附加持久卷时拒绝 NiFi 权限

Question

我在 AWS EKS 上创建了一个 NiFi 集群。最初的部署工作正常。后来我将持久卷和持久卷声明附加到 NiFi 设置。启动 NiFi 后，出现此错误：

ERROR in ch.qos.logback.core.rolling.RollingFileAppender[USER_FILE] - openFile(/opt/nifi/nifi-current/logs/nifi-user.log,true) call failed. java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)

由于我不是 NiFi 和 Kubernetes 方面的专家，因此我无法确定问题所在。它看起来像是 NiFi 的权限问题。我使用的 NiFi 版本是 NiFI 1.15.0。

这可能是什么根本原因？这是因为 NiFi 没有使用 root 用户还是其他原因？

我在这里分享完整的错误：

13:56:22,449 |-ERROR in ch.qos.logback.core.rolling.RollingFileAppender[USER_FILE] - openFile(/opt/nifi/nifi-current/logs/nifi-user.log,true) call failed. java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)
    at java.io.FileNotFoundException: /opt/nifi/nifi-current/logs/nifi-user.log (Permission denied)
    at  at java.io.FileOutputStream.open0(Native Method)
    at  at java.io.FileOutputStream.open(FileOutputStream.java:270)
    at  at java.io.FileOutputStream.<init>(FileOutputStream.java:213)
    at  at ch.qos.logback.core.recovery.ResilientFileOutputStream.<init>(ResilientFileOutputStream.java:26)
    at  at ch.qos.logback.core.FileAppender.openFile(FileAppender.java:204)
    at  at ch.qos.logback.core.FileAppender.start(FileAppender.java:127)
    at  at ch.qos.logback.core.rolling.RollingFileAppender.start(RollingFileAppender.java:100)
    at  at ch.qos.logback.core.joran.action.AppenderAction.end(AppenderAction.java:90)
    at  at ch.qos.logback.core.joran.spi.Interpreter.callEndAction(Interpreter.java:309)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:193)
    at  at ch.qos.logback.core.joran.spi.Interpreter.endElement(Interpreter.java:179)
    at  at ch.qos.logback.core.joran.spi.EventPlayer.play(EventPlayer.java:62)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:165)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:152)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:110)
    at  at ch.qos.logback.core.joran.GenericConfigurator.doConfigure(GenericConfigurator.java:53)
    at  at ch.qos.logback.classic.util.ContextInitializer.configureByResource(ContextInitializer.java:75)
    at  at ch.qos.logback.classic.util.ContextInitializer.autoConfig(ContextInitializer.java:150)
    at  at org.slf4j.impl.StaticLoggerBinder.init(StaticLoggerBinder.java:84)
    at  at org.slf4j.impl.StaticLoggerBinder.<clinit>(StaticLoggerBinder.java:55)
    at  at org.slf4j.LoggerFactory.bind(LoggerFactory.java:150)
    at  at org.slf4j.LoggerFactory.performInitialization(LoggerFactory.java:124)
    at  at org.slf4j.LoggerFactory.getILoggerFactory(LoggerFactory.java:417)
    at  at org.slf4j.LoggerFactory.getLogger(LoggerFactory.java:362)
    at  at org.apache.nifi.bootstrap.RunNiFi.<init>(RunNiFi.java:145)
    at  at org.apache.nifi.bootstrap.RunNiFi.main(RunNiFi.java:284)

我还分享了描述我用于创建 NiFi 集群的 pv 和 PVC 的 Kubernetes 清单部分：

        volumeMounts:
          - name: "data"
            mountPath: /opt/nifi/nifi-current/data
          - name: "flowfile-repository"
            mountPath: /opt/nifi/nifi-current/flowfile_repository
          - name: "content-repository"
            mountPath: /opt/nifi/nifi-current/content_repository
          - name: "provenance-repository"
            mountPath: /opt/nifi/nifi-current/provenance_repository
          - name: "logs"
            mountPath: /opt/nifi/nifi-current/logs

  volumeClaimTemplates:
    - metadata:
        name: "data"
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "gp2"
        resources:
          requests:
            storage: 1Gi
    - metadata:
        name: "flowfile-repository"
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "gp2"
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: "content-repository"
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "gp2"
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: "provenance-repository"
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "gp2"
        resources:
          requests:
            storage: 10Gi
    - metadata:
        name: "logs"
      spec:
        accessModes: ["ReadWriteOnce"]
        storageClassName: "gp2"
        resources:
          requests:
            storage: 5Gi

感谢任何帮助。

Answer 1

假设您在创建 pv 和 pvc 时没有任何问题，请尝试使用额外的 initContainers 部分以允许具有 UID 和 GID 1000 的 NiFi 用户读取和写入配置的 EBS 卷：

initContainers:
- name: fixmount
  image: busybox
  command: [ 'sh', '-c', 'chown -R 1000:1000 /opt/nifi/nifi-current/logs' ]
  volumeMounts:
  - name: logs
    mountPath: /opt/nifi/nifi-current/logs

我希望这将有助于解决您的问题。这是 Kubernetes 官方文档页面Init Containers。