在Minikube部署CockroachDB Helm Chart失败：创建目录权限拒绝

在Fedora 37（已禁用SELinux）的Minikube v1.29.0上，使用默认参数部署CockroachDB时，3个节点中有2个启动失败，报错如下：

Creating data directory: mkdir /cockroach/cockroach-data/auxiliary: permission denied

不确定问题与CockroachDB、Minikube还是Linux系统相关，寻求相关信息或提示。

复现步骤 #

minikube start --cpus=2 --memory=2g --nodes=3

helm repo add cockroachdb https://charts.cockroachdb.com/
helm repo update

helm upgrade --install cockroachdb cockroachdb/cockroachdb

执行结果 #

kubectl get all 输出 #

$ kubectl get all
NAME                         READY   STATUS             RESTARTS     AGE
pod/cockroachdb-0            0/1     CrashLoopBackOff   1 (8s ago)   26s
pod/cockroachdb-1            0/1     CrashLoopBackOff   1 (2s ago)   26s
pod/cockroachdb-2            0/1     Running            0            26s
pod/cockroachdb-init-gkb2z   1/1     Running            0            26s

NAME                         TYPE        CLUSTER-IP      EXTERNAL-IP   PORT(S)              AGE
service/cockroachdb          ClusterIP   None            <none>        26257/TCP,8080/TCP   26s
service/cockroachdb-public   ClusterIP   10.100.59.219   <none>        26257/TCP,8080/TCP   26s
service/kubernetes           ClusterIP   10.96.0.1       <none>        443/TCP              6m34s

NAME                           READY   AGE
statefulset.apps/cockroachdb   0/3     26s

NAME                                                  SCHEDULE       SUSPEND   ACTIVE   LAST SCHEDULE   AGE
cronjob.batch/cockroachdb-rotate-self-signer          0 0 1 */11 *   False     0        <none>          26s
cronjob.batch/cockroachdb-rotate-self-signer-client   0 0 */26 * *   False     0        <none>          26s

NAME                         COMPLETIONS   DURATION   AGE
job.batch/cockroachdb-init   0/1           26s        26s

kubectl get po -o wide 输出 #

$ kubectl get po -o wide
NAME                     READY   STATUS             RESTARTS      AGE   IP           NODE           NOMINATED NODE   READINESS GATES
cockroachdb-0            0/1     CrashLoopBackOff   2 (15s ago)   52s   10.244.2.2   minikube-m03   <none>           <none>
cockroachdb-1            0/1     CrashLoopBackOff   2 (11s ago)   52s   10.244.1.4   minikube-m02   <none>           <none>
cockroachdb-2            0/1     Running            0             52s   10.244.0.3   minikube       <none>           <none>
cockroachdb-init-gkb2z   1/1     Running            0             52s   10.244.1.3   minikube-m02   <none>           <none>

失败节点日志（cockroachdb-0） #

$ kubectl logs cockroachdb-0
Defaulted container "db" out of: db, copy-certs (init)
++ hostname
+ exec /cockroach/cockroach start --join=cockroachdb-0.cockroachdb.datastore.svc.cluster.local:26257,cockroachdb-1.cockroachdb.datastore.svc.cluster.local:26257,cockroachdb-2.cockroachdb.datastore.svc.cluster.local:26257 --advertise-host=cockroachdb-0.cockroachdb.datastore.svc.cluster.local --certs-dir=/cockroach/cockroach-certs/ --http-port=8080 --port=26257 --cache=25% --max-sql-memory=25% --logtostderr=INFO
Flag --logtostderr has been deprecated, use --log instead to specify 'sinks: {stderr: {filter: ...}}'.
E230321 11:03:10.501705 1 1@cli/clierror/check.go:35  [-] 1  ERROR: connection lost.
E230321 11:03:10.501705 1 1@cli/clierror/check.go:35  [-] 1 +creating data directory: mkdir /cockroach/cockroach-data/auxiliary: permission denied
ERROR: connection lost.

creating data directory: mkdir /cockroach/cockroach-data/auxiliary: permission denied
Failed running "start"

问题原因与解决方法 #

核心原因是Minikube多节点环境中，PersistentVolume（PV）的目录权限与CockroachDB容器运行用户不匹配：CockroachDB官方镜像默认以非root用户（UID 1000）运行，而Minikube不同节点上的hostPath存储目录权限可能不一致，导致部分节点的目录无法被容器用户写入。

解决方法1：临时以root用户运行容器（测试环境适用） #

部署时通过Helm参数指定容器以root用户运行，绕过权限限制：

helm upgrade --install cockroachdb cockroachdb/cockroachdb \
  --set statefulset.securityContext.runAsUser=0 \
  --set statefulset.securityContext.runAsGroup=0

解决方法2：手动调整Minikube节点存储目录权限 #

进入每个失败节点对应的Minikube节点，修改存储目录权限：

# 进入minikube-m02节点，处理cockroachdb-1的存储目录
minikube ssh -n minikube-m02
sudo mkdir -p /data/cockroachdb/cockroachdb-1
sudo chown -R 1000:1000 /data/cockroachdb/cockroachdb-1
exit

# 进入minikube-m03节点，处理cockroachdb-0的存储目录
minikube ssh -n minikube-m03
sudo mkdir -p /data/cockroachdb/cockroachdb-0
sudo chown -R 1000:1000 /data/cockroachdb/cockroachdb-0
exit

之后重新部署：

helm uninstall cockroachdb
helm upgrade --install cockroachdb cockroachdb/cockroachdb

解决方法3：自定义StorageClass配置权限（生产环境适用） #

创建自定义StorageClass，确保动态生成的PV自动设置正确权限：

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: cockroachdb-sc
provisioner: k8s.io/minikube-hostpath
volumeBindingMode: WaitForFirstConsumer
mountOptions:
  - uid=1000
  - gid=1000

应用该StorageClass后，部署时指定使用：

kubectl apply -f storageclass.yaml
helm upgrade --install cockroachdb cockroachdb/cockroachdb \
  --set persistence.storageClass=cockroachdb-sc

内容的提问来源于stack exchange，提问作者Lerenn