fsGroup does not change the owner of the mounted directory.

[LennyLip]

Hello, I have hostPath PersistentVolume that mounts correctly. I set securityContext/fsGroup as described in documentation.

apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    supplementalGroups: [4000]
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox:1.28
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

Also I have extraMounts config as described in documentation

machine:
    kubelet:
        extraMounts:
            - destination: /var/lib/example # Destination is the absolute path where the mount will be placed in the container.
              type: bind # Type specifies the mount kind.
              source: /var/lib/example # Source specifies the source path of the mount.
              # Options are fstab style mount options.
              options:
                - bind
                - rshared
                - rw

These settings are applied to the pod, but they do not change the owner of the mountPath. The group is still root, not the fsGroup ID

drwxr-xr-x 2 root root 6 Dec 5 22:38 data

Does anyone know why this is happening? Thanks.

[LennyLip]

Resolved by this code, but I don't understand why is fsGroup is not works directly.

      initContainers:
        - name: set-volume-ownership
          image: busybox:1.28
          command: ["sh", "-c", "chown -R 2000:2000 /data/demo"]
          volumeMounts:
            - name: sec-ctx-vol
              mountPath: /data/demo
          securityContext:
            runAsUser: 0 # <-run as root
            runAsGroup: 0

[smira]

I think something is missing in the question, the volume is emptyDir, not PV, and not sure how /var/lib/example matters

[LennyLip]

I think something is missing in the question, the volume is emptyDir, not PV, and not sure how /var/lib/example matters

Hi, thanks for the response. It was just a copy-paste from docs. My PV config was taken from here . So it's type: local and it have the same paths.

runAsGroup
runAsUser
also, it seems, do not change anything, but it applies to the pods.

ps.
The Docker file image uses a custom user
USER appuser

[smira]

If you have a short but complete reproducer, we can look into that. Something we can kubectl apply and see the problem.