使用 OpenShift 进行卷挂载的写入权限

Question

Using OpenShift 3.11, I've mounted an nfs persistent volume, but the application cannot copy into the new volume, saying:

oc logs my-project-77858bc694-6kbm6 
cp: cannot create regular file '/config/dbdata/resdb.lock.db': Permission denied
...

I've tried to change the ownership of the folder by doing a chown in an InitContainers, but it tells me the operation not permitted.

      initContainers:
        - name: chowner
          image:  alpine:latest
          command: ["/bin/sh", "-c"]
          args:
            - ls -alt /config/dbdata; chown 1001:1001 /config/dbdata;
          volumeMounts:
          - name: my-volume
            mountPath: /config/dbdata/ 

oc logs my-project-77858bc694-6kbm6 -c chowner
total 12
drwxr-xr-x    3 root     root          4096 Nov  7 03:06 ..
drwxr-xr-x    2 99       99            4096 Nov  7 02:26 .
chown: /config/dbdata: Operation not permitted

I expect to be able to write to the mounted volume.

Answer 1

You can give your Pods permission to write into a volume by using fsGroup: GROUP_ID in a Security Context. fsGroup makes your volumes writable by GROUP_ID and makes all processes inside your container part of that group.

For example:

apiVersion: v1
kind: Pod
metadata:
  name: POD_NAME
spec:
  securityContext:
    fsGroup: GROUP_ID
...