CODEWITHSUNDEEP
kubernetesfile-permissions
Nic Rohr
Nic Rohr

Reputation: 1

After mounting a second pod to Local-Storage PVC in Kubernetes v 1.27, first pod loses permissions to directory

Using local storage to store data files to /data/dummy1. This works fine forever as long as I can tell. I have the pod running as root performing basic file generation & writes.

A second container mounts to the same PVC to monitor the directory. As soon as the second container mounts, the first container loses permissions for /data as root. Even exec-ing into the pod/container I cannot do ls /data/dummy1 anymore.

Both pods are running on the same node, Pod 2 now does have access to the directory. I can see the files written on the host system

fsGroup, runAsUser, and runAsGroup are all the same and root between pods.

rhel 8.8
xfs filesystem

pvc.yaml

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: pvc-3
  namespace: dummy 
spec:
  storageClassName: local-storage 
  accessModes:
    - ReadWriteMany
  volumeName: pv-3
  resources:
    requests:
      storage: 10Gi

deploy-spec.yaml

...
        volumeMounts:
        - mountPath: /data
          name: local-persistent-storage
      volumes:
        - name: local-persistent-storage
          persistentVolumeClaim:
            claimName: pvc-3

Tried: Mount pod1 to local-storage pvc, read/write files Mount pod2 to same local-storage pvc, read/write files.

Expected: ability to read and write files from 2 pods with same security context on the same node mounted to the same local-storage pvc

Actual: Pod2 gained access to read/write and Pod1 lost access

Upvotes: 0

Views: 200

Answers (1)

Nic Rohr
Nic Rohr

Reputation: 1

I found the answer was in the way selinux flags were being modified on pod/container startup.

I modified the directory
sudo chcon -Rt svirt_sandbox_file_t s0 [directory path]

Upvotes: 0

Related Questions