PHP应用从Docker迁移至Kubernetes后访问出现403权限问题求助

我已经完成PHP应用的Docker容器化部署，现尝试迁移至Kubernetes环境，相关配置文件如下：

Dockerfile #

FROM php:7.2-apache
COPY config/php.ini /usr/local/etc/php/
RUN  curl -sSLf \
        -o /usr/local/bin/install-php-extensions \
        https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && \
    chmod +x /usr/local/bin/install-php-extensions && \
    install-php-extensions mysqli

Deployment配置 #

apiVersion: apps/v1
kind: Deployment
metadata:
  name: server-deployment
  labels:
    app: server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: server
  template:
    metadata:
      labels:
        app: server
    spec:
      containers:
      - name: server
        image: ahmedelbagory288/testphp 
        ports:
        - containerPort: 80
        volumeMounts:
        - name: myapp-persistent-storage
          mountPath: /var/www/html/
      volumes:
      - name: myapp-persistent-storage
        persistentVolumeClaim:
          claimName: myapp-pv-claim
---
apiVersion: v1
kind: Service
metadata:
  name: server-service
spec:
  selector:
    app: server
  type: LoadBalancer  
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
      nodePort: 30000 

PersistentVolume配置 #

apiVersion: v1
kind: PersistentVolume
metadata:
  name: myapp-pv
  labels:
    type: local
spec:
  capacity:
   storage: 1Gi
  accessModes:
   - ReadWriteOnce
  hostPath:
    path: /media/bego/data/DevOps-Course/K8s Example/PHP/php my admin/app 
        
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: myapp-pv-claim
spec:
  accessModes:
   - ReadWriteMany
  resources:
   requests: 
    storage: 1Gi

我希望将本地app目录的文件挂载到php:7.2-apache容器中实现访问，但执行minikube service server-service后出现权限错误：

Forbidden
You don't have permission to access this resource.

Apache/2.4.38 (Debian) Server at 172.17.0.2 Port 30000

该问题核心原因是PV与PVC访问模式不匹配，且挂载目录权限与Apache运行用户（www-data）不兼容，以下是具体修复步骤：

1. 修复PV与PVC访问模式冲突 #

你的PersistentVolume设置的访问模式是ReadWriteOnce，但PersistentVolumeClaim请求的是ReadWriteMany，会导致PVC无法正确绑定PV，需调整PVC的访问模式与PV一致：

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: myapp-pv-claim
spec:
  accessModes:
   - ReadWriteOnce  # 修改为与PV一致的访问模式
  resources:
   requests: 
    storage: 1Gi

2. 调整挂载目录权限 #

方法一：修改Dockerfile添加权限配置 #

在Dockerfile中增加权限设置，确保www-data用户拥有/var/www/html目录的读写权限：

FROM php:7.2-apache
COPY config/php.ini /usr/local/etc/php/
RUN  curl -sSLf \
        -o /usr/local/bin/install-php-extensions \
        https://github.com/mlocati/docker-php-extension-installer/releases/latest/download/install-php-extensions && \
    chmod +x /usr/local/bin/install-php-extensions && \
    install-php-extensions mysqli && \
    # 添加权限配置
    chown -R www-data:www-data /var/www/html && \
    chmod -R 755 /var/www/html

重新构建镜像并更新Deployment中的镜像地址。

方法二：在Deployment中添加初始化容器调整权限 #

若不想重新构建镜像，可在Deployment中添加init容器，提前调整挂载目录的权限：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: server-deployment
  labels:
    app: server
spec:
  replicas: 1
  selector:
    matchLabels:
      app: server
  template:
    metadata:
      labels:
        app: server
    spec:
      initContainers:
      - name: fix-permissions
        image: busybox:latest
        command: ["sh", "-c", "chown -R 33:33 /var/www/html && chmod -R 755 /var/www/html"]
        volumeMounts:
        - name: myapp-persistent-storage
          mountPath: /var/www/html/
      containers:
      - name: server
        image: ahmedelbagory288/testphp 
        ports:
        - containerPort: 80
        volumeMounts:
        - name: myapp-persistent-storage
          mountPath: /var/www/html/
      volumes:
      - name: myapp-persistent-storage
        persistentVolumeClaim:
          claimName: myapp-pv-claim

注：33是php:7.2-apache镜像中www-data用户的固定UID。

3. 验证修复效果 #

执行以下命令重新应用配置：

kubectl apply -f pv.yaml
kubectl apply -f deployment.yaml

等待Pod重启完成后，再次执行minikube service server-service访问应用。

内容的提问来源于stack exchange，提问作者Ahmed EL Bagory