<p>I manage a deployment of Kubernetes on Openstack.</p>
<p>My user pods mount a <code>PersistentVolume</code> created dynamically using Openstack Cinder as their home folder.</p>
<p>What is strange is that if I create an (empty) file with file permissions 600:</p>
<pre><code>bash-4.2$ ls -l
total 16
-rw------- 1 jovyan users     0 Jul 16 17:55 id_rsa
</code></pre>
<p>Then I kill the container and restart it, the volume gets mounted again, but the permissions now have <code>rw</code> for group permissions:</p>
<pre><code>bash-4.2$ ls -l
total 16
-rw-rw---- 1 jovyan users     0 Jul 16 17:55 id_rsa
</code></pre>
<p>Any suggestions on how to debug this further?</p>
<h2>Details on Kubernetes configuration</h2>
<ul>
<li>The volume <code>AccessMode</code> is <code>ReadWriteOnce</code>, <code>volumeMode: Filesystem</code></li>
<li>Volume filesystem is <code>ext4</code>: <code>/dev/sdf: Linux rev 1.0 ext4 filesystem data, UUID=c627887b-0ff0-4310-b91d-37fe5ca9564d (needs journal recovery) (extents) (64bit) (large files) (huge files)</code></li>
</ul>
<h2>Check on Openstack</h2>
<p>I first thought it was an Openstack issue, but if I detach the volume from the Openstack instance, then attach it again using Openstack commands, and mount it using the terminal on a node, permissions are ok. So I think it is Kubernetes messing with the permissions somehow.</p>
<h2>Yaml resources</h2>
<p>I pasted the YAML files for the pod, the PV and the PVC on a gist, see <a href="https://gist.github.com/zonca/21b81f735d0cc9a06cb85ae0fa0285e5" rel="noreferrer">https://gist.github.com/zonca/21b81f735d0cc9a06cb85ae0fa0285e5</a></p>
<p>I also added the output of <code>kubectl describe</code> for those resources.
It is a deployment of the <code>Jupyterhub</code> 0.9.0 Helm package.</p>

<p>This is happening because you have configured your pod with <code>fsGroup</code>.  It's specified under the <code>securityContext</code>:</p>
<pre><code>---
securityContext:
  fsGroup: 100
---
</code></pre>
<p>Whenever <code>fsGroup</code> field is specified, all processes of the container are also part of the supplementary group ID. The owner for volumes and any files created in that volume will be Group ID.</p>
<p>Here`s how <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#podsecuritycontext-v1-core" rel="noreferrer">kubernetes API docs</a> explains that:</p>
<blockquote>
<p><code>fsGroup</code> is a special supplemental group that applies to all
containers in a pod. Some volume types allow the Kubelet to change the
ownership of that volume to be owned by the pod:</p>
<ol>
<li>The owning GID will be the FSGroup</li>
<li>The setgid bit is set (new files created in the volume will be owned by FSGroup)</li>
<li><strong>The permission bits are OR'd
with rw-rw---- If unset, the Kubelet will not modify the ownership and
permissions of any volume</strong>.</li>
</ol>
</blockquote>
