使用Amazon EFS部署TimescaleDB多节点时遇权限不允许错误

使用timescaledb-multinode的Helm Chart，将存储类改为Amazon EFS的efs-sc后，所有副本的initdb容器出现以下错误：

install: cannot change owner and permissions of ‘/var/lib/postgresql/pgdata’: Operation not permitted

环境信息 #

• Helm Chart：timescaledb-multinode
• 镜像：timescale/timescaledb-ha:pg15.3-ts2.11.1-all
• Kubernetes集群：Amazon EKS
• Kubernetes版本：

  kubectl version
  Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.3", GitCommit:"25b4e43193bcda6c7328a6d147b1fb73a33f1598", GitTreeState:"clean", BuildDate:"2023-06-14T09:47:38Z", GoVersion:"go1.20.5", Compiler:"gc", Platform:"darwin/arm64"}
  Kustomize Version: v5.0.1
  Server Version: version.Info{Major:"1", Minor:"26+", GitVersion:"v1.26.5-eks-c12679a", GitCommit:"c03cecf98904742cce2e1183f87194102cc9dad9", GitTreeState:"clean", BuildDate:"2023-05-22T20:29:55Z", GoVersion:"go1.19.9", Compiler:"gc", Platform:"linux/amd64"}
  

values.yaml配置 #

dataNodes: 3
nameOverride: timescaledb

image:
  repository: timescale/timescaledb-ha
  tag: pg15.3-ts2.11.1-all
  pullPolicy: IfNotPresent

credentials:
  accessNode:
    superuser: tea
  dataNode:
    superuser: coffee

env:
  - name: LC_ALL
    value: C.UTF-8
  - name: LANG
    value: C.UTF-8
  - name: PGDATA
    value: /var/lib/postgresql/pgdata

persistentVolume:
  enabled: true
  size: 200G
  storageClass: "efs-sc"
  subPath: ""
  mountPath: "/var/lib/postgresql"
  annotations:
    helm.sh/resource-policy: keep
    volume.beta.kubernetes.io/storage-class: efs-sc
  accessModes:
    - ReadWriteMany

resources: {}

postgresql:
  databases:
    - postgres
    - example
  parameters:
    max_connections: 100
    max_prepared_transactions: 150
    shared_buffers: 300MB
    work_mem: 16MB
    timescaledb.passfile: '../.pgpass'
    log_connections: 'on'
    log_line_prefix: "%t [%p]: [%c-%l] %u@%d,app=%a [%e] "
    log_min_duration_statement: '1s'
    log_statement: ddl
    log_checkpoints: 'on'
    log_lock_waits: 'on'
    min_wal_size: 256MB
    max_wal_size: 512MB
    temp_file_limit: 1GB

nodeSelector: {}
tolerations: []
affinityTemplate: |
  podAntiAffinity:
    preferredDuringSchedulingIgnoredDuringExecution:
    - weight: 100
      podAffinityTerm:
        topologyKey: "kubernetes.io/hostname"
        labelSelector:
          matchLabels:
            app:  {{ template "timescaledb.name" . }}
            release: {{ .Release.Name | quote }}
affinity: {}
rbac:
  create: true

serviceAccount:
  create: true
  name:

错误核心原因是EFS默认不支持POSIX权限修改（除非开启EFS Access Points并配置用户映射），而initdb容器尝试修改/var/lib/postgresql/pgdata的属主和权限导致失败。以下是几种可行解决方式：

方式一：使用EFS Access Points配置用户映射 #

1. 创建EFS Access Point，指定用户ID（UID）为PostgreSQL容器默认的999（对应镜像中postgres用户），组ID（GID）为999，并设置路径权限为700。
2. 在Kubernetes的StorageClass或PersistentVolumeClaim中配置使用该Access Point。
3. 调整Helm values，确保PVC关联到配置了Access Point的存储类，此时容器无需修改权限即可正常访问。

方式二：禁用initdb的权限修改步骤 #

在Helm values的env中添加如下变量，跳过权限检查和修改：

env:
  # 保留原有环境变量
  - name: SKIP_CHOWN
    value: "true"

该变量会让timescaledb-ha镜像的初始化脚本跳过修改PGDATA目录权限的步骤。注意需确保EFS路径的权限已符合PostgreSQL要求（UID/GID为999，权限700），否则PostgreSQL启动后无法读写数据。

方式三：调整挂载路径与PGDATA设置 #

将persistentVolume.mountPath改为/var/lib/postgresql/data，同时修改PGDATA为/var/lib/postgresql/data/pgdata，并确保EFS上的data目录权限正确。不过这种方式本质是通过路径规划避开权限问题，可靠性不如Access Point方案。

内容的提问来源于stack exchange，提问作者Manoj Kumar Maharana