Kubernetes - setting custom permissions/file ownership per volume (and not per pod)

Question

Is there any way to set per-volume permissions/ownership in Kubernetes declaratively?

Usecase:

a pod is composed of two containers, running as two distinct users/groups, both of them non-root, and are unable to sudo
the containers mount a volume each, and need to create files in these volumes (e.g. both of them want to write logs)

We know that we can use fsGroup, however that is a pod-level declaration. So even if we pick fsGroup equal to user in first container, then we are going to have permission issues in the other one. (ref: Kubernetes: how to set VolumeMount user group and file permissions)

Adam Kotwasinski · Accepted Answer · 2017-10-27T12:04:00.567

6

One solution is to use init-container to change permissions of mounted directories.

The init-container would need to mount both volumes (from both containers), and do the needed chown/chmod operations.

Drawbacks:

extra container that needs to be aware of other containers' specific (ie. uid/gid)
init container needs to run as root to perform chown

edited Oct 27 '17 at 12:04

answered Oct 27 '17 at 11:35

Adam Kotwasinski

4,377
3
17
40

2

Hi @Adam - were you able to find an alternative solution to this? – trdavidson Jan 28 '19 at 14:00

score 3 · Answer 2 · edited Oct 13 '20 at 16:45

3

It can be done with adding one init container with root access.

    initContainers:
    - name: changeowner
      image: busybox
      command: ["sh", "-c", "chown -R 200:200 /<volume>"]   
      volumeMounts:
      - name: <your volume>
        mountPath: /<volume>

edited Oct 13 '20 at 16:45

R. Doolan

177
1
1
12

answered Sep 13 '19 at 04:53

rajdeepbs29

1,211
12
9

Kubernetes - setting custom permissions/file ownership per volume (and not per pod)

2 Answers2

Linked