<p>I'm creating a Kubernetes PVC and a Deploy that uses it.</p>

<p>In the yaml it is specified that uid and gid must be 1000.</p>

<p>But when deployed the volume is mounted with different IDs so I have no write access on it.</p>

<p>How can I specify effectively uid and gid for a PVC?</p>

<p>PVC yaml:</p>



<pre class="lang-yaml prettyprint-override"><code>---

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: jmdlcbdata
  annotations:
    pv.beta.kubernetes.io/gid: "1000"
    volume.beta.kubernetes.io/mount-options: "uid=1000,gid=1000"
    volume.beta.kubernetes.io/storage-class: default
spec:
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "2Gi"
  storageClassName: "default"
</code></pre>

<p>Deploy yaml:</p>

<pre class="lang-yaml prettyprint-override"><code>---

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  creationTimestamp: null
  name: jmdlcbempty
  namespace: default
spec:
  replicas: 1
  strategy:
    type: Recreate
  template:
    metadata:
      creationTimestamp: null
      labels:
        name: jmdlcbempty
    spec:
      securityContext:
        runAsUser: 1000
        fsGroup: 1000
      volumes:
        - name: jmdlcbdata
          persistentVolumeClaim:
            claimName: jmdlcbdata  
      containers:
        - name: myalpine
          image: "alpine"
          command:
            - /bin/sh
            - "-c"
            - "sleep 60m"
          imagePullPolicy: IfNotPresent


          volumeMounts:
            - mountPath: /usr/share/logstash/data
              name: jmdlcbdata
</code></pre>

<p>And here is the dir list:</p>

<pre class="lang-yaml prettyprint-override"><code>$ kubectl get pvc; kubectl get pods;            
NAME         STATUS    VOLUME                                     CAPACITY   ACCESS MODES   STORAGECLASS   AGE
jmdlcbdata   Bound     pvc-6dfcdb29-8a0a-11e8-938b-1a5d4ff12be9   20Gi       RWO            default        2m
NAME                           READY     STATUS    RESTARTS   AGE
jmdlcbempty-68cd675757-q4mll   1/1       Running   0          6s
$ kubectl exec -it jmdlcbempty-68cd675757-q4mll -- ls -ltr /usr/share/logstash/
total 4
drwxr-xr-x    2 nobody   42949672      4096 Jul 17 21:44 data
</code></pre>

<p>I'm working on a IBM's Bluemix cluster.</p>

<p>Thanks.</p>

<p>After some experiments, finally, I can provide an answer. </p>

<p>There are several ways to run processes in a Container from specific UID and GID:</p>

<ol>
<li><p><code>runAsUser</code> field in <code>securityContext</code> in a Pod definition specifies a user ID for the first process runs in Containers in the Pod. </p></li>
<li><p><code>fsGroup</code> field in <code>securityContext</code> in a Pod specifies what group ID is associated with all Containers in the Pod. This group ID is also associated with volumes mounted to the Pod and with any files created in these volumes.</p></li>
<li><p>When a Pod consumes a PersistentVolume that has a <code>pv.beta.kubernetes.io/gid</code> annotation, the annotated GID is applied to all Containers in the Pod in the same way that GIDs specified in the Pod’s security context are.    </p></li>
</ol>

<p>Note, every GID, whether it originates from a PersistentVolume annotation or the Pod’s specification, is applied to the first process run in each Container.</p>

<p>Also, there are several ways to set up mount options for <code>PersistentVolume</code>s. A <code>PersistentVolume</code> is a piece of storage in the cluster that has been provisioned by an administrator. Also, it can be provisioned dynamically using a <code>StorageClass</code>. Therefore, you can specify mount options in a <code>PersistentVolume</code> when you create it manually. Or you can specify them in <code>StorageClass</code>, and every PersistentVolume requested from that class by a <code>PersistentVolumeClaim</code> will have these options.</p>

<p>It is better to use <code>mountOptions</code> attribute than <code>volume.beta.kubernetes.io/mount-options</code> annotation and <code>storageClassName</code> attribute instead of <code>volume.beta.kubernetes.io/storage-class</code> annotation. These annotations were used instead of the attributes in the past and they are still working now, however they will become fully deprecated in a future Kubernetes release. Here is an example:</p>



<pre class="lang-yaml prettyprint-override"><code>kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: with-permissions
provisioner: &lt;your-provider&gt;
parameters:
  &lt;option-for your-provider&gt;
reclaimPolicy: Retain
mountOptions: #these options
  - uid=1000
  - gid=1000
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: test
spec:
  accessModes:
    - "ReadWriteOnce"
  resources:
    requests:
      storage: "2Gi"
  storageClassName: "with-permissions" #these options
</code></pre>

<p>Note that mount options are not validated, so mount will simply fail if one is invalid. And you can use <code>uid=1000, gid=1000</code> mount options for file systems like FAT or NTFS, but not for EXT4, for example.</p>

<p>Referring to your configuration:</p>

<ol>
<li><p>In your PVC yaml <code>volume.beta.kubernetes.io/mount-options: "uid=1000,gid=1000"</code> is not working, because it is an option for StorageClass or PV.</p></li>
<li><p>You specified <code>storageClassName: "default"</code> and <code>volume.beta.kubernetes.io/storage-class: default</code> in your PVC yaml, but they are doing the same. Also, <code>default</code> <code>StorageClass</code> do not have mount options by default.</p></li>
<li><p>In your PVC yaml 'pv.beta.kubernetes.io/gid: "1000"' annotation does the same as <code>securityContext.fsGroup: 1000</code> option in Deployment definition, so the first is unnecessary.</p></li>
</ol>

<p>Try to create a <code>StorageClass</code> with required mount options (<code>uid=1000, gid=1000</code>), and use a PVC to request a PV from it, as in the example above. After that, you need to use a <code>Deployment</code> definition with <code>SecurityContext</code> to setup access to mounted PVC. But make sure that you are using mount options available for your file system.</p>
