Kubernetes/Minikube：挂载volume后，pod挂载目录为空

Question

我是 k8s 的新手。我正在关注official tutorial 使用 minikube 在 k8s 中设置 Nginx pod、安装卷和服务 index.html。

当我安装并转到主页页面时，我收到此错误 directory index of "/usr/share/nginx/html/" is forbidden。

如果我没有挂载任何东西，我会收到一个“欢迎使用 Nginx”页面。

这是挂载前该文件夹的内容。而在 mount 为空之后

root@00c1:/usr/share/nginx/html# ls -l
total 8
-rw-r--r-- 1 root root 494 Jul 23 11:45 50x.html
-rw-r--r-- 1 root root 612 Jul 23 11:45 index.html

为什么挂载后pod里面的mounted文件夹是空的？

这是我的设置

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Mi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/home/my_username/test/html"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Mi
---
apiVersion: v1
kind: ReplicationController
metadata:
  name: nginx-hello-rc
spec:
  replicas: 2
  selector:
    app: hello-nginx-tester
  template:
    metadata:
      labels:
        app: hello-nginx-tester
    spec:
      securityContext:
        fsGroup: 1000
      volumes:
        - name: task-pv-storage
          persistentVolumeClaim:
            claimName: task-pv-claim
      containers:
        - name: task-pv-container
          image: nginx
          ports:
            - containerPort: 80
              name: "http-server"
          volumeMounts:
            - mountPath: "/usr/share/nginx/html"
              name: task-pv-storage
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-tester
  labels:
    app: hello-nginx-tester
spec:
  type: NodePort
  ports:
  - port: 80
    nodePort: 30500
    protocol: TCP
  selector:
    app: hello-nginx-tester

任何信息将不胜感激。谢谢

Answer 1

我已经在我运行的 k8s 环境中检查了您的配置。经过一些调整后，以下清单对我来说很顺利：

apiVersion: v1
kind: PersistentVolume
metadata:
  name: task-pv-volume
  labels:
    type: local
spec:
  storageClassName: manual
  capacity:
    storage: 10Mi
  accessModes:
    - ReadWriteOnce
  hostPath:
    path: "/home/my_username/test/html"
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: task-pv-claim
spec:
  storageClassName: manual
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 3Mi
  volumeName: task-pv-volume
---
apiVersion: v1
kind: ReplicationController
metadata:
  name: nginx-hello-rc
spec:
  replicas: 2
  selector:
    app: hello-nginx-tester
  template:
    metadata:
      labels:
        app: hello-nginx-tester
    spec:
      securityContext:
        fsGroup: 1000
      volumes:
        - name: task-pv-volume
          persistentVolumeClaim:
            claimName: task-pv-claim
      containers:
        - name: task-pv-container
          image: nginx
          ports:
            - containerPort: 80
              name: "http-server"
          volumeMounts:
            - mountPath: "/usr/share/nginx/html"
              name: task-pv-volume
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-tester
  labels:
    app: hello-nginx-tester
spec:
  type: NodePort
  ports:
  - port: 80
    nodePort: 30500
    protocol: TCP
  selector:
    app: hello-nginx-tester

Answer 2

目录“/usr/share/nginx/html”的所有者将是 1000，因为您已经设置了 SecurityContext fsGroup 值。因此，您无法访问该目录。如果删除 SecurityContext 部分，已安装卷的所有者将设置为 root。您不会遇到访问问题。