panxiao81/gitea-dynamic-runner
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

修复只读根文件系统下的 ServiceAccount token 挂载 #8

Merged
panxiao81 merged 1 commits from fix/serviceaccount-mountpoint into main 2026-09-16 15:20:02 +00:00
Conversation 0 Commits 1 Files Changed 1
+3 -1
panxiao81 commented 2026-09-16 15:19:03 +00:00
Owner
Copy Link
Copy Source

Pod worker 开启 readOnlyRootFilesystem 时，kubelet 无法在镜像中临时创建 projected ServiceAccount token 的目标目录，导致容器在启动前失败。

本次修改在 controller/worker 共用镜像中预创建 /var/run/secrets/kubernetes.io/serviceaccount，继续保留只读根文件系统。

验证：

  • 14 项单元测试通过
  • controller 镜像构建成功
  • 以 UID/GID 65532 验证目标目录存在且可访问
Pod worker 开启 `readOnlyRootFilesystem` 时，kubelet 无法在镜像中临时创建 projected ServiceAccount token 的目标目录，导致容器在启动前失败。 本次修改在 controller/worker 共用镜像中预创建 `/var/run/secrets/kubernetes.io/serviceaccount`，继续保留只读根文件系统。 验证： - 14 项单元测试通过 - controller 镜像构建成功 - 以 UID/GID 65532 验证目标目录存在且可访问
panxiao81 added 1 commit 2026-09-16 15:19:04 +00:00
修复只读根文件系统下的服务账号令牌挂载
test / python (pull_request) Successful in 10s
Details
test / shell (pull_request) Successful in 21s
Details
3ec528623a
panxiao81 merged commit cbfcb10143 into main 2026-09-16 15:20:02 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
panxiao81 (Xiao Pan)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: panxiao81/gitea-dynamic-runner#8