Kubernetes部署PostgreSQL Pod遇终止状态，权限拒绝问题求助

问题原因 #

你自定义的PGDATA路径/some/path/here在容器镜像中不存在，PostgreSQL启动脚本尝试创建该目录时，由于当前运行用户（UID 70）没有权限在上级目录（如/some）下创建新目录，导致权限拒绝错误。

解决方案 #

方案1：使用挂载卷的根目录作为PGDATA路径 #

直接将PGDATA设置为挂载卷的根路径，避免创建多级目录的权限问题：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsUser: 70
        runAsGroup: 70
        fsGroup: 70
        fsGroupChangePolicy: "Always"
      containers:
        - image: docker.io/postgres:14.8-alpine3.18
          name: postgres
          resources: 
            limits:
              hugepages-2Mi: 512Mi
              memory: 2Gi
              cpu: "8"
            requests:
              memory: 128Mi
              cpu: "1"
          env:
            - name: POSTGRES_DB
              value: postgres_db_name
            - name: POSTGRES_USER
              value: postgres_db_user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
                  key: root_password_key
            # 修改PGDATA为挂载卷的根路径
            - name: PGDATA
              value: /pgdata
          ports:
            - containerPort: 5432
              name: postgres
          volumeMounts:
            - name: postgres-volume-name
              # 挂载路径与PGDATA一致
              mountPath: /pgdata
      volumes:
        - name: postgres-volume-name
          persistentVolumeClaim:
            claimName: postgres-pv-claim

方案2：通过InitContainer提前创建目录并设置权限 #

如果必须使用/some/path/here作为PGDATA路径，添加InitContainer提前创建目录并修改权限：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsUser: 70
        runAsGroup: 70
        fsGroup: 70
        fsGroupChangePolicy: "Always"
      # 添加InitContainer完成目录初始化
      initContainers:
        - name: setup-pgdir
          image: alpine:3.18
          command: ["sh", "-c", "mkdir -p /some/path/here && chown 70:70 /some/path/here"]
          volumeMounts:
            - name: postgres-volume-name
              mountPath: /some/path/here
      containers:
        - image: docker.io/postgres:14.8-alpine3.18
          name: postgres
          resources: 
            limits:
              hugepages-2Mi: 512Mi
              memory: 2Gi
              cpu: "8"
            requests:
              memory: 128Mi
              cpu: "1"
          env:
            - name: POSTGRES_DB
              value: postgres_db_name
            - name: POSTGRES_USER
              value: postgres_db_user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
                  key: root_password_key
            - name: PGDATA
              value: /some/path/here
          ports:
            - containerPort: 5432
              name: postgres
          volumeMounts:
            - name: postgres-volume-name
              mountPath: /some/path/here
      volumes:
        - name: postgres-volume-name
          persistentVolumeClaim:
            claimName: postgres-pv-claim

方案3：使用PostgreSQL镜像默认的PGDATA路径 #

直接使用镜像默认的/var/lib/postgresql/data作为PGDATA路径，避免自定义路径的权限问题：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: postgres
  labels:
    app: postgres
spec:
  replicas: 1
  selector:
    matchLabels:
      app: postgres
  template:
    metadata:
      labels:
        app: postgres
    spec:
      securityContext:
        runAsUser: 70
        runAsGroup: 70
        fsGroup: 70
        fsGroupChangePolicy: "Always"
      containers:
        - image: docker.io/postgres:14.8-alpine3.18
          name: postgres
          resources: 
            limits:
              hugepages-2Mi: 512Mi
              memory: 2Gi
              cpu: "8"
            requests:
              memory: 128Mi
              cpu: "1"
          env:
            - name: POSTGRES_DB
              value: postgres_db_name
            - name: POSTGRES_USER
              value: postgres_db_user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
                  key: root_password_key
              # 移除自定义PGDATA，使用默认路径
          ports:
            - containerPort: 5432
              name: postgres
          volumeMounts:
            - name: postgres-volume-name
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: postgres-volume-name
          persistentVolumeClaim:
            claimName: postgres-pv-claim

验证修改 #

应用修改后的Deployment配置：

kubectl apply -f your-postgres-deployment.yaml

查看Pod状态：

kubectl get pods

确认Pod正常启动后，可通过日志验证：

kubectl logs <postgres-pod-name>

内容的提问来源于stack exchange，提问作者Shubham Nikam