K
Q

How to define the uid, gid of a mounted volume in Pod

6/14/2020

This is a question in our production environment. We use Kubernetes to deploy our application through Pods. The Pods may need some storage to store files.

We use 'Persistent Volume' and 'Persistent Volume Claim' to present the real backend storage server. Currently, the real back storage server is 'NFS'. But the 'NFS' is not controlled by us and we cannot change the NFS configuration.

Every time, the uid and gid of the volume mount into the Pod is always 'root root'. But the process in the Pod is running as a non-root user, the process cannot read/write the mounted volume. What our current solution is that we define an initContainer which run as root and use command 'chown udi folder' to change the ownership. There is a limitation that the ininContainer must be run as root.

For now, we are trying to deploy our application on Openshift. By default, all the Pods(containers) cannot be run as root. Otherwise, the Pod is failed to create.

So my question is that a k8s way or Openshift way to define/change the uid and gid of the mounted volume. I have tried mountOptions which in talked about in Kubernetes Persistent Volume Claim mounted with wrong gid
`mountOptions: #these options

  • uid=1000
  • gid=1000`

But failed with the below error message. Seems that the NFS server does not support the uid and gid parameters.

Warning  FailedMount  11s  kubelet, [xxxxx.net]  MountVolume.SetUp failed for volume "nfs-gid-pv" : mount failed: exit status 32 Mounting command: systemd-run
Mounting arguments: --description=Kubernetes transient mount for /opt/kubernetes/data/kubelet/pods/3c75930a-d3f7-4d55-9996-4d10dcac9549/volumes/kubernetes.io~nfs/nfs-gid-pv --scope -- mount -t nfs -o gid=1999,uid=1999 shc-sma-cd74.hpeswlab.net:/var/vols/itom/itsma/tzhong /opt/kubernetes/data/kubelet/pods/3c75930a-d3f7-4d55-9996-4d10dcac9549/volumes/kubernetes.io~nfs/nfs-gid-pv
Output: Running scope as unit run-22636.scope.
mount.nfs: an incorrect mount option was specified
  Warning  FailedMount  7s  kubelet, [xxxxx.net]  MountVolume.SetUp failed for volume "nfs-gid-pv" : mount failed: exit status 32
Mounting command: systemd-run
Mounting arguments: --description=Kubernetes transient mount for /opt/kubernetes/data/kubelet/pods/3c75930a-d3f7-4d55-9996-4d10dcac9549/volumes/kubernetes.io~nfs/nfs-gid-pv --scope -- mount -t nfs -o gid=1999,uid=1999 shc-sma-cd74.hpeswlab.net:/var/vols/itom/itsma/tzhong /opt/kubernetes/data/kubelet/pods/3c75930a-d3f7-4d55-9996-4d10dcac9549/volumes/kubernetes.io~nfs/nfs-gid-pv
Output: Running scope as unit run-22868.scope.
mount.nfs: an incorrect mount option was specified
-- Cain
kubernetes
nfs
persistent-volume-claims
persistent-volumes

Similar Questions

Readiness probe failed: Get http://10.32.1.71:80/setting s: net/http: request canceled (Client.Timeout exceeded while awaiting headers)
Unable to add kubernetes-bionic main (Ubuntu 18.04) to apt repository
How do I connect Kubernetes Engine on GCP to an external Google Cloud Storage Bucket?
Kubernetes use External Services inside Pod
Enable webhook authentication kubelet api

1 Answer

6/15/2020

If we speak about Kubernetes, you could set group ID that owns the volume this can be done by using fsGroup, a feature from Pod Security Context.

As or OpenShift I do not know.

apiVersion: v1
kind: Pod
metadata:
  name: hello-world
spec:
  containers:
  # specification of the pod's containers
  # ...
  securityContext:
    fsGroup: 1000

The security context for a Pod applies to the Pod's Containers and also to the Pod's Volumes when applicable. Specifically fsGroup and seLinuxOptions are applied to Volumes as follows:

  • fsGroup: Volumes that support ownership management are modified to be owned and writable by the GID specified in fsGroup. See the Ownership Management design document for more details.

You can also read more about it here and follow steps posted by @rajdeepbs29 posted here.

-- Crou
Source: StackOverflow