K
Q

Kubernetes - setting custom permissions/file ownership per volume (and not per pod)

10/27/2017

Is there any way to set per-volume permissions/ownership in Kubernetes declaratively?

Usecase:

  • a pod is composed of two containers, running as two distinct users/groups, both of them non-root, and are unable to sudo
  • the containers mount a volume each, and need to create files in these volumes (e.g. both of them want to write logs)

We know that we can use fsGroup, however that is a pod-level declaration. So even if we pick fsGroup equal to user in first container, then we are going to have permission issues in the other one. (ref: Kubernetes: how to set VolumeMount user group and file permissions)

-- Adam Kotwasinski
kubernetes

Similar Questions

Kubernetes fission create env error
Phoenix channel's socket keeps getting closed in distributed cluster environment
HAProxy 1.8 - Passing socket connection during HAProxy soft reload
Issue mounting Cloud SQL credentials to a container in Kubernetes

2 Answers

9/13/2019

It can be done with adding one init container with root access.

initContainers: - name: changeowner image: busybox command: ["sh", "-c", "chown -R 200:200 /"] volumeMounts: - name: mountPath: /

-- rajdeepbs29
Source: StackOverflow
10/27/2017

One solution is to use init-container to change permissions of mounted directories.

The init-container would need to mount both volumes (from both containers), and do the needed chown/chmod operations.

Drawbacks:

  • extra container that needs to be aware of other containers' specific (ie. uid/gid)
  • init container needs to run as root to perform chown
-- Adam Kotwasinski
Source: StackOverflow