本地K8s集群部署Camunda 8时PostgreSQL权限拒绝问题求助

问题 #

在本地Kubernetes集群安装Camunda 8，执行了以下Helm命令：

helm repo add camunda https://helm.camunda.io
helm repo update
helm install camunda-platform camunda/camunda-platform

同时为PostgreSQL编写了如下存储清单文件：

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: data-camunda-platform-postgresql-0
provisioner: kubernetes.io/pvc-protection
volumeBindingMode: WaitForFirstConsumer

---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  labels:
    app.kubernetes.io/component: primary
    app.kubernetes.io/instance: camunda-platform
    app.kubernetes.io/name: postgresql
  name: data-camunda-platform-postgresql-0
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: data-camunda-platform-postgresql-0
  resources:
    requests:
      storage: 16G

---

apiVersion: v1
kind: PersistentVolume
metadata:
  name: data-camunda-platform-postgresql-0
  labels:
    app.kubernetes.io/component: primary
    app.kubernetes.io/instance: camunda-platform
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: postgresql
spec:
  storageClassName: data-camunda-platform-postgresql-0
  capacity:
    storage: 16Gi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/mnt/data-camunda-postgres"

查看PostgreSQL Pod日志时出现权限错误：

root@c1-control-plane:/opt# kubectl logs camunda-platform-postgresql-0

postgresql 14:08:23.32
postgresql 14:08:23.32 Welcome to the Bitnami postgresql container
postgresql 14:08:23.32 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql
postgresql 14:08:23.33 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues
postgresql 14:08:23.33
postgresql 14:08:23.34 INFO  ==> ** Starting PostgreSQL setup **
postgresql 14:08:23.36 INFO  ==> Validating settings in POSTGRESQL_* env vars..
postgresql 14:08:23.36 INFO  ==> Loading custom pre-init scripts...
postgresql 14:08:23.37 INFO  ==> Initializing PostgreSQL database...
mkdir: cannot create directory ‘/bitnami/postgresql/data’: Permission denied

已知执行sudo chown -R postgres:postgres /bitnami/postgresql/data可解决，但不想手动执行，且无法进入容器，求自动解决方法。

解决方案 #

方法1：宿主机预设置hostPath目录权限 #

因为使用hostPath存储，直接在宿主机目标目录配置正确权限即可（Bitnami PostgreSQL镜像默认postgres用户UID/GID为1001）：

sudo mkdir -p /mnt/data-camunda-postgres
sudo chown -R 1001:1001 /mnt/data-camunda-postgres
sudo chmod 700 /mnt/data-camunda-postgres

之后重启PostgreSQL Pod：

kubectl delete pod camunda-platform-postgresql-0

方法2：通过Helm Values配置自动权限初始化 #

Camunda Helm Chart基于Bitnami PostgreSQL Chart，可通过自定义values添加初始化脚本或配置安全上下文：

1. 创建postgres-values.yaml文件：

postgresql:
  # 配置预初始化脚本自动修复权限
  initdbScripts:
    fix-perms.sh: |
      #!/bin/bash
      chown -R postgres:postgres /bitnami/postgresql/data
      chmod 700 /bitnami/postgresql/data
  # 配置容器运行安全上下文，确保权限匹配
  primary:
    podSecurityContext:
      fsGroup: 1001
    containerSecurityContext:
      runAsUser: 1001
      runAsGroup: 1001

2. 执行Helm升级应用配置：

helm upgrade camunda-platform camunda/camunda-platform -f postgres-values.yaml

方法3：利用Kubernetes PV的fsGroup自动调整权限 #

修改PostgreSQL的Pod安全上下文配置，让Kubernetes自动为挂载的hostPath目录设置正确的用户组权限：
在上述postgres-values.yaml中仅保留安全上下文配置即可，执行Helm升级后，Kubernetes会在挂载volume时自动将目录权限设置为fsGroup指定的1001组，匹配容器内的postgres用户权限。

内容的提问来源于stack exchange，提问作者Hadagan