K8S-Pod挂载数据卷权限问题

• 场景：需要将同一个服务的多个Pod副本的日志持久化到本地，为方便根据Pod的名称快速查看日志，在Pod挂载数据卷时，可以通过subPathExpr和env变量配合使用为每个Pod副本自动创建以Pod名称命名的文件夹
• 故障：自动创建的文件夹属主属组为root，业务进程使用appuser启动，导致程序无法进行写操作
• 解决：

[root@master-176 ccas]# cat ccas-tomcat.yaml 
kind: Deployment
apiVersion: extensions/v1beta1
metadata:
  name: ccas-tomcat-deploy
spec:
  replicas: 3
  selector:
    matchLabels:
      app: ccas-tomcat
  template:
    metadata:
      name: ccas-tomcat
      labels:
        app: ccas-tomcat
    spec:
      volumes:
      - name: webapps
        nfs:
          path: /app/data/kubernetes/ccas/tomcat/webapps
          server: 172.16.52.62
      - name: tomcat-logs
        hostPath:
          path: /app/data/ccas
          type: DirectoryOrCreate
      - name: app-logs
        hostPath:
          path: /app/data/ccas
          type: DirectoryOrCreate
      - name: backup
        hostPath:
          path: /app/data/ccas
          type: DirectoryOrCreate
      initContainers:
      - name: volume-init
        image: alpine:3.18
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        volumeMounts:
        - name: tomcat-logs
          mountPath: /app/apache-tomcat-9.0.0.M15/logs
          subPathExpr: $(POD_NAME)/tomcat_logs
        - name: app-logs
          mountPath: /app/logs
          subPathExpr: $(POD_NAME)/app_logs
        - name: backup
          mountPath: /app/backup
          subPathExpr: $(POD_NAME)/backup
        command: ["sh", "-c", "adduser -D appuser; chown -R appuser.appuser /app; ls -l /app"]
      containers:
      - name: tomcat
        env:
        - name: POD_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        image: 172.16.52.62:18082/lancoo/tomcat:9.0.0
        volumeMounts:
        - name: webapps
          mountPath: /app/apache-tomcat-9.0.0.M15/webapps
        - name: tomcat-logs
          mountPath: /app/apache-tomcat-9.0.0.M15/logs
          subPathExpr: $(POD_NAME)/tomcat_logs
        - name: app-logs
          mountPath: /app/logs
          subPathExpr: $(POD_NAME)/app_logs
        - name: backup
          mountPath: /app/backup
          subPathExpr: $(POD_NAME)/backup

---

kind: Service
apiVersion: v1
metadata:
  name: ccas-tomcat-svc
spec:
  type: NodePort
  selector:
    app: ccas-tomcat
  ports:
  - port: 8082
    protocol: TCP
    targetPort: 8080
    nodePort: 30086