为Kubernetes现有Pod添加sidecar日志容器后Pod崩溃问题求助

一、错误点清单 #

• YAML语法错误：业务容器（simple-webapp）的启动命令缺少command字段前缀，直接在容器层级定义命令数组不符合K8s YAML规范
• Shell语法错误：业务容器启动脚本中存在echo "$(date) INFO $i" >>;语句，重定向符号后未指定输出文件，执行会直接报错崩溃
• 存储卷定义错误：spec.volumes下的varlog共享卷未指定存储类型（应使用emptyDir实现Pod内容器共享存储），错误添加了仅属于volumeMounts的mountPath字段
• 重复字段冲突：sidecar容器（count-log-1）下重复定义了两次volumeMounts块，手动编写的serviceAccount挂载属于冗余配置，会覆盖K8s自动注入逻辑引发异常
• 冗余无效配置：sidecar容器无需定义8080端口监听，busybox执行的tail命令不会监听任何端口，该配置属于无效内容
• 非法字段残留：YAML中包含creationTimestamp、resourceVersion、uid、status等K8s自动生成的只读字段，手动提交时携带这些字段会直接报错
• 功能匹配错误：需求要求共享卷挂载到/var/log/k8slog路径，原配置错误将卷挂载到了/var/log路径
• 基础逻辑错误：K8s不支持对运行中的Pod动态添加容器，如需添加sidecar必须重建Pod

二、修正后符合要求的YAML配置 #

apiVersion: v1
kind: Pod
metadata:
  labels:
    name: webapp-1
  name: webapp-1
  namespace: default
spec:
  containers:
  - image: kodekloud/event-simulator
    imagePullPolicy: Always
    name: simple-webapp
    command:
    - /bin/sh
    - -c
    - >
      i=0;
      while true;
      do
        echo "$i: $(date)" >> /var/log/k8slog/application.log;
        echo "$(date) INFO $i" >> /var/log/k8slog/application.log;
        i=$((i+1));
        sleep 1;
      done
    volumeMounts:
    - name: varlog
      mountPath: /var/log/k8slog
  - name: count-log-1
    image: busybox
    args: [/bin/sh, -c, 'tail -n+1 /var/log/k8slog/application.log']
    volumeMounts:
    - name: varlog
      mountPath: /var/log/k8slog
    resources: {}
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: Always
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: default
  serviceAccountName: default
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
    tolerationSeconds: 300
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
    tolerationSeconds: 300
  volumes:
  - name: varlog
    emptyDir: {}
  - name: default-token-fgstk
    secret:
      defaultMode: 420
      secretName: default-token-fgstk

验证方法 #

Pod启动后执行kubectl logs webapp-1 -c count-log-1，可正常输出业务容器写入的日志内容即为配置生效。

内容的提问来源于stack exchange，提问作者NelsonVasu