liveBook · Manning

Fsgroup field

As explained in Kubernetes in Action, Second Edition

The fsGroup field is a Kubernetes pod security-context field that assigns a supplemental group and can set group ownership for mounted volume files.

The fsGroup field is a Pod security-context setting that assigns a supplemental group to every container and changes group ownership on mounted volume files. It helps a non-root process read protected volume content when the files initially belong to root. section 9.5.4

Letting Envoy read a private key

A secret volume contains example-com.key with mode 0640 and is initially owned by root:root. The Envoy process runs as user and group 101, so it cannot read the key. Add this to the Pod specification: fsGroup: 101. After recreating the Pod, the mounted files become owned by root:envoy, allowing Envoy to start and the Pod to reach Running status. section 9.5.4

fsGroup changes group ownership, not user ownership: mounted files can become owned by the selected group, but their user owner remains unchanged. section 9.5.4

How Kubernetes in Action, Second Edition covers it

How deep it goes
Demonstrates a permission failure, manifest change, Pod recreation, and ownership check, but stops short of changing user ownership.
Examples
Uses an Envoy container, a TLS secret volume, example-com.key, UID/GID 101, and kubectl ownership checks.
What it assumes
Assumes basic awareness of containers, users, groups, file modes, Pods, and mounted volumes.
What you can do after
Operate/configure a Pod manifest so a non-root container can read protected files from a mounted volume.
How it connects
Connects Pod security contexts with supplemental groups, secret volumes, mounted-file ownership, and volume permissions.
Cover of Kubernetes in Action, Second Edition
liveBookmanning.com
Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.