TimescaleDB单节点Kubernetes部署因PodSecurityPolicy失败求助

问题场景 #

安装0.18.0版本的TimescaleDB单节点Helm Chart后，StatefulSet已启动，但Pod出现权限报错，确认问题与PodSecurityPolicy（PSP）相关，但无法定位具体触发操作，疑问是否与Patroni创建pgbackrest相关数据库有关，需修复该报错。

配置文件（values.yaml） #

timescaledb-single:
  image:
    pullPolicy: IfNotPresent

  service:
    primary:
      labels:
        team: my-team
    replica:
      labels:
        team: my-team

  prometheus:
    enabled: true
  
persistentVolumes:
    wal:
      size: 20G
    data:
      size: 5G

  replicaCount: 3

  serviceAccount:
    create: false  # There's an existing service account already from an earlier install.
    name: my-cluster-timescaledb

报错信息 #

2022-11-14 18:14:17,077 ERROR: Error creating replica using method pgbackrest: /etc/timescaledb/scripts/pgbackrest_restore.sh exited with code=1
2022-11-14 18:14:17,077 ERROR: failed to bootstrap from leader 'my-cluster-timescaledb-0'
2022-11-14 18:14:27,076 ERROR: Permission denied
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 498, in wrapper
    return func(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 1088, in touch_member
    ret = self._api.patch_namespaced_pod(self._name, self._namespace, body)
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 483, in wrapper
    return getattr(self._core_v1_api, func)(*args, **kwargs)
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 419, in wrapper
    return self._api_client.call_api(method, path, headers, body, **kwargs)
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 388, in call_api
    return self._handle_server_response(response, _preload_content)
  File "/usr/lib/python3/dist-packages/patroni/dcs/kubernetes.py", line 218, in _handle_server_response
    raise k8s_client.rest.ApiException(http_resp=response)
patroni.dcs.kubernetes.K8sClient.rest.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Audit-Id': 'a34c6fd2-a1c3-4cdf-99cf-1288fddf8817', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'Date': 'Mon, 14 Nov 2022 18:14:27 GMT', 'Content-Length': '289'})
HTTP response body: b'{"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"pods \"my-cluster-timescaledb-1\" is forbidden: PodSecurityPolicy: unable to validate pod: []","reason":"Forbidden","details":{"name":"my-cluster-timescaledb-1","kind":"pods"},"code":403}\n'

问题分析 #

1. 核心触发点：报错明确显示PSP无法验证Pod，同时Patroni执行touch_member操作（Patch Pod）时返回403权限拒绝。这说明两个关键权限缺失：
   • Pod本身的安全上下文不符合PSP规则，导致创建/更新被阻止；
   • 所用ServiceAccount缺少Patch Pod的RBAC权限，Patroni无法维护集群状态。
2. pgbackrest报错的关联性：pgbackrest的restore脚本退出是Pod无法正常启动的结果，而非原因——因为PSP阻止了Pod初始化，导致副本无法从主节点同步数据，进而触发pgbackrest操作失败。

修复步骤 #

• 检查ServiceAccount的PSP绑定
  确保已有的my-cluster-timescaledb ServiceAccount被绑定到包含必要权限的ClusterRole或Role，需涵盖：

  • 允许Pod使用符合TimescaleDB要求的安全上下文（如runAsUser=999、fsGroup=999，对应postgres用户组）；
  • 授予pods/patch权限，让Patroni能够更新Pod的状态或注解。

• 验证PSP规则细节
  查看集群中生效的PSP，确认以下规则是否允许：

  • 允许使用指定的PersistentVolumeClaim（对应wal和data卷的挂载）；
  • 允许容器暴露TimescaleDB所需的端口（如5432）；
  • 允许容器执行脚本（pgbackrest恢复操作需要执行脚本）；
  • 允许设置runAsNonRoot、allowPrivilegeEscalation=false等TimescaleDB默认的安全上下文配置。

• 临时验证与逐步收紧
  如果无法快速定位PSP的具体限制，可先给ServiceAccount绑定一个宽松的PSP（如privileged，仅用于测试），确认Pod能正常启动后，再逐步调整PSP规则到符合安全要求的范围。

• 确认ServiceAccout权限完整性
  检查已有ServiceAccount的RBAC权限，确保包含以下资源的操作权限：

  apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "patch"]
  

内容的提问来源于stack exchange，提问作者ritratt