Kubernetes挂载PV后Laravel存储目录root权限异常排查

已在Kubernetes集群部署Laravel应用，需实现：

• 将storage目录挂载到Persistent Volume（PV），用于存储图片等文件
• 限制存储容量为5GB
• 保证数据持久化（服务器重启后数据不丢失）

当前核心问题：挂载PV后，/var/www/html/storage目录所有者为root/root，而非Dockerfile中设置的nobody/nobody，导致应用无读写权限。

当前Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: laravel-api-app
  namespace: my-project
  labels:
    app.kubernetes.io/name: laravel-api-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: laravel-api-app
  template:
    metadata:
      labels:
        app: laravel-api-app
    spec:
      containers:
        - name: laravel-api-app
          image: me/laravel-api:v1.0.0
          ports:
            - name: laravel
              containerPort: 8080
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: laravel-api-secret
            - configMapRef:
                name: laravel-api-config
          volumeMounts:
            - name: storage
              mountPath: /var/www/html/storage
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: laravel-api-persistant-volume-claim

Dockerfile配置 #

USER nobody
COPY --chown=nobody . /var/www/html

权限异常现象 #

Pod内执行ls -la结果显示storage目录权限异常：

drwxr-xr-x    2 root     root          4096 Mar 14 18:18 storage

已尝试的失败方案 #

• 添加容器级securityContext设置runAsUser:65534、runAsGroup:65534、fsGroup:65534，问题未解决
• 尝试用Laravel镜像作为initContainer复制storage内容到挂载目录，出现Init:ExitCode:127错误；改为普通容器调试时，日志显示cp: can't create directory '/mnt/app': Permission denied，且Pod清单未生效新增的securityContext，容器陷入CrashLoopBackOff

1. 配置PV与PVC实现容量限制和持久化 #

先创建PVC（PersistentVolumeClaim）请求5GB存储，集群会自动分配对应PV（或手动创建PV绑定）：

PVC配置文件（laravel-storage-pvc.yaml） #

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: laravel-api-persistant-volume-claim
  namespace: my-project
spec:
  accessModes:
    - ReadWriteOnce  # 单节点读写，适配单副本应用
  resources:
    requests:
      storage: 5Gi  # 限制存储容量为5GB
  # 若集群有默认存储类，可省略storageClassName字段
  storageClassName: "standard"

创建PVC：

kubectl apply -f laravel-storage-pvc.yaml -n my-project

2. 修复storage目录权限问题 #

推荐两种可靠方案，任选其一即可：

方案一：使用busybox initContainer预设置权限 #

在Deployment中添加initContainer，以root权限修改PV挂载目录的所有者为nobody（UID:65534）：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: laravel-api-app
  namespace: my-project
  labels:
    app.kubernetes.io/name: laravel-api-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: laravel-api-app
  template:
    metadata:
      labels:
        app: laravel-api-app
    spec:
      initContainers:
        - name: setup-storage-permissions
          image: busybox:latest
          command: ["sh", "-c", "chown -R 65534:65534 /mnt && chmod -R 775 /mnt"]
          volumeMounts:
            - name: storage
              mountPath: /mnt
      containers:
        - name: laravel-api-app
          image: me/laravel-api:v1.0.0
          ports:
            - name: laravel
              containerPort: 8080
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: laravel-api-secret
            - configMapRef:
                name: laravel-api-config
          volumeMounts:
            - name: storage
              mountPath: /var/www/html/storage
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: laravel-api-persistant-volume-claim

说明：

• busybox默认以root运行，有权限修改PV目录权限
• 直接使用UID 65534而非用户名nobody，避免部分环境中用户名映射问题
• chmod 775保证nobody用户有读写权限，同组用户也具备访问权限

方案二：正确配置Pod级securityContext #

将securityContext配置在Pod级别而非容器级别，确保fsGroup生效，自动调整挂载目录的所有者：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: laravel-api-app
  namespace: my-project
  labels:
    app.kubernetes.io/name: laravel-api-app
spec:
  replicas: 1
  selector:
    matchLabels:
      app: laravel-api-app
  template:
    metadata:
      labels:
        app: laravel-api-app
    spec:
      securityContext:
        fsGroup: 65534  # Pod启动时自动将挂载卷的所有者组设置为该值
        fsGroupChangePolicy: "OnRootMismatch"  # 仅当根目录权限不匹配时修改，提升性能
      containers:
        - name: laravel-api-app
          image: me/laravel-api:v1.0.0
          ports:
            - name: laravel
              containerPort: 8080
          imagePullPolicy: Always
          envFrom:
            - secretRef:
                name: laravel-api-secret
            - configMapRef:
                name: laravel-api-config
          volumeMounts:
            - name: storage
              mountPath: /var/www/html/storage
          securityContext:
            runAsUser: 65534  # 容器以nobody用户运行
            runAsGroup: 65534
      imagePullSecrets:
        - name: regcred
      volumes:
        - name: storage
          persistentVolumeClaim:
            claimName: laravel-api-persistant-volume-claim

说明：

• Pod级fsGroup会让Kubernetes自动调整所有挂载卷的所有者组为65534，部分存储驱动也会同步调整所有者用户
• 容器级runAsUser/runAsGroup保证应用进程以nobody用户运行，与目录权限匹配

验证解决方案 #

1. 应用更新后的Deployment：

kubectl apply -f updated-deployment.yaml -n my-project

2. 进入Pod检查权限：

kubectl exec -it <pod-name> -n my-project -- ls -la /var/www/html/storage

3. 验证持久化：上传一张图片到storage目录，删除Pod后重新创建，检查图片是否存在
4. 验证容量限制：通过存储后端工具（如AWS EBS、本地存储管理工具）查看是否已限制为5GB

内容的提问来源于stack exchange，提问作者A. Vreeswijk