Helm Chart中ConfigMap通过envFrom无法注入Deployment容器环境变量

现象 #

通过envFrom引用ConfigMap为Deployment容器注入环境变量时，应用无法正确读取这些变量，导致数据库密码验证失败（报错password authentication failed for user "SA_MR_NP"）；但直接使用env字段手动设置环境变量时，应用可以正常获取并启动。

相关配置与日志信息 #

Deployment中的envFrom配置 #

envFrom:
  - configMapRef:
      name: env-configs 

Pod描述（执行kubectl describe pod portal-app-589bb5bbdc-cdxlj输出） #

$kubectl describe pod portal-app-589bb5bbdc-cdxlj
Name:             portal-app-589bb5bbdc-cdxlj
Namespace:        portal
Priority:         0
Service Account:  portal-app
Node:             ip-something.ec2.internal/someip
Start Time:       Thu, 12 Oct 2023 07:28:51 -0500
Labels:           app.kubernetes.io/instance=portal-app
                  app.kubernetes.io/name=portal-app
                  pod-template-hash=589bb5bbdc
Annotations:      kubernetes.io/psp: eks.privileged
Status:           Running
IP:               10.23.9.1
IPs:
  IP:           10.23.9.1
Controlled By:  ReplicaSet/portal-app-589bb5bbdc
Containers:
  maintenance-portal-app:
    Container ID:  docker://d737dd3096693d7d0b
    Image:         26178.dkr.ecr.us-east-1.amazonaws.com/portal:f6628dad
    Image ID:      docker-pullable://26178.dkr.ecr.us-east-1.amazonaws.com/portal@sha256:d737dd3096693d7d0b
    Port:          3000/TCP
    Host Port:     0/TCP
    State:         Waiting
      Reason:      CrashLoopBackOff
    Last State:    Terminated
      Reason:      Error
      Message:     yarn run v1.22.19
$ yarn migrate:all && yarn listMigrations && yarn start
$ knex migrate:latest --knexfile db/knexfile.mjs
Requiring external module /app/node_modules/interpret/mjs-stub
Working directory changed to /app/db
password authentication failed for user "SA_MR_NP"
error: password authentication failed for user "SA_MR_NP"
    at Parser.parseErrorMessage (/app/node_modules/pg-protocol/dist/parser.js:287:98)
    at Parser.handlePacket (/app/node_modules/pg-protocol/dist/parser.js:126:29)
    at Parser.parse (/app/node_modules/pg-protocol/dist/parser.js:39:38)
    at Socket.<anonymous> (/app/node_modules/pg-protocol/dist/index.js:11:42)
    at Socket.emit (node:events:513:28)
    at addChunk (node:internal/streams/readable:315:12)
    at readableAddChunk (node:internal/streams/readable:289:9)
    at Socket.Readable.push (node:internal/streams/readable:228:10)
    at TCP.onStreamRead (node:internal/stream_base_commons:190:23)
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command.

      Exit Code:    1
      Started:      Thu, 12 Oct 2023 07:40:07 -0500
      Finished:     Thu, 12 Oct 2023 07:40:08 -0500
    Ready:          False
    Restart Count:  7
    Limits:
      cpu:     1800m
      memory:  4Gi
    Requests:
      cpu:     900m
      memory:  2Gi
    Liveness:  http-get http://:http/api/health-check delay=60s timeout=1s period=10s #success=1 #failure=3
    Startup:   http-get http://:http/api/health-check delay=10s timeout=1s period=10s #success=1 #failure=5
    Environment Variables from:
      env-configs  ConfigMap  Optional: false

ConfigMap描述（执行kubectl describe configmaps env-configs输出） #

kubectl describe configmaps env-configs
Name:         env-configs
Namespace:    portal
Labels:       app=env-configs
              app.kubernetes.io/managed-by=Helm
Annotations:  meta.helm.sh/release-name: env-configs
              meta.helm.sh/release-namespace: portal

Data
====
DB_PASSWORD:
----
'XXXXXXXXXXX'
GIT_SHA:
----
'109fda6b'

解决方案 #

1. 修复ConfigMap值的引号问题 #

从ConfigMap描述可以看到，DB_PASSWORD的值被包裹在单引号中，这会导致注入到容器的环境变量值包含多余的引号，应用读取时会把带引号的字符串当作密码，导致验证失败。

• 手动修复：执行命令重新创建ConfigMap，去掉值两端的单引号：

  kubectl create configmap env-configs --from-literal=DB_PASSWORD=XXXXXXXXXXX --from-literal=GIT_SHA=109fda6b -n portal
  

• Helm管理修复：修改Chart中的ConfigMap模板，确保值不包含多余的引号。比如模板中如果是用{{ .Values.db.password }}，确认Values中的密码没有带引号。

2. 验证环境变量注入结果 #

临时修改Deployment的容器启动命令，添加打印环境变量的操作，确认变量值是否正确：

command: ["sh", "-c", "printenv | grep DB_PASSWORD && yarn migrate:all && yarn listMigrations && yarn start"]

然后查看Pod日志，确认DB_PASSWORD的值没有多余引号。

3. 其他排查点 #

• 确认应用读取的环境变量名与ConfigMap中的键名完全一致（注意大小写、下划线）；
• 确认ConfigMap与Pod处于同一命名空间（当前均在portal命名空间，无需额外配置）。

内容的提问来源于stack exchange，提问作者Xeno