如何给 grafana 用户适当的权限，以便它可以成功启动？

Question

环境：

kubernetes provider: gke
kubernetes version: v1.13.12-gke.25
grafana version: 6.6.2 (official image)

grafana 部署清单：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      name: grafana
      labels:
        app: grafana
    spec:
      containers:
      - name: grafana
        image: grafana/grafana:6.6.2
        ports:
        - name: grafana
          containerPort: 3000
        # securityContext:
        #     runAsUser: 104
        #     allowPrivilegeEscalation: true
        resources:
          limits:
            memory: "1Gi"
            cpu: "500m"
          requests: 
            memory: "500Mi"
            cpu: "100m"
        volumeMounts:
          - mountPath: /var/lib/grafana
            name: grafana-storage
      volumes:
        - name: grafana-storage
          persistentVolumeClaim:
              claimName: grafana-pvc

问题

当我第一次部署这个 grafana 仪表板时，它工作正常。一段时间后，我重新启动了 pod 以检查卷挂载是否正常工作。重新启动后，我得到以下错误。

mkdir: can't create directory '/var/lib/grafana/plugins': Permission denied
GF_PATHS_DATA='/var/lib/grafana' is not writable.
You may have issues with file permissions, more information here: http://docs.grafana.org/installation/docker/#migration-from-a-previous-version-of-the-docker-container-to-5-1-or-later

我从这个错误中了解到，用户可以创建这些文件。我怎样才能给这个用户适当的权限来成功启动 grafana？

Answer 1

我使用适当的 PVC 重新创建了您的部署，并注意到 grafana pod 失败了。

命令输出：$ kubectl get pods -n monitoring

NAME READY STATUS RESTARTS AGE
grafana-6466cd95b5-4g95f 0/1 Error  2  65s

进一步调查指出了与您相同的错误：

mkdir: can't create directory '/var/lib/grafana/plugins': Permission denied
GF_PATHS_DATA='/var/lib/grafana' is not writable.
You may have issues with file permissions, more information here: http://docs.grafana.org/installation/docker/#migration-from-a-previous-version-of-the-docker-container-to-5-1-or-later

此错误在首次创建 pod 和部署时显示。无需重新创建任何 pod。

我所做的是编辑您的部署：

apiVersion: apps/v1
kind: Deployment
metadata:
  name: grafana
  namespace: monitoring
spec:
  replicas: 1
  selector:
    matchLabels:
      app: grafana
  template:
    metadata:
      name: grafana
      labels:
        app: grafana
    spec:
      securityContext:
          runAsUser: 472
          fsGroup: 472
      containers:
      - name: grafana
        image: grafana/grafana:6.6.2
        ports:
        - name: grafana
          containerPort: 3000
        resources:
          limits:
            memory: "1Gi"
            cpu: "500m"
          requests:
            memory: "500Mi"
            cpu: "100m"
        volumeMounts:
          - mountPath: /var/lib/grafana
            name: grafana-storage
      volumes:
        - name: grafana-storage
          persistentVolumeClaim:
              claimName: grafana-pvc

请具体看一下部分：

      securityContext:
          runAsUser: 472
          fsGroup: 472

这是官方文档中描述的设置：Kubernetes.io: set the security context for a pod

请查看与您的问题类似的 Github 问题，并向我指出允许 pod 正确生成的解决方案：

• https://github.com/grafana/grafana-docker/issues/167

从 5.1 版开始，Grafana 进行了一些重大更新。请看：Grafana.com: Docs: Migrate to v5.1 or later

如果这有帮助，请告诉我。