Please implement fsGroup, to automatically chown subdir contents

[mossroy]

It's a stable feature of kubernetes since 1.23: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods, and very useful, especially when you run containers as non-root.

This feature does not seem to be supported by nfs-subdir-external-provisioner.

Here is a test-case:

• deploy a pvc and a pod using it (with a fsGroup configured). For example with the manifests below
• on the NFS server, create a file in the corresponding directory, for example with touch test, see its owner/group with ls -ln test
• restart the pod
• check again with ls -ln test if the group has been changed to the one specified in fsGroup (70 in my example below)

Example manifests:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: testcase-fsgroup
spec:
  selector:
    matchLabels:
      app: testcase-fsgroup
  replicas: 1
  template:
    metadata:
      labels:
        app: testcase-fsgroup
    spec:
      securityContext:
        fsGroup: 70
        fsGroupChangePolicy: "Always"
      containers:
      - image: nginx:latest
        name: nginx
        volumeMounts:
        - mountPath: "/usr/share/nginx/html"
          name: testcase-fsgroup
      volumes:
      - name: testcase-fsgroup
        persistentVolumeClaim:
          claimName: testcase-fsgroup
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: testcase-fsgroup
spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: nfs-client
  resources:
    requests:
      storage: 10Mi

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle rotten
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten