<p>I am new to K8S.  I have a yaml file which generates kubernetes secrets mounted on projected volumes.  Upon execution, I found that the secret files (packaged with secrets) are showing "root" as file owner and group owner.  I want to change the file owner and group owner to the same specific user (say 450).  </p>

<p>I have tried using "chown" from init container (tried it but failed), but I got error saying "read-only file system" and could not modify file &amp; group owner.
I do not want to use "fsGroup" under securitycontext. I observed that the "mode:" option under "items" behaves in unpredictable manner when fsGroup is used.</p>

<p>Is there any way to modify default file and group owner of the kubernetes secret files that are mounted via projected volumes ? </p>

<p>I am providing the sample code below. Suppose I want to change the file &amp; group owner of "password" file (under 'mysecret2') in the below sample.  how to achieve it?</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: volume-test
spec:
  containers:
  - name: container-test
    image: busybox
    volumeMounts:
    - name: all-in-one
      mountPath: "/projected-volume"
      readOnly: true
  volumes:
  - name: all-in-one
    projected:
      sources:
      - secret:
          name: mysecret
          items:
            - key: username
              path: username
      - secret:
          name: mysecret2
          items:
            - key: password
              path: password
              mode: 511
</code></pre>

<p>As far as I know, there's no way to change owner UID for secrets.</p>

<p>A workaround is to copy a secret to a normal file, then change its ownership and mode, like this:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: volume-test
spec:
  containers:
  - name: container-test
    image: busybox
    command: |
      - "/bin/bash"
      - "-exc"
        cp /etc/secrets-mount/*_pgpass /etc/secrets
        chown my-user /etc/*_pgpass
        chmod 600 /etc/*_pgpass
        exec su-exec my-user /entrypoint.sh
    volumeMounts:
    - name: secrets
      mountPath: /etc/secrets-mount/

....
</code></pre>
