0

I'm trying to mount a Kubernetes secret object as a volume in the following way:

securityContextCustom:
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
    extraVolumes:
    - name: es-security-config
      projected:
        defaultMode: 0600
        sources:
        - secret:
            name: users-secret
        - secret:
            name: users-roles-secret
    extraVolumeMounts:  
    - name: es-security-config
      mountPath: /usr/share/elasticsearch/config/users
      subPath: users
    - name: es-security-config
      mountPath: /usr/share/elasticsearch/config/users_roles
      subPath: users_roles

'users-secret' and 'users-roles-secret' are the kubernetes secret object which I want to mount as a volume in their respective mountPath.

However, when I check the file permissions ls -ltr, I get this:

-rw------- 1 root          elasticsearch             24 Feb  2 11:13 users_roles
-rw------- 1 root          elasticsearch            136 Feb  2 11:13 users

I decided to use securityContextCustom (using opendistro elastic-search) and change the ownership of the mounted secrets.

running id inside the dir gives me:

uid=1000(elasticsearch) gid=1000(elasticsearch) groups=1000(elasticsearch)

So I'm seeing the ID being changed correctly.

As you can see the group id has changed but the owner still remains as root. Any ideas why this is the case? I want root to be also changed to userid of 1000 (elasticsearch) for our pod to correctly work.

David Maze
  • 130,717
  • 29
  • 175
  • 215
Samuel Syed
  • 11
  • 5
  • Did you try use command `sudo chown elasticsearch users users_roles` to change ownership of these dirs? – RadekW Feb 03 '22 at 09:23
  • At this moment there is no way to change ownership for mounted secrets. This feature is still awaited. You can follow FR [here](https://github.com/kubernetes/kubernetes/issues/81089). Fortunately there is a workaround for it. [Here](https://stackoverflow.com/a/51478536/14801225) is an answer how to achieve it. Let me know if it is helpful for you – RadekW Feb 03 '22 at 14:59

0 Answers0