Azure Kubernetes集群中使用Azure Files作为PV的MySQL实例无法启动问题求助

I've run into this exact issue before with Azure Files and MySQL—here's how to resolve it, along with why it's happening:

Quick Fix: Disable SSL Auto-Generation #

The root problem is that Azure Files (using SMB) doesn't support chmod/chown operations after mounting—permissions are fixed at mount time via your storage class's dir_mode and file_mode settings. MySQL tries to set restrictive permissions (600) on auto-generated SSL certificates like ca-key.pem, which fails on SMB volumes.

To fix this, add the --skip-ssl flag to your MySQL container's startup arguments to disable SSL certificate generation entirely:

args:
- "--ignore-db-dir=lost+found"
- "--initialize-insecure"
- "--skip-ssl"

Update your Deployment with this change, and the Azure Files-backed MySQL instance should start successfully.

Why This Works #

When you enable SSL (the default for MySQL 5.7+), the initialization process generates SSL certificates in /var/lib/mysql (your Azure Files mount point). It then attempts to lock down their permissions to prevent unauthorized access—but SMB volumes don't allow post-mount permission changes, even if the file was created with full 777 permissions. Disabling SSL skips this certificate generation and permission-modification step entirely.

Alternative: Use Pre-Provided SSL Certificates (If You Need SSL) #

If you require SSL for your MySQL instance, don't let MySQL auto-generate certificates on the Azure Files volume. Instead:

• Create your own SSL certificates (or use self-signed ones)
• Mount them to a different path in the container (e.g., an emptyDir or a small Azure Disk volume that supports permission changes)
• Add MySQL startup flags to point to these pre-existing certificates:

  args:
  - "--ignore-db-dir=lost+found"
  - "--initialize-insecure"
  - "--ssl-ca=/path/to/custom/ca.pem"
  - "--ssl-cert=/path/to/custom/server-cert.pem"
  - "--ssl-key=/path/to/custom/server-key.pem"
  

Note on NFS Azure Files #

You mentioned testing NFS v3—if you go that route, make sure your storage class sets the correct uid and gid for the mysql user (default UID/GID is 999 for MySQL 5.7). NFS does support post-mount permission changes, so MySQL will be able to modify certificate permissions if the volume is mounted with the right ownership. Here's an example storage class for NFS:

apiVersion: storage.k8s.io/v1
kind: StorageClass
mountOptions:
  - nfsvers=3
parameters:
  skuName: Standard_LRS
provisioner: file.csi.azure.com
reclaimPolicy: Delete
volumeBindingMode: Immediate
metadata:
  name: azure-file-nfs

When creating your PVC, add annotations to set the UID/GID:

metadata:
  name: azurefile-pvc-nfs
  annotations:
    volume.beta.kubernetes.io/mount-options: "uid=999,gid=999"

This should let MySQL modify file permissions on the NFS volume without issues.

内容的提问来源于stack exchange，提问作者Peter Kracik