sysbox 0.6.1 does not support K8S 1.23.x fsGroup PodSecurityContext making all kind of non-host volumes useless
@rodnymolina is already working on this.
Since May 25, 2023.
- Dominant language
- Shell
- Stars
- 3.9k
- Forks
- 230
- Avg merge
- 7h 48m
- Merged PRs (30d)
- 3
Description
Install an Ubuntu image with a EmptyDir volume and a Longhorn volume on a Kubernetes 1.23.16 cluster created with Rancher 2.7.3 RKE1 on Ubuntu 20.04 (22.04 does not work with sysbox installer, see https://github.com/nestybox/sysbox/issues/567) and specify "fsGroup: 1000" in the pods securityContext as described here https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods
You will see that the empty dir volume as well as the longhorn volume will be mounted as:
drwxrwxrwx 2 nobody nogroup 4096 May 24 17:02 data
drwxrwsr-x 3 nobody nogroup 4096 May 24 15:39 data2
Even if you do not use the fsGroup security context, the volumes are mounted the same.
When running the pod without sysbox runtime, everything works as exptected, i.e., with fsGroup 1000, the volumes are mounted at GID 1000 and without fsGroup they are mounted as group ID 0.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.