使用‘Ubuntu with Docker’镜像创建的GKE集群无法部署Pod求助

在使用「Ubuntu with Docker」镜像创建的GKE集群上部署DaemonSet时触发OCI运行时错误，具体错误信息如下：

Error response from daemon: OCI runtime create failed: invalid mount {Destination:[/sys/fs/cgroup Type:bind Source:/var/lib/docker/volumes/d9e3b871f4cc210e3dba6471f326dcbf7b404daad7906ed9fc669e207c093ec2/_data Options:[rbind]}: mount destination [/sys/fs/cgroup not absolute: unknown

对应的DaemonSet配置文件：

apiVersion: apps/v1
kind: DaemonSet
metadata:
  labels:
    diamanti.com/app: armada
    diamanti.com/control-plane: 'true'
  name: armada
  namespace: diamanti-system
spec:
  selector:
    matchLabels:
      diamanti.com/app: armada
      diamanti.com/control-plane: 'true'
  template:
    metadata:
      annotations:
        scheduler.alpha.kubernetes.io/critical-pod: ''
      labels:
        diamanti.com/app: armada
        diamanti.com/control-plane: 'true'
    spec:
      containers:
        - envFrom:
            - configMapRef:
                name: armada-config
          image: 'diamanti/armada:v3.3.1-197'
          name: armada
      dnsPolicy: ClusterFirstWithHostNet
      nodeSelector:
        spektra.diamanti.io/node: "true"
      hostNetwork: true
      restartPolicy: Always
      schedulerName: default-scheduler
      serviceAccount: diamanti-node-runner
      serviceAccountName: diamanti-node-runner
      tolerations:
        - effect: NoSchedule
          key: node-role.kubernetes.io/master

注：服务账号diamanti-node-runner已绑定cluster-admin角色。

1. 排查镜像内部的挂载配置错误 #

错误提示显示挂载目标路径格式非法（多了左括号[），这是因为diamanti/armada:v3.3.1-197镜像的Dockerfile或启动脚本中存在错误的挂载指令。可以通过以下步骤验证：

• 本地拉取镜像并检查挂载配置：

  docker pull diamanti/armada:v3.3.1-197
  docker inspect diamanti/armada:v3.3.1-197 | grep -A 20 "Mounts"
  

• 找到错误的挂载语句后修正，重新构建镜像再部署。

2. 覆盖镜像的错误挂载配置 #

在DaemonSet的容器配置中添加自定义的cgroup挂载，绕过镜像内部的错误配置：
修改后的DaemonSet关键配置片段：

spec:
  containers:
    - envFrom:
        - configMapRef:
            name: armada-config
      image: 'diamanti/armada:v3.3.1-197'
      name: armada
      securityContext:
        privileged: true
      volumeMounts:
        - name: cgroup
          mountPath: /sys/fs/cgroup
          mountPropagation: HostToContainer
  volumes:
    - name: cgroup
      hostPath:
        path: /sys/fs/cgroup
        type: Directory

这里直接挂载宿主机的/sys/fs/cgroup目录，确保挂载路径格式正确。

3. 切换GKE节点的容器运行时 #

GKE的Ubuntu+Docker镜像可能与该镜像存在cgroup兼容性问题，建议切换为Containerd运行时的节点镜像：

• 创建集群时选择「Containerd」作为容器运行时
• 对现有集群的节点池进行升级，替换为Containerd类型的节点镜像

内容的提问来源于stack exchange，提问作者sandeep