裸金属K8s部署Zammad时PostgreSQL目录权限拒绝问题排查

问题 #

在裸金属Kubernetes集群中通过Zammad Helm Chart部署Zammad，该部署依赖Bitnami PostgreSQL Chart配置数据库。即便执行了包含--set volumePermissions.enabled=true的安装命令：

helm upgrade --install zammad zammad/zammad --namespace zammad --set persistence.storageClass="manual" --set volumePermissions.enabled=true

PostgreSQL仍抛出权限拒绝错误：

sana@SANA3:~/sampleApp$ kubectl logs pod/zammad-postgresql-0
postgresql 11:12:15.65
postgresql 11:12:15.66 Welcome to the Bitnami postgresql container
postgresql 11:12:15.66 Subscribe to project updates by watching https://github.com/bitnami/bitnami-docker-postgresql
postgresql 11:12:15.66 Submit issues and feature requests at https://github.com/bitnami/bitnami-docker-postgresql/issues
postgresql 11:12:15.66
postgresql 11:12:15.69 INFO  ==> ** Starting PostgreSQL setup **
postgresql 11:12:15.72 INFO  ==> Validating settings in POSTGRESQL_* env vars..
postgresql 11:12:15.73 INFO  ==> Loading custom pre-init scripts...
postgresql 11:12:15.74 INFO  ==> Initializing PostgreSQL database...
mkdir: cannot create directory ‘/bitnami/postgresql/data’: Permission denied

存储类配置 #

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"storage.k8s.io/v1","kind":"StorageClass","metadata":{"annotations":{},"name":"manual-postgre"},"provisioner":"kubernetes.io/no-provisioner","volumeBindingMode":"Immediate"}
  creationTimestamp: "2023-01-25T07:05:38Z"
  name: manual-postgre
  resourceVersion: "10359744"
  uid: ad6bb681-18eb-4f80-9995-2d00273e9b08
provisioner: kubernetes.io/no-provisioner
reclaimPolicy: Delete
volumeBindingMode: Immediate

PV配置 #

apiVersion: v1
kind: PersistentVolume
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"PersistentVolume","metadata":{"annotations":{},"labels":{"type":"local"},"name":"hostpath-postgre2"},"spec":{"accessModes":["ReadWriteOnce"],"capacity":{"storage":"8Gi"},"claimRef":{"apiVersion":"v1","kind":"PersistentVolumeClaim","name":"data-zammad-postgresql-0","namespace":"zammad"},"hostPath":{"path":"/var/postgre2","type":"DirectoryOrCreate"},"persistentVolumeReclaimPolicy":"Retain","storageClassName":"manual-postgre"}}
    pv.kubernetes.io/bound-by-controller: "yes"
  labels:
    type: local
  name: hostpath-postgre2
spec:
  accessModes:
  - ReadWriteOnce
  capacity:
    storage: 8Gi
  claimRef:
    apiVersion: v1
    kind: PersistentVolumeClaim
    name: data-zammad-postgresql-0
    namespace: zammad
  hostPath:
    path: /var/postgre2
    type: DirectoryOrCreate
  persistentVolumeReclaimPolicy: Retain
  storageClassName: manual-postgre
  volumeMode: Filesystem

PVC配置 #

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"PersistentVolumeClaim","metadata":{"annotations":{},"labels":{"app.kubernetes.io/instance":"zammad","app.kubernetes.io/name":"postgresql"},"name":"data-zammad-postgresql-0","namespace":"zammad"},"spec":{"accessModes":["ReadWriteOnce"],"resources":{"requests":{"storage":"8Gi"}},"storageClassName":"manual-postgre","volumeMode":"Filesystem","volumeName":"hostpath-postgre2"}}
    pv.kubernetes.io/bind-completed: "yes"
  labels:
    app.kubernetes.io/instance: zammad
    app.kubernetes.io/name: postgresql
  name: data-zammad-postgresql-0
  namespace: zammad
spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: 8Gi
  storageClassName: manual-postgre
  volumeMode: Filesystem
  volumeName: hostpath-postgre2

疑问：权限配置遗漏了什么？为何相同命令在microK8s中正常，裸金属集群却报错？

解决方案 #

问题根源 #

1. 容器运行用户权限不匹配：Bitnami PostgreSQL镜像默认用1001用户运行，而你裸金属节点上的/var/postgre2目录默认是root权限，容器内的1001用户没有读写权限。
2. 参数作用范围错配：你设置的volumePermissions.enabled=true是给Zammad主应用的，而非依赖的PostgreSQL子Chart。Bitnami PostgreSQL Chart本身有独立的权限配置参数，你没配置。
3. microK8s的自动适配：microK8s默认的hostpath-provisioner会自动调整hostPath目录权限，适配容器运行用户；但你裸金属集群用的是手动创建的PV，没有这个自动处理机制。

修复步骤 #

1. 指定PostgreSQL子Chart的权限参数
   修改helm安装命令，给PostgreSQL子Chart加上权限配置：

   helm upgrade --install zammad zammad/zammad --namespace zammad \
     --set persistence.storageClass="manual" \
     --set volumePermissions.enabled=true \
     --set postgresql.volumePermissions.enabled=true
   

2. 手动调整节点目录权限
   如果上面的参数不生效，直接在PV绑定的节点上执行命令修改目录权限：

   sudo chown -R 1001:1001 /var/postgre2
   sudo chmod -R 755 /var/postgre2
   

   执行后删除PostgreSQL Pod，让它重新挂载卷：

   kubectl delete pod zammad-postgresql-0 -n zammad
   

3. 后续优化建议
   裸金属集群使用本地存储时，尽量避免直接用hostPath，推荐用local PV配合local-volume-provisioner，它能自动处理权限和节点亲和性问题；或者使用支持动态调整权限的存储类。

内容的提问来源于stack exchange，提问作者Sana.91