goharbor / harbor

An open source trusted cloud native registry project that stores, signs, and scans content.
https://goharbor.io
Apache License 2.0
23.68k stars 4.72k forks source link

persistence.persistentVolumeClaim.trivy.existingClaim can't have value #20639

Closed linonetwo closed 2 months ago

linonetwo commented 2 months ago

Expected behavior and actual behavior:

Need to provide existingClaim when upgrade or change values using helm upgrade harbor --namespace image-registry ./harbor, otherwise there will be "device already mounted at" error:

MountVolume.SetUp failed for volume "pvc-4bcbe5a9-200f-44a3-bd73-101d7951589c" : rpc error: code = Internal desc = rpc error: code = Internal desc = verifyMount: device already mounted at [/var/lib/kubelet/pods/13dacfb6-b1e3-4037-9e92-2e67856858b4/volumes/kubernetes.io~csi/pvc-4bcbe5a9-200f-44a3-bd73-101d7951589c/mount /host/var/lib/kubelet/pods/13dacfb6-b1e3-4037-9e92-2e67856858b4/volumes/kubernetes.io~csi/pvc-4bcbe5a9-200f-44a3-bd73-101d7951589c/mount]

Steps to reproduce the problem:

But if fill value at persistence.persistentVolumeClaim.trivy.existingClaim, it also gives error:

helm upgrade harbor --namespace image-registry ./harbor
Error: UPGRADE FAILED: cannot patch "harbor-trivy" with kind StatefulSet: StatefulSet.apps "harbor-trivy" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden

while fill this value for registry and jobservice is OK. it is not used and still cause "device already mounted at" for pod

persistence:
  enabled: true
  resourcePolicy: "keep"
  persistentVolumeClaim:
    registry:
      existingClaim: "harbor-registry"
      storageClass: ""
      subPath: ""
      accessMode: ReadWriteOnce
      size: 5Gi
      annotations: {}
    jobservice:
      jobLog:
        existingClaim: "harbor-jobservice"

Versions:

Additional context:

linonetwo commented 2 months ago

Can be workaround by manually deleting the old pod when upgrading helm.

MinerYang commented 2 months ago

Will close by non-related.