预先填充的mysql停靠映像在安装pod模板安全上下文时不会启动。

Question

我有一个带有预极化模式的mysql映像，下面我共享设置文件。

我的伪造文件：

FROM mysql:8.0.31 as builder

# That file does the DB initialization but also runs mysql daemon, by removing the last line it will only init
RUN ["sed", "-i", "s/exec \"$@\"/echo \"not running $@\"/", "/usr/local/bin/docker-entrypoint.sh"]

# needed for intialization
ENV MYSQL_ROOT_PASSWORD=test

COPY ./sql-scripts /docker-entrypoint-initdb.d/

# Need to change the datadir to something else that /var/lib/mysql because the parent docker file defines it as a volume.
# https://docs.docker.com/engine/reference/builder/#volume :
#       Changing the volume from within the Dockerfile: If any build steps change the data within the volume after
#       it has been declared, those changes will be discarded.
RUN ["/usr/local/bin/docker-entrypoint.sh", "mysqld", "--datadir", "/initialized-db"]

FROM mysql:8.0.31

COPY --from=builder /initialized-db /var/lib/mysql

我的吊舱模板yaml：

apiVersion: v1
kind: Pod
metadata:
  labels:
    label: 'backend'
spec:
  shareProcessNamespace: true
  containers:
    - name: "maven"
      image: maven:3.6.3-openjdk-11
      resources:
        requests:
          memory: "2Gi"
          cpu: "2"
        limits:
          memory: "10Gi"
          cpu: "10"
      command: [ sleep ]
      args: [ 1h ]
      securityContext:
        capabilities:
          add:
            - SYS_PTRACE
    - name: mysql
      image: myDockerRegistry/mysql8-integration-test:v5
      env:
        - name: MYSQL_USER
          value: test
        - name: MYSQL_PASSWORD
          value: test
        - name: MYSQL_ROOT_PASSWORD
          value: test
      securityContext:
        capabilities:
          add:
            - SYS_PTRACE

我的管道：

pipeline {
    agent {
        kubernetes {
            yaml libraryResource('pod-templates/backend.yaml')
        }
    }
    stages { ... }
}

上面的设置工作正常，但我想使用动态PVC作为工作区，然后在pod模板之后将下面的一行添加到管道中。

workspaceVolume dynamicPVC(accessModes: 'ReadWriteOnce',requestsSize: "10Gi", storageClassName: 'premium-rwo')

但是我必须将securityContext添加到我的pod模板中，这样jenkins就能够在代理中安装PVC：

spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000

通过这些更改，吊舱启动并正确地挂载卷，但是mysql容器无法工作。这是错误日志：

2022-11-03 09:33:25+00:00 [Note] [Entrypoint]: Entrypoint script for MySQL Server 8.0.31-1.el8 started.
'/var/lib/mysql/mysql.sock' -> '/var/run/mysqld/mysqld.sock'
2022-11-03T09:33:25.839933Z 0 [Warning] [MY-011068] [Server] The syntax '--skip-host-cache' is deprecated and will be removed in a future release. Please use SET GLOBAL host_cache_size=0 instead.
2022-11-03T09:33:25.842508Z 0 [System] [MY-010116] [Server] /usr/sbin/mysqld (mysqld 8.0.31) starting as process 13
2022-11-03T09:33:25.845263Z 0 [Warning] [MY-010122] [Server] One can only use the --user switch if running as root
mysqld: File './binlog.index' not found (OS errno 13 - Permission denied)
2022-11-03T09:33:25.845867Z 0 [ERROR] [MY-010119] [Server] Aborting
2022-11-03T09:33:25.846078Z 0 [System] [MY-010910] [Server] /usr/sbin/mysqld: Shutdown complete (mysqld 8.0.31)  MySQL Community Server - GPL.

I asume是与mysql容器中的根权限相关的东西，但是很奇怪，因为官方的映像运行得很完美。

最后，这是注入jenkins代理后生成的原始yaml：

apiVersion: v1
kind: Pod
metadata:
  annotations:
    buildUrl: >-
      http://jenkins.jenkins.svc.cluster.local:8080/job/LegacyProjects/job/my-project/job/k8s-test/79/
    runUrl: job/LegacyProjects/job/my-project/job/k8s-test/79/
  labels:
    label: backend
    jenkins/jenkins-jenkins-agent: 'true'
    jenkins/label-digest: 4581eadfdfcb3d0141b8e8727b53b2ff9a3575ec
    jenkins/label: LegacyProjects_my-project_k8s-test_79-xgtxd
  name: my-project-k8s-test-79-xgtxd-2xw2r-8wj64
  namespace: jenkins
spec:
  containers:
    - args:
        - 1h
      command:
        - sleep
      image: 'maven:3.6.3-openjdk-11'
      name: maven
      resources:
        limits:
          memory: 10Gi
          cpu: '10'
        requests:
          memory: 2Gi
          cpu: '2'
      securityContext:
        capabilities:
          add:
            - SYS_PTRACE
      volumeMounts:
        - mountPath: /home/jenkins/agent
          name: workspace-volume
          readOnly: false
    - env:
        - name: MYSQL_USER
          value: test
        - name: MYSQL_PASSWORD
          value: test
        - name: MYSQL_ROOT_PASSWORD
          value: test
      image: 'myDockerRegistry/mysql8-integration-test:v5'
      name: mysql
      securityContext:
        capabilities:
          add:
            - SYS_PTRACE
      volumeMounts:
        - mountPath: /home/jenkins/agent
          name: workspace-volume
          readOnly: false
    - env:
        - name: JENKINS_SECRET
          value: '********'
        - name: JENKINS_TUNNEL
          value: 'jenkins-agent.jenkins.svc.cluster.local:50000'
        - name: JENKINS_AGENT_NAME
          value: my-project-k8s-test-79-xgtxd-2xw2r-8wj64
        - name: JENKINS_NAME
          value: my-project-k8s-test-79-xgtxd-2xw2r-8wj64
        - name: JENKINS_AGENT_WORKDIR
          value: /home/jenkins/agent
        - name: JENKINS_URL
          value: 'http://jenkins.jenkins.svc.cluster.local:8080/'
      image: 'jenkins/inbound-agent:4.11-1-jdk11'
      name: jnlp
      resources:
        limits: {}
        requests:
          memory: 256Mi
          cpu: 100m
      volumeMounts:
        - mountPath: /home/jenkins/agent
          name: workspace-volume
          readOnly: false
  nodeSelector:
    kubernetes.io/os: linux
  restartPolicy: Never
  securityContext:
    fsGroup: 1000
    runAsGroup: 1000
    runAsUser: 1000
  shareProcessNamespace: true
  volumes:
    - name: workspace-volume
      persistentVolumeClaim:
        claimName: pvc-workspace-my-project-test-79-xgtxd-2xw2r-8wj64
        readOnly: false

如有任何帮助，将不胜感激。

Answer 1

默认情况下，COPY命令只作为根用户工作，您应该为该命令指定--chown=1000:1000标志以设置正确的用户和组(在您的示例中--它的用户带有uid和gid 1000，在securityContext中指定)，有关更多细节，请参见https://stackoverflow.com/a/44766666和https://docs.docker.com/engine/reference/builder/#copy

虽然用例可能需要使用数据库进行预构建映像，但考虑以db的形式运行正式的mysql映像，并考虑使用init容器使用液化基/flyway或其他(甚至内置)数据库迁移工具包，从长远来看，这可能是一个更可移植的解决方案。