Unable to mount and read only file error #45
Comments
|
+1 |
|
I'm also experiencing this issue trying to mount to a container. Some more details, if it helps:
Certificate definition: apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: registry-tls
spec:
secretName: registry-tls-secret
dnsNames:
- 'registry.redacted.net'
issuerRef:
name: letsencrypt-ca
kind: ClusterIssuerPod definition: apiVersion: v1
kind: Pod
metadata:
name: docker-registry-pod
labels:
app: registry
spec:
containers:
- name: registry
image: registry:2
volumeMounts:
- name: repo-vol
mountPath: '/var/lib/registry'
- name: tls
mountPath: '/tls'
volumes:
- name: repo-vol
persistentVolumeClaim:
claimName: docker-registry-vol-claim
- name: tls
csi:
readOnly: yes
driver: csi.cert-manager.io
volumeAttributes:
csi.cert-manager.io/issuer-name: letsencrypt-ca
csi.cert-manager.io/dns-names: registry.redacted.netLogs from csi driver are a bunch of the following: Logs from cert-manager: I can't really tell what's happening here, tbh. It looks like the certificate -is- being issued, but not in time? So the CSI driver deletes the certificate request and tries again which again times out? I'm using the Cloudflare DNS challenge solver for cert-manager, so it's possible that the propagation delay is to blame here. I've also tried it with the disable-auto-renew attribute. ETA: after messing around with this for a bit, I eventually gave up and mounted the TLS secret as a volume on the container. |
@glmdev I have the same issue, what did you do to fix it? |
|
For anyone running into the above, can they please share what the status is of the CertificateRequest which is causing them problems? e.g.: Also setting a higher log level on the csi-driver should help give an idea on what is happening: |
|
It sounds like everyone here is using Let's Encrypt with the CSI driver - is that correct? I am not sure if the CSI driver is the best tool for this job if so, as the CSI driver will perform a whole new Order on every pod creation for a new certificate, which is likely going to eat up all your quota with their API. Also to clarify, you don't need to use the CSI driver at all if you are creating a Certificate resource - you'll just want to mount the generated Secret into the Pod as a volume like you've resorted to above 😊 |
|
For now I fell back to manual certificate management, I'll check that when I get the time. No, I have a local CA generated with openssl. |
|
I am trying to use cert-manager log: From what I understood from the doc, one doesn't need to create any Certificate resource (in which we define
I will really appreciate any help. |
|
Hi @GarbageYard, looking at the events of the CertificateRequest, the The |
|
Thanks, actually the name for the ClusterIssuer was incorrectly set. Now I am getting this error:
Since |
inteon
added
the
priority/awaiting-more-evidence
|
Using |
|
I'm on a new project now, we use the CSI driver with no issue. |
Warning FailedMount 11m (x329 over 16h) kubelet Unable to attach or mount volumes: unmounted volumes=[tls], unattached volumes=[tls kube-api-access-2v6n8]: timed out waiting for the condition
Warning FailedMount 88s (x482 over 16h) kubelet MountVolume.SetUp failed for volume "tls" : rpc error: code = Unknown desc = chmod /var/lib/kubelet/pods/0fd27403-622b-457c-b43f-606472572c59/volumes/kubernetes.io~csi/tls/mount: read-only file system
The text was updated successfully, but these errors were encountered: