0

I have a kube cluster running using kind. Kind runs in a docker container. It has access to a volume by way of the following:

  extraMounts:
  - hostPath: /mnt/disk-1/shared
    containerPath: /shared-drive

... the persistent-volume and pvc configuration:

---
# Volumes - PVC write
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: pvc-write
  namespace: ingress-nginx
spec:
  accessModes: [ReadWriteOnce]
  resources:
    requests:
      storage: 100Gi
---
# PV
apiVersion: v1
kind: PersistentVolume
metadata:
  name: shared-drive
  namespace: ingress-nginx
spec:
  capacity:
    storage: 100Gi
  accessModes:
   - ReadWriteOnce
  storageClassName: standard
  hostPath:
    path: /shared-drive

... the request for the volume in the deployment template spec:

    spec:
      volumes:
      - name: shared-drive
        persistentVolumeClaim:
          claimName: pvc-write
          readOnly: false
        ...
        volumeMounts:
        - name: shared-drive
          mountPath: "/shared"

Other observations

From within the container where I need access to the shared volume: (accessed by docker exec -ti cluster-control-plane bash -> crictl exec -ti the-container sh)

> ls -l /
...
drw-rw-rw-   2 appuser appuser   26 Oct  9 19:36 shared
  1. I can view a list of the files in the shared directory
  2. I cannot read nor write to the directory
  3. I can read and write in other directories belonging to appuser
  4. The volume being shared by the host (the host running kind) has rw permissions for "other" users

I've played a bit with setting the securityContext for the container without success. This attempt was not thorough as I'm at a loss for how to interpret what I'm "solving for". So for instance, the following did not solve the problem:

# included in the deployment template spec
securityContext:
  runAsUser: 999
  runAsGroup: 999
  fsGroupChangePolicy: "OnRootMismatch"
Edmund's Echo
  • 766
  • 8
  • 15

0 Answers0