Kubernetes Security Policy fsgroup not working

Viewed 44

Trying to mount Kubernetes volume to a pod(running as non-root) with fsGroup SecurityContext option. But the volume is still mounted as root and getting permission denied from the pod when trying to do write operations on the filesystem

Created the Persistent volume:

kind: PersistentVolume
apiVersion: v1
metadata:
  name: pv-demo
spec:
  storageClassName: nfs
  capacity:
    storage: 10Gi
  nfs:
    server: xxx.xxx.xxx.xxx
    path: /nfs/data/demo
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  volumeMode: Filesystem

Persistent volume claim:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: demo-vol
spec:
  storageClassName: nfs
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 10Gi
  volumeName: pv-demo

StatefulSet for the application deployment. The container image starts as user 1001(belonging to group 0)

apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: demo-app
  labels:
    app: demo-app
spec:
  replicas: 1
  serviceName: demo-app
  selector:
    matchLabels:
      app: demo-app
    spec:
      securityContext:
        fsGroup: 0
        fsGroupChangePolicy: "OnRootMismatch"
      containers:
      - name: demo-app-container
        image: <theImage>
        volumeMounts:
            - mountPath: /store
              name: demo-vol
      volumes:
        - name: demo-vol
          persistentVolumeClaim:
            claimName: demo-vol
0 Answers
Related