1

I am mount a NFS file system path in kubernetes cluster(v1.18) pods in CentOS 8(the nfs is installed in Fedora 32), this is my pv yaml define:

apiVersion: v1
kind: PersistentVolume
metadata:
    name: nfs-jenkins-pv
    namespace: infrastrcuture
spec:
    capacity:
    storage: 8Gi
    accessModes:
    - ReadWriteOnce
    mountOptions:
    - vers=4.0
    - noresvport
    nfs:
    server: "192.168.31.2"
    path: "/home/dolphin/data/k8s/monitoring/infrastructure/jenkins"
    persistentVolumeReclaimPolicy: Retain

and when I start pod, it show this error:

MountVolume.SetUp failed for volume "nfs-jenkins-pv" : mount failed: exit status 32 Mounting command: systemd-run Mounting arguments: --description=Kubernetes transient mount for /var/lib/kubelet/pods/656dacd8-fcc9-44f1-a0c8-baa7eb5fa82e/volumes/kubernetes.io~nfs/nfs-jenkins-pv --scope -- mount -t nfs -o noresvport,vers=4.0 192.168.31.2:/home/dolphin/data/k8s/monitoring/infrastructure/jenkins /var/lib/kubelet/pods/656dacd8-fcc9-44f1-a0c8-baa7eb5fa82e/volumes/kubernetes.io~nfs/nfs-jenkins-pv Output: Running scope as unit: run-r5dc1ce59823746ffbbb18381cbec71cc.scope mount.nfs: Operation not permitted

I am tried to change the jenkins folder privillege like this:

chmod 777 jenkins

but still not work.I could mount the nfs file system from local machine using command line with root like this:

sudo mount -t nfs -o v3 192.168.31.2:/home/dolphin/data/k8s/monitoring/infrastructure/jenkins /mnt

but in kuberentes cluster it it always root user and root is not a good practice and may cause security problem. I have tweak the exports file in /etc/exports like this:

[dolphin@MiWiFi-R4CM-srv infrastructure]$ cat /etc/exports
/home/dolphin/data/k8s/monitoring/infrastructure/jenkins *(rw,no_root_squash)

what should I do to make anyone could mount nfs file system? maybe avoid using root user.

0

use nfsv3 works:

apiVersion: v1
kind: PersistentVolume
metadata:
    name: nfs-jenkins-pv
    namespace: infrastrcuture
spec:
    capacity:
    storage: 8Gi
    accessModes:
    - ReadWriteOnce
    nfs:
    server: "192.168.31.2"
    path: "/home/dolphin/data/k8s/monitoring/infrastructure/jenkins"
    persistentVolumeReclaimPolicy: Retain

or using nfsv4,the file should write like this:

apiVersion: v1
kind: PersistentVolume
metadata:
  name: nfs-jenkins-pv
  namespace: infrastrcuture
spec:
  capacity:
    storage: 8Gi
  accessModes:
    - ReadWriteOnce
  mountOptions:
    - vers=4.0
  nfs:
    server: "192.168.31.2"
    path: "/infrastructure/jenkins"
  persistentVolumeReclaimPolicy: Retain

and define the /etc/exports file like this:

[dolphin@MiWiFi-R4CM-srv alertmanager]$ cat /etc/exports
/home/dolphin/data/k8s *(rw,fsid=0,sync,insecure_locks,insecure,no_root_squash)
/home/dolphin/data/k8s/infrastructure/jenkins *(rw,fsid=1000,sync,insecure_locks,insecure,no_root_squash)
/home/dolphin/data/k8s/monitoring/alertmanager *(rw,fsid=1001,sync,insecure_locks,insecure,no_root_squash)
2
  • 3
    I guess, this is more removeing noresvport works – kofemann Jul 19 '20 at 16:11
  • I tested it and not noresvport, it is v3 and v4 mount diff. v4 should specify root dir.@kofemann – Dolphin Jul 26 '20 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.