Kubernetes의 SC 및 PVC에서 사용할 때 쓸 수 있도록 NFS 내보내기에 대한 권한을 어떻게 설정합니까?

Kubernetes의 SC 및 PVC에서 사용할 때 쓸 수 있도록 NFS 내보내기에 대한 권한을 어떻게 설정합니까?

저는 Debian 기반 배포판(LMDE)에 Minikube를 배포하고 nfs-kernel-server.

/srv/nfs-volume1   *(rw,sync,no_subtree_check)

그런 다음 아래 지침에 따라 다음 명령을 사용하여 PertantVolume(PV) 및 PertantVolumeClaim(PVC)을 Minikube에 추가했습니다 csi-driver-nfs. https://discuss.kubernetes.io/t/use-nfs-for-pertant-volumes/19035

user@laptop1:/srv$ ls -lrt
total 4
drwxrwxrwx 4 nobody nogroup 4096 Aug 31 20:47 nfs-volume1
user@laptop1:/srv$

SC(StorageClass) 및 PVC는 다음과 같이 구성됩니다.

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: nfs-vol1
provisioner: nfs.csi.k8s.io
parameters:
  server: 192.168.0.150
  share: /srv/nfs-volume1
reclaimPolicy: Delete
volumeBindingMode: Immediate
mountOptions:
  - hard
  - nfsvers=4.2
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: nfs-pvc
spec:
  storageClassName: nfs-vol1
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 5Gi

그런 다음 Kubeflow/JupyterLab 기반 노트북용 PVC를 사용합니다(Kubeflow UI에서 가져옴).

apiVersion: kubeflow.org/v1beta1
kind: Notebook
metadata:
  annotations:
    notebooks.kubeflow.org/server-type: jupyter
  creationTimestamp: '2023-08-31T18:50:02Z'
  generation: 1
  labels:
    app: volume-book
  managedFields:
    - apiVersion: kubeflow.org/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        f:metadata:
          f:annotations:
            .: {}
            f:notebooks.kubeflow.org/server-type: {}
          f:labels:
            .: {}
            f:app: {}
        f:spec:
          .: {}
          f:template:
            .: {}
            f:spec:
              .: {}
              f:containers: {}
              f:serviceAccountName: {}
              f:tolerations: {}
              f:volumes: {}
      manager: OpenAPI-Generator
      operation: Update
      time: '2023-08-31T18:50:02Z'
    - apiVersion: kubeflow.org/v1beta1
      fieldsType: FieldsV1
      fieldsV1:
        f:status:
          .: {}
          f:conditions: {}
          f:containerState:
            .: {}
            f:running:
              .: {}
              f:startedAt: {}
          f:readyReplicas: {}
      manager: manager
      operation: Update
      subresource: status
      time: '2023-08-31T18:50:06Z'
  name: volume-book
  namespace: kubeflow-user-example-com
  resourceVersion: '110625'
  uid: c92ba16b-4b0b-4399-b651-77d7a2eb730f
spec:
  template:
    spec:
      containers:
        - env: []
          image: kubeflownotebookswg/jupyter-pytorch-cuda-full:v1.7.0-rc.0
          imagePullPolicy: IfNotPresent
          name: volume-book
          resources:
            limits:
              cpu: '0.6'
              memory: 1.2Gi
              nvidia.com/gpu: '1'
            requests:
              cpu: '0.5'
              memory: 1Gi
          volumeMounts:
            - mountPath: /dev/shm
              name: dshm
            - mountPath: /home/jovyan/kubeflow-volume
              name: kubeflow-volume
            - mountPath: /home/jovyan
              name: volume-book-volume
      serviceAccountName: default-editor
      tolerations: []
      volumes:
        - emptyDir:
            medium: Memory
          name: dshm
        - name: kubeflow-volume
          persistentVolumeClaim:
            claimName: kubeflow-volume
            readOnly: false
        - name: volume-book-volume
          persistentVolumeClaim:
            claimName: volume-book-volume
status:
  conditions:
    - lastProbeTime: '2023-08-31T18:50:06Z'
      lastTransitionTime: '2023-08-31T18:50:05Z'
      status: 'True'
      type: Initialized
    - lastProbeTime: '2023-08-31T18:50:06Z'
      lastTransitionTime: '2023-08-31T18:50:06Z'
      status: 'True'
      type: Ready
    - lastProbeTime: '2023-08-31T18:50:06Z'
      lastTransitionTime: '2023-08-31T18:50:06Z'
      status: 'True'
      type: ContainersReady
    - lastProbeTime: '2023-08-31T18:50:06Z'
      lastTransitionTime: '2023-08-31T18:50:03Z'
      status: 'True'
      type: PodScheduled
  containerState:
    running:
      startedAt: '2023-08-31T18:50:05Z'
  readyReplicas: 1

그러나 볼륨에 쓰려고 하면 다음 오류가 발생합니다.

 [I 2023-08-31 20:44:03.073 ServerApp] Creating new file in /kubeflow-volume 
 [W 2023-08-31 20:44:03.074 ServerApp] 403 POST /notebook/kubeflow-user-example-com/volume-book/api/contents/kubeflow-volume?1693514643048 (127.0.0.6): Permission denied: kubeflow-volume/untitled.txt 
 [W 2023-08-31 20:44:03.075 ServerApp] wrote error: 'Permission denied: kubeflow-volume/untitled.txt' 

파일 시스템의 볼륨은 다음과 같습니다.

user@laptop1:/srv/nfs-volume1$ ll -d pvc-4a07985a-0207-41cc-8d2f-dec8ffbad3d7 
drwxrwsr-x 2 nobody nogroup 4096 Aug 31 20:47 pvc-4a07985a-0207-41cc-8d2f-dec8ffbad3d7

소유권은 nfs 내보내기 디렉터리에서 가져오지만 권한은 가져오지 않습니다.

여러 노트북/포드에서 NFS 스토리지 클래스를 사용할 수 있도록 권한을 설정하려면 어떻게 해야 합니까?

관련 정보