如何在Kubernetes上运行Polynote？

Question

我希望能在我的Kubernetes集群上运行Polynote，特别是针对编程方面的内容。不幸的是，我没有什么好运气，错误信息也不是很有帮助。据我所知，它还比较新，因此我无法使用已有的参考Kubernetes配置使其正常工作。

使用下面的YAML文件，我成功启动了它。但是，当我端口转发并尝试访问Pod时，它会崩溃，然后重新启动。不幸的是，我获得的错误消息只是Killed，这并没有提供太多的指导意义。我从裸Docker镜像开始，然后添加了他们在他们的存储库中的Docker备注中建议的配置。

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: polynote-config
  namespace: dev
  labels:
    app: polynote
data:
  config.yml: |-
    listen:
      host: 0.0.0.0

    storage:
      dir: /opt/notebooks
      mounts:
        examples:
          dir: examples
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: polynote
  namespace: dev
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: polynote
    spec:
      containers:
      - name: polynote
        image: polynote/polynote:latest
        resources:
          limits:
            memory: "100Mi"
          requests:
            memory: "100Mi"
        ports:
        - containerPort: 8192
        volumeMounts:
        - name: config
          mountPath: /opt/config/config.yml
          readOnly: true
          subPath: config.yml
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: polynote-config

编辑：为了清晰起见，这是来自Pod的全部日志记录：

[INFO]  Loading configuration from config.yml
[INFO]  Loaded configuration: PolynoteConfig(Listen(8192,127.0.0.1),Storage(tmp,notebooks,Map()),List(),List(),Map(),Map(),Behavior(true,Always,List()),Security(None),UI(/))
[WARN]  Polynote allows arbitrary remote code execution, which is necessary for a notebook tool to function.
        While we'll try to improve safety by adding security measures, it will never be completely safe to
        run Polynote on your personal computer. For example:

        - It's possible that other websites you visit could use Polynote as an attack vector. Browsing the web
          while running Polynote is unsafe.
        - It's possible that remote attackers could use Polynote as an attack vector. Running Polynote on a
          computer that's accessible from the internet is unsafe.
        - Even running Polynote inside a container doesn't guarantee safety, as there will always be
          privilege escalation and container escape vulnerabilities which an attacker could leverage.

        Please be diligent about checking for new releases, as they could contain fixes for critical security
        flaws.

        Please be mindful of the security issues that Polynote causes; consult your company's security team
        before running Polynote. You are solely responsible for any breach, loss, or damage caused by running
        this software insecurely.
[zio-default-async-1-1076496284] INFO org.http4s.blaze.channel.nio1.NIO1SocketServerGroup - Service bound to address /127.0.0.1:8192
[zio-default-async-1-1076496284] INFO org.http4s.server.blaze.BlazeServerBuilder - 


  _____      _                   _
 |  __ \    | |                 | |
 | |__) |__ | |_   _ _ __   ___ | |_ ___
 |  ___/ _ \| | | | | '_ \ / _ \| __/ _ \
 | |  | (_) | | |_| | | | | (_) | ||  __/
 |_|   \___/|_|\__, |_| |_|\___/ \__\___|
                __/ |
               |___/

Server running at http://127.0.0.1:8192
[zio-default-async-1-1076496284] INFO org.http4s.server.blaze.BlazeServerBuilder - http4s v0.20.6 on blaze v0.14.6 started at http://127.0.0.1:8192/
Killed

- josephkibe

---

你检查过 kubectl logs 中的日志了吗？ - erik258

确实，这就是我上面要写的。错误的程度是“已终止”，这并不能提供太多帮助。我将在上面粘贴完整的日志。 - josephkibe

哦，抱歉，我错过了那个。除非你有充分的理由相信你没有使用超过100 MiB（这是你允许的pod的全部），否则你可能会因资源不足而被k8s无情地终止。 - erik258

关于内存使用的问题，你说得很好。我不知道为什么错过了内存不足错误。虽然我已经让它运行起来了，但引导内核仍然因未知原因崩溃，但这可能与 Kubernetes 无关。 - josephkibe

Answer 1

问题最终有两个方面。首先，我设置的内存限制确实过低，需要大约2GB的内存才能成功启动。其次，原来我没有为笔记本文件挂载任何存储设备。

以下是我设计的有效清单。我知道我为笔记本挂载存储的方式可能不是最优的，但既然我知道它正在工作，我感到舒适可以进行调整。

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: polynote-config
  namespace: dev
  labels:
    app: polynote
data:
  config.yml: |-
    listen:
      host: 0.0.0.0

    storage:
      dir: /opt/notebooks
      mounts:
        examples:
          dir: examples
---
apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: polynote
  namespace: dev
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: polynote
    spec:
      containers:
      - name: polynote
        image: polynote/polynote:latest
        resources:
          limits:
            memory: "2000Mi"
            ephemeral-storage: "100Mi"
          requests:
            memory: "2000Mi"
            ephemeral-storage: "100Mi"
        ports:
        - containerPort: 8192
        volumeMounts:
        - name: config
          mountPath: /opt/config/config.yml
          readOnly: true
          subPath: config.yml
        - name: data
          mountPath: /opt/notebooks/
      volumes:
      - name: config
        configMap:
          defaultMode: 0600
          name: polynote-config
      - name: data
        emptyDir: {}

- josephkibe