kubernetes-sigs / nfs-subdir-external-provisioner

Dynamic sub-dir volume provisioner on a remote NFS server.
Apache License 2.0
2.6k stars 762 forks source link

Please implement fsGroup, to automatically chown subdir contents #350

Open mossroy opened 3 months ago

mossroy commented 3 months ago

It's a stable feature of kubernetes since 1.23: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods, and very useful, especially when you run containers as non-root.

This feature does not seem to be supported by nfs-subdir-external-provisioner.

Here is a test-case:

Example manifests:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: testcase-fsgroup
spec:
  selector:
    matchLabels:
      app: testcase-fsgroup
  replicas: 1
  template:
    metadata:
      labels:
        app: testcase-fsgroup
    spec:
      securityContext:
        fsGroup: 70
        fsGroupChangePolicy: "Always"
      containers:
      - image: nginx:latest
        name: nginx
        volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: testcase-fsgroup
      volumes:
      - name: testcase-fsgroup
        persistentVolumeClaim:
          claimName: testcase-fsgroup
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: testcase-fsgroup
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: nfs-client
  resources:
    requests:
      storage: 10Mi
k8s-triage-robot commented 5 days ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale