whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document recursive chown feature (#19391)

Browse Source 
* Add placeholder docs for recursive chown feature

* Update content/en/docs/concepts/policy/pod-security-policy.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* Update content/en/docs/concepts/policy/pod-security-policy.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* Address feedback

* Move recursive chown docs to correct place

* Address review feedback

* Apply suggestions from code review

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

* move bit about ephemental volumes to note

* Update content/en/docs/tasks/configure-pod-container/security-context.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>

Co-authored-by: Tim Bannister <tim@scalefactory.com>
This commit is contained in:
Hemant Kumar
2020-03-17 06:26:23 -04:00
committed by GitHub
parent 098400c958
commit 5c2e807d0a
2 changed files with 41 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/configure-pod-container/security-context.md
+39
View File
@@ -140,6 +140,45 @@ Exit your shell:
exit
```
## Configure volume permission and ownership change policy for Pods
{{< feature-state for_k8s_version="v1.18" state="alpha" >}}
By default, Kubernetes recursively changes ownership and permissions for the contents of each
volume to match the `fsGroup` specified in a Pod's `securityContext` when that volume is
mounted.
For large volumes, checking and changing ownership and permissions can take a lot of time,
slowing Pod startup. You can use the `fsGroupChangePolicy` field inside a `securityContext`
to control the way that Kubernetes checks and manages ownership and permissions
for a volume.
**fsGroupChangePolicy** - `fsGroupChangePolicy` defines behavior for changing ownership and permission of the volume
before being exposed inside a Pod. This field only applies to volume types that support
`fsGroup` controlled ownership and permissions. This field has two possible values:
* _OnRootMismatch_: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This could help shorten the time it takes to change ownership and permission of a volume.
* _Always_: Always change permission and ownership of the volume when volume is mounted.
For example:
```yaml
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
fsGroupChangePolicy: "OnRootMismatch"
```
This is an alpha feature. To use it, enable the [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) `ConfigurableFSGroupPolicy` for the kube-api-server, the kube-controller-manager, and for the kubelet.
{{< note >}}
This field has no effect on ephemeral volume types such as
[`secret`](https://kubernetes.io/docs/concepts/storage/volumes/#secret),
[`configMap`](https://kubernetes.io/docs/concepts/storage/volumes/#configmap),
and [`emptydir`](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir).
{{< /note >}}
## Set the security context for a Container
To specify security settings for a Container, include the `securityContext` field