<p>I would like to provide DAGs to all Kubernetes airflow pods (web, scheduler, workers) via a persistent volume,</p>

<pre><code>kubectl create -f pv-claim.yaml
</code></pre>

<p>pv-claim.yaml containing:</p>

<pre><code>kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: airflow-pv-claim
  annotations:
    pv.beta.kubernetes.io/gid: "1000"
    pv.beta.kubernetes.io/uid: "1000"
spec:
  storageClassName: standard
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
</code></pre>

<p>The deployment command is then:</p>

<pre><code>helm install --namespace my_name --name "airflow" stable/airflow --values ~my_name/airflow/charts/airflow/values.yaml
</code></pre>

<p>In the chart stable/airflow, values.yaml also allows for specification of persistence:</p>

<pre><code>persistence:
  enabled: true
  existingClaim: airflow-pv-claim
  accessMode: ReadWriteMany
  size: 1Gi
</code></pre>

<p>But if I do</p>

<pre><code>kubectl exec -it airflow-worker-0 -- /bin/bash
touch dags/hello.txt
</code></pre>

<p><strong>I get a permission denied error.</strong></p>

<p>I have tried hacking the airflow chart to set up an initContainer to chown dags/:</p>

<pre><code>command: ["sh", "-c", "chown -R 1000:1000 /dags"]
</code></pre>

<p>which is working for all but the workers (because they are created by flower?), as suggested at <a href="https://serverfault.com/a/907160/464205">https://serverfault.com/a/907160/464205</a></p>

<p>I have also seen talk of fsGroup etc. - see e.g. <a href="https://stackoverflow.com/questions/50156124/kubernetes-nfs-persistent-volumes-permission-denied">Kubernetes NFS persistent volumes permission denied</a></p>

<p>I am trying to avoid editing the airflow charts (which seems to require hacks to at least two deployments-*.yaml files, plus one other), but perhaps this is unavoidable.</p>

<p><strong>Punchline:</strong></p>

<p><strong>What is the easiest way to provision DAGs through a persistent volume to all airflow pods running on Kubernetes, with the correct permissions?</strong></p>

<p>See also:</p>

<p><a href="https://stackoverflow.com/questions/50767186/persistent-volume-atached-to-k8s-pod-group">Persistent volume atached to k8s pod group</a></p>

<p><a href="https://stackoverflow.com/questions/50156124/kubernetes-nfs-persistent-volumes-permission-denied">Kubernetes NFS persistent volumes permission denied</a> [not clear to me how to integrate this with the airflow helm charts]</p>

<p><a href="https://stackoverflow.com/questions/46974105/kubernetes-setting-custom-permissions-file-ownership-per-volume-and-not-per-p?noredirect=1&amp;lq=1">Kubernetes - setting custom permissions/file ownership per volume (and not per pod)</a> [non-detailed, non-airflow-specific]</p>

<p>It turns out you do, I think, have to edit the airflow charts, by adding the following block in <code>deployments-web.yaml</code> and <code>deployments-scheduler.yaml</code> under <code>spec.template.spec</code>:</p>

<pre><code>kind: Deployment
spec:
  template:
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        fsUser: 1000
</code></pre>

<p>This allows one to get dags into airflow using e.g.</p>

<pre><code>kubectl cp my_dag.py my_namespace/airflow-worker-0:/usr/local/airflow/dags/
</code></pre>
