时间戳

首页 > 解决方案 > Kubernetes 上的 IBM 文件存储卡在“待处理”

kubernetes - Kubernetes 上的 IBM 文件存储卡在“待处理”

问题描述

我正在尝试使用以下https://cloud.ibm.com/docs/containers?topic=containers-file_storage#add_file：

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: ibmc-file
  labels:
    billingType: 'monthly'
    region: us-south
    zone: dal10
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 12Gi
  storageClassName: ibmc-file-silver

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: postgres
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: postgres
    spec:
      containers:
        - name: postgres
          image: postgres:11
          imagePullPolicy: Always
          ports:
            - containerPort: 5432
          envFrom:
            - configMapRef:
                name: postgres-config
          volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql/data
      volumes:
        - name: postgres-storage
          persistentVolumeClaim:
            claimName: ibmc-file

但是 PVC 永远不会“绑定”并被卡在“待处理”状态。

➜  postgres-kubernetes kubectl describe pvc ibmc-file
Name:          ibmc-file
Namespace:     default
StorageClass:  ibmc-file-silver
Status:        Pending
Volume:        
Labels:        billingType=monthly
               region=us-south
               zone=dal10
Annotations:   ibm.io/provisioning-status=failed: Storage creation failed with error: {Code:E0013, Description:User doesn't have permissions to create or manage Storage [Backend Error:Validation failed due to missin...
               kubectl.kubernetes.io/last-applied-configuration={"apiVersion":"v1","kind":"PersistentVolumeClaim","metadata":{"annotations":{},"labels":{"billingType":"monthly","region":"us-south","zone":"dal10"},"n...
               volume.beta.kubernetes.io/storage-provisioner=ibm.io/ibmc-file
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:      
Access Modes:  
Events:
  Type     Reason                Age                From                                                                                    Message
  ----     ------                ----               ----                                                                                    -------
  Normal   Provisioning          10m (x3 over 10m)  ibm.io/ibmc-file_ibm-file-plugin-5d7684d8c5-xlvks_db50c480-500f-11e9-ba08-cae91657b92d  External provisioner is provisioning volume for claim "default/ibmc-file"
  Warning  ProvisioningFailed    10m (x3 over 10m)  ibm.io/ibmc-file_ibm-file-plugin-5d7684d8c5-xlvks_db50c480-500f-11e9-ba08-cae91657b92d  failed to provision volume with StorageClass "ibmc-file-silver": Storage creation failed with error: {Code:E0013, Description:User doesn't have permissions to create or manage Storage [Backend Error:Validation failed due to missing permissions[NAS_MANAGE] for User[id:xxx, name:xxxm_2018-11-20-07.35.49, email:xxx, account:xxx]], Type:MissingStoragePermissions, RC:401, Recommended Action(s):Run `ibmcloud ks api-key-info` to see the owner of the API key that is used to order storage. Then, contact the account administrator to add the missing storage permissions. If infrastructure credentials were manually set via `ibmcloud ks credentials-set`, check the permissions of that user. Delete the PVC and re-create it. If the problem persists, open an IBM Cloud support case.}
  Normal   ExternalProvisioning  7m (x22 over 10m)  persistentvolume-controller                                                             waiting for a volume to be created, either by external provisioner "ibm.io/ibmc-file" or manually created by system administrator
  Normal   ExternalProvisioning  11s (x26 over 6m)  persistentvolume-controller                                                             waiting for a volume to be created, either by external provisioner "ibm.io/ibmc-file" or manually created by system administrator

标签： kubernetesibm-cloud

解决方案

@atkayla 您能否尝试运行kubectl get secret storage-secret-store -n kube-system -o yaml | grep slclient.toml: | awk '{print $2}' | base64 --decode以查看存储机密存储中使用的 API 密钥？如果这也显示了您的姓名和电子邮件地址，则文件存储插件使用分配给您的权限。

您可能拥有创建集群的权限，但您可能缺少一些不允许您创建存储的存储权限。您是帐户的所有者并且有可能检查权限吗？你应该有Add/Upgrade Storage (StorageLayer)和Storage Manage。

如果您没有这些权限，请添加这些权限，然后运行ibmcloud ks api-key-set以更新 API 密钥。存储秘密存储会在 5-15 分钟后自动刷新。然后，您可以再试一次。

推荐阅读