以非root用户运行Fluent-Bit自定义镜像遇存储初始化错误求助

报错信息 #

Fluent Bit v1.9.10
* Copyright (C) 2015-2022 The Fluent Bit Authors
* Fluent Bit is a CNCF sub-project under the umbrella of Fluentd
* https://fluentbit.io

[2023/05/02 16:31:18] [ info] [fluent bit] version=1.9.10, commit=010c75b194, pid=1
[2023/05/02 16:31:18] [error] [storage] [chunkio] cannot initialize root path /var/fluent-bit/state/flb-storage/

[2023/05/02 16:31:18] [error] [storage] error initializing storage engine
[2023/05/02 16:31:18] [error] [lib] backend failed

你判断的原因没错——非root用户没权限读写/var/fluent-bit/state/flb-storage/这个挂载目录，光给容器加securityContext没用，得从卷的权限配置下手，以下是几种可行方案：

方案一：用initContainer提前调整目录权限 #

在DaemonSet配置里加一个初始化容器，先修改存储目录的权限，让非root用户能读写：

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
spec:
  template:
    spec:
      initContainers:
      - name: fix-permissions
        image: busybox:1.36
        command: ["sh", "-c", "chown -R 1000:1000 /var/fluent-bit/state/flb-storage/"]
        volumeMounts:
        - name: fluentbit-state
          mountPath: /var/fluent-bit/state/flb-storage/
      containers:
      - name: fluent-bit
        image: fluent/fluent-bit:1.9.10
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
        volumeMounts:
        - name: fluentbit-state
          mountPath: /var/fluent-bit/state/flb-storage/
      volumes:
      - name: fluentbit-state
        hostPath:
          path: /var/fluent-bit/state/flb-storage/
          type: DirectoryOrCreate

注意：把1000:1000换成你实际要用的非root用户UID和GID。

方案二：为Pod配置fsGroup #

在Pod的securityContext里设置fsGroup，Kubernetes会自动把挂载卷的目录权限调整为该组权限，让容器用户能访问：

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: fluent-bit
spec:
  template:
    spec:
      securityContext:
        fsGroup: 1000
      containers:
      - name: fluent-bit
        image: fluent/fluent-bit:1.9.10
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
        volumeMounts:
        - name: fluentbit-state
          mountPath: /var/fluent-bit/state/flb-storage/
      volumes:
      - name: fluentbit-state
        hostPath:
          path: /var/fluent-bit/state/flb-storage/
          type: DirectoryOrCreate

说明：fsGroup的组ID要和容器运行用户的GID一致，Kubernetes会自动处理目录权限。

方案三：修改Fluent-Bit存储路径 #

如果前两种方式都不行，可以修改Fluent-Bit的配置文件，把存储路径指向容器内已有权限的目录（比如/tmp下的目录），但这种方式不适合需要持久化存储的场景：
在fluent-bit.conf的[SERVICE]段修改：

[SERVICE]
    storage.path /tmp/flb-storage/

内容的提问来源于stack exchange，提问作者mmiara