Longhorn PVC Ownership and Permission
Kubernetes supports the 2 volume modes for PVC: Filesystem and Block. When a pod defines the security context and requests a Longhorn PVC, Kubernetes will handle the ownership and permission modification for the PVC differently based on the volume mode.
Because the Longhorn CSI driver csiDriver.spec.fsGroupPolicy
is set to ReadWriteOnceWithFSType
, the Kubelet attempts to change the ownership and permission of a Longhorn PVC in the following manner:
pod.spec.securityContext.fsGroup
.fsType
of the PV and accessModes
of the PVC.fsType
is defined and the PVC’s accessModes
list contains ReadWriteOnly
, continue to the next step.pod.spec.securityContext.fsGroupChangePolicy
.pod.spec.securityContext.fsGroupChangePolicy
is set to always
or empty, the kubelet performs the following actions:pod.spec.securityContext.fsGroup
pod.spec.securityContext.fsGroup
pod.spec.securityContext.fsGroup
every time the volume is mountedpod.spec.securityContext.fsGroupChangePolicy
is set to OnRootMismatch
:pod.spec.securityContext.fsGroup
) , the recursive permission and ownership change will be skipped.pod.spec.securityContext.fsGroup
For more information, see:
For PVC with Block volume mode, Kubelet never attempts to change the permission and ownership of the block device when making it available inside the container.
You must set the correct group ID in the pod.spec.securityContext
for the pod to be able to read and write to the block device or run the container as root.
By default, Longhorn puts the block device into group id 6, which is typically associated with the “disk” group.
Therefore, pods that use Longhorn PVC with Block volume mode must either set the group id 6 in the pod.spec.securityContext
, or run as root.
For example:
pod.spec.securityContext
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: longhorn-block-vol
spec:
accessModes:
- ReadWriteOnce
volumeMode: Block
storageClassName: longhorn
resources:
requests:
storage: 2Gi
---
apiVersion: v1
kind: Pod
metadata:
name: block-volume-test
namespace: default
spec:
securityContext:
runAsGroup: 1000
runAsNonRoot: true
runAsUser: 1000
supplementalGroups:
- 6
containers:
- name: block-volume-test
image: ubuntu:20.04
command: ["sleep", "360000"]
imagePullPolicy: IfNotPresent
volumeDevices:
- devicePath: /dev/longhorn/testblk
name: block-vol
volumes:
- name: block-vol
persistentVolumeClaim:
claimName: longhorn-block-vol
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: longhorn-block-vol
spec:
accessModes:
- ReadWriteOnce
volumeMode: Block
storageClassName: longhorn
resources:
requests:
storage: 2Gi
---
apiVersion: v1
kind: Pod
metadata:
name: block-volume-test
namespace: default
spec:
containers:
- name: block-volume-test
image: ubuntu:20.04
command: ["sleep", "360000"]
imagePullPolicy: IfNotPresent
volumeDevices:
- devicePath: /dev/longhorn/testblk
name: block-vol
volumes:
- name: block-vol
persistentVolumeClaim:
claimName: longhorn-block-vol
© 2019-2024 Longhorn Authors | Documentation Distributed under CC-BY-4.0
© 2024 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page.