Group ownership associates a filesystem object with a Unix user group. The group’s permissions can determine whether a process may read or write the object. This matters when a secret or configMap volume uses stricter permissions: the container process may need matching group ownership to access the mounted files. section 9.5.4
A file’s permissions apply separately to its owner, owning group, and other users. For example, mode 0640 allows the owner to read and write, the group to read, and others no access. In a Pod, set fsGroup in the securityContext to assign the mounted files to the process’s group. section 9.5.4
Allowing a container group to read a secret
A process running as envoy with group ID 101 can use a secret key whose mode is 0640 when the Pod sets fsGroup: 101. Before the setting, the file appears as root root; afterward, it appears as root envoy, so the group permission applies. section 9.5.4
apiVersion: v1
kind: Pod
metadata:
name: kiada-ssl
spec:
securityContext: #1
fsGroup: 101 #1
volumes:
...
Use the Pod securityContext to set fsGroup for mounted secret or configMap files. section 9.5.4
