OpenShift添加startupProbe后oc apply报错问题咨询

我给容器配置了如下startupProbe：

startupProbe:
  httpGet:
    path: someurl
    port: 6060
    scheme: HTTP
  periodSeconds: 10
  successThreshold: 1
  failureThreshold: 12
  timeoutSeconds: 9

通过以下命令在DeploymentConfig中应用该探针时：

(oc process -f path/to/DeploymentConfig.yml \
    -p SomeVariable=$SomeVariable \
    | oc apply -f - \
)

出现错误：

error: unable to find api field in struct Container for the json field "startupProbe"

相关背景信息：

• 此前DeploymentConfig可正常工作，仅添加startupProbe后出现问题
• 首次部署成功，但后续部署均报错
• 直接在OpenShift中编辑/添加/回滚DeploymentConfig无异常，说明startupProbe配置合法
• 无OpenShift日志访问权限，事件中无报错
• 部署及报错发生在GitLab流水线中，即OpenShift在应用前拦截了配置
• OpenShift版本为4.12

附完整DeploymentConfig模板：

apiVersion: v1
kind: Template
metadata:
  name: deploymentconfig-template
objects:
  - apiVersion: apps.openshift.io/v1
    kind: DeploymentConfig
    metadata:
      labels:
        app: ${IMAGE_NAME}-${TARGET_SYSTEM}
      name: ${IMAGE_NAME}-${TARGET_SYSTEM}
      namespace: ${OPENSHIFT_NAMESPACE}
    spec:
      replicas: 1
      revisionHistoryLimit: 10
      selector:
        app: ${IMAGE_NAME}-${TARGET_SYSTEM}
        deploymentconfig: ${IMAGE_NAME}-${TARGET_SYSTEM}
      strategy:
        activeDeadlineSeconds: 21600
        resources: {}
        rollingParams:
          intervalSeconds: 1
          maxSurge: 25%
          maxUnavailable: 25%
          timeoutSeconds: 600
          updatePeriodSeconds: 1
        type: Rolling
      template:
        metadata:
          labels:
            app: ${IMAGE_NAME}-${TARGET_SYSTEM}
            deploymentconfig: ${IMAGE_NAME}-${TARGET_SYSTEM}
        spec:
          containers:
            - name: ${IMAGE_NAME}
              image: ${DOCKER_REGISTRY}/${DOCKER_NAMESPACE}/${IMAGE_NAME}:${IMAGE_TAG}
              imagePullPolicy: Always
              ports:
                - containerPort: 5555
                  protocol: TCP
              resources:
                requests:
                  memory: 120Mi
                limits:
                  memory: 200Mi
              livenessProbe:
                exec:
                  command:
                    - /bin/sh
                    - -c
                    - nc -z localhost 5555
                initialDelaySeconds: 60
                periodSeconds: 10
              readinessProbe:
                httpGet:
                  path: someurl
                  port: 6060
                  scheme: HTTP
                initialDelaySeconds: 30
                periodSeconds: 60
                successThreshold: 1
                failureThreshold: 3
                timeoutSeconds: 60
              startupProbe:
                httpGet:
                  path: someurl
                  port: 6060
                  scheme: HTTP
                periodSeconds: 20
                successThreshold: 1
                failureThreshold: 20
                timeoutSeconds: 19
              terminationMessagePath: /dev/termination-log
              terminationMessagePolicy: File
              env:
                - name: SERVICE_ACCOUNT_ENABLED
                  value: ${SERVICE_ACCOUNT_ENABLED}
                - name: NODE_TLS_REJECT_UNAUTHORIZED
                  value: "0"
              envFrom:
                - configMapRef:
                    name: ${IMAGE_NAME}-${TARGET_SYSTEM}
              volumeMounts:
                - name: keycloak-json-server
                  mountPath: /server/keycloak/keycloak.json
                  subPath: keycloak.json
                - name: keycloak-2fa-disabled-json-server
                  mountPath: /server/keycloak/keycloak_2FAdisabled.json
                  subPath: keycloak_2FAdisabled.json
                - mountPath: /server/modules/external_apis/eko-ora/deploy-config
                  name: deploy-config
                - mountPath: /server/deploy-config
                  name: deploy-global-config
          imagePullSecrets:
            - name: mtr
          dnsPolicy: ClusterFirst
          restartPolicy: Always
          schedulerName: default-scheduler
          securityContext: {}
          terminationGracePeriodSeconds: 30
          volumes:
            - name: keycloak-json-server
              configMap:
                name: ${IMAGE_NAME}-${TARGET_SYSTEM}
                items:
                  - key: keycloak.json
                    path: keycloak.json
            - name: keycloak-2fa-disabled-json-server
              configMap:
                name: ${IMAGE_NAME}-${TARGET_SYSTEM}
                items:
                  - key: keycloak_2FAdisabled.json
                    path: keycloak_2FAdisabled.json
            - name: deploy-config
              configMap:
                name: ${IMAGE_NAME}-${TARGET_SYSTEM}
                items:
                  - key: eko-ora.deploy.json
                    path: eko-ora.deploy.json
                  - key: scim.deploy.json
                    path: scim.deploy.json
                  - key: apiSettings.deploy.json
                    path: apiSettings.deploy.json
            - name: deploy-global-config
              configMap:
                name: ${IMAGE_NAME}-${TARGET_SYSTEM}
                items:
                  - key: globalSettings.deploy.json
                    path: globalSettings.deploy.json
                  - key: roleBasedUI.deploy.json
                    path: roleBasedUI.deploy.json
                  - key: createUserReq.deploy.json
                    path: createUserReq.deploy.json
                  - key: searchUserReq.deploy.json
                    path: searchUserReq.deploy.json
      test: false
parameters:
  - name: TARGET_SYSTEM
  - name: OPENSHIFT_NAMESPACE
  - name: DOCKER_REGISTRY
  - name: DOCKER_NAMESPACE
  - name: IMAGE_NAME
  - name: IMAGE_TAG
  - name: SERVICE_ACCOUNT_ENABLED

1. 错误触发原因 #

核心原因是GitLab流水线中使用的oc客户端版本低于OpenShift集群版本（4.12）。startupProbe属于Kubernetes 1.16引入的特性，OpenShift从4.2版本开始支持，但旧版本的oc客户端内置的API结构体定义中没有这个字段，解析YAML配置时就会抛出字段不存在的错误。

首次部署成功是因为当时流水线的oc版本兼容，或者首次部署的校验逻辑未触发严格检查；后续部署报错则是客户端版本回退或校验逻辑生效。而直接在OpenShift控制台操作正常，是因为控制台使用集群内置的兼容版本API，不受本地客户端版本限制。

2. 避免错误的方法 #

• 升级流水线中的oc客户端版本：将GitLab流水线里的oc客户端升级到与OpenShift集群（4.12）匹配的版本，确保客户端API定义包含startupProbe字段。
• 跳过客户端字段校验：在oc apply命令中添加--validate=false参数，强制跳过客户端侧的字段校验，直接将配置发送到集群API服务器处理（集群本身支持该字段），修改后的命令如下：

  (oc process -f path/to/DeploymentConfig.yml \
      -p SomeVariable=$SomeVariable \
      | oc apply -f - --validate=false \
  )
  

• 检查流水线环境的oc版本：执行oc version命令确认GitLab流水线运行环境中的oc版本，确保版本≥4.2（推荐与集群版本完全一致）。

内容的提问来源于stack exchange，提问作者telion