kubernetes: modified subpath configmap mount fails when container restarts

I have the same issue with docker 1.11.5 using AKS. I found a workaround using projected key for volumes definition.

apiVersion: v1
kind: ConfigMap
metadata:
  name: test-configmap
  namespace: test-cfg
data:
  common1.json: |
    {
      "logger": {
        "enabled": true,
        "level": "info",
        "extreme": false,
        "stream": "stdout"
      }
    }
  common2.json: |
    {
      "test": 4         
    }
---
apiVersion: v1
kind: Pod 
metadata:
  name: issue
  namespace: test-cfg
spec:
  volumes:
  - name: conf-volume
    configMap:
      name: test-configmap
  containers:
  - name: test
    image: ubuntu:bionic
    command: ["sleep", "30"]
    resources:
      requests:
        cpu: 100m
    volumeMounts:
      - name: conf-volume
        mountPath: /etc/common1.json
        subPath: common1.json
      - name: conf-volume
        mountPath: /etc/common2.json
        subPath: common2.json
---
apiVersion: v1
kind: Pod 
metadata:
  name: working
  namespace: test-cfg
spec:
  volumes:
  - name: conf-volume
    projected:
      sources:
      - configMap:
          name: test-configmap
          items:
            - key: common1.json
              path: common1.json
            - key: common2.json
              path: common2.json
  containers:
  - name: test-container
    image: ubuntu:bionic
    imagePullPolicy: "Always"
    resources:
      requests:
        cpu: 100m
    volumeMounts:
      - name: conf-volume
        mountPath: /test
    command: ["sleep", "30"]

With this configuration , Issue pod will not restart, instead working pod will work. Steps are the same as described here

Can we get this issue reopened ?

Any reason this was closed? Looks like it’s still an issue.

It was closed because https://github.com/kubernetes/kubernetes/pull/89629 was submitted against the development branch. But you’re still going to see the problem on older versions unless a fix is backported.

And as I mentioned in https://github.com/kubernetes/kubernetes/issues/93691 I think the backport to 1.18.1 was buggy, which makes me wonder about other versions.

To work around the problem ensure that your deployments recreate the pods when you configmaps change, for example by adding a checksum of the configmaps to the annotations of the deployment/statefulset pod template.

Is there a better solution in versions before v1.19？

We are also experiencing this issue (GKE with k8s 1.15 & 1.16). As a workaround we have used slightly simpler version of workaround shown by @Zero-2 with items field for ConfigMapVolumeSource instead of using projected volume, for example:

volumes:
- name: app-config
  configMap:
    name: app-config
    items:
    - key:  config.json
      path: config.json

https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.16/#configmapvolumesource-v1-core

Issue seen on k8s 1.14.3, docker 18.06.3-ce, CoreOs Container Linux 2135.5.0 with subPath from secret in the same directory where another secret has a subPath

this seems related to:

moby/moby#37083

docker fixed this bug in the 18.06.03-ce , but I also saw this issue with kubernetes v1.13.2 and docker 18.06.03-ce