubelet            Init container "sidecar" may not have a non-default restartPolicy
  Normal   Scheduled                            3m24s  default-scheduler  Successfully assigned default/sidecar to choi-k8s-test-node

解决方案 #

1. 确保kubelet正确启用SidecarContainers特性门控 #

SidecarContainers是Alpha特性，需要集群中所有节点的kubelet都启用该特性门控，之前的操作仅注释了配置，未实际启用：

• 编辑/etc/systemd/system/kubelet.service.d/10-kubeadm.conf，取消KUBELET_EXTRA_ARGS=--feature-gates=SidecarContainers=true的注释
• 重新加载systemd配置并重启kubelet：

  sudo systemctl daemon-reload
  sudo systemctl restart kubelet
  

• 验证kubelet参数是否生效：

  ps aux | grep kubelet | grep feature-gates
  

  确认输出中包含--feature-gates=SidecarContainers=true

2. 重新创建Pod #

删除现有失败的Pod并重新应用配置：

kubectl delete pod sidecar
kubectl apply -f <你的Pod配置文件名>.yaml

补充说明 #

在Kubernetes中，默认情况下Init容器不允许设置restartPolicy: Always，仅当启用SidecarContainers特性门控后，才允许将Init容器标记为Sidecar（通过设置restartPolicy: Always），使其在主容器运行期间持续存在。

内容的提问来源于stack exchange，提问作者B A