<p>I'm using two VMs with Atomic Host (1 Master, 1 Node; Centos Image). I want to use NFS shares from another VM (Ubuntu Server 16.04) as persistent volumes for my pods. I can mount them manually and in Kubernetes (Version 1.5.2) the persistent volumes are successfully created and bound to my PVCs. Also they are mounted in my pods. <strong>But when I try to write or even read from the corresponding folder inside the pod, I get the error <code>Permission denied</code>.</strong> From my research I think, the problem lies within the folders permission/owner/group on my NFS Host.</p>

<p>My exports file on the Ubuntu VM (<code>/etc/exports</code>) has 10 shares with the following pattern (The two IPs are the IPs of my Atomic Host Master and Node):</p>

<pre><code>/home/user/pv/pv01   192.168.99.101(rw,insecure,async,no_subtree_check,no_root_squash) 192.168.99.102(rw,insecure,async,no_subtree_check,no_root_squash)
</code></pre>

<p>In the image for my pods I create a new user named <code>guestbook</code>, so that the container doesn't use a privileged user, as this insecure. I read many post like <a href="https://www.linuxquestions.org/questions/linux-server-73/write-permission-for-users-on-nfs-folder-852800/" rel="nofollow noreferrer">this one</a>, that state, you have to set the permissions to world-writable or using the same UID and GID for the shared folders. So in my Dockerfile I create the <code>guestbook</code> user with the UID <code>1003</code> and a group with the same name and GID <code>1003</code>:</p>

<pre><code>RUN groupadd -r guestbook -g 1003 &amp;&amp; useradd -u 1003 -r -g 1003 guestbook
</code></pre>

<p>On my NFS Host I also have a user named <code>guestbook</code> with UID <code>1003</code> as a member of the group <code>nfs</code> with GID <code>1003</code>. The permissions of the shared folders (with <code>ls -l</code>) are as following:</p>

<pre><code>drwxrwxrwx 2 guestbook nfs 4096 Feb 19 11:23 pv01
</code></pre>

<p>(world writable, owner guestbook, group nfs). In my Pod I can see the permissions of the mounted folder <code>/data</code> (again with <code>ls -l</code>) as:</p>

<pre><code>drwxrwxrwx. 2 guestbook guestbook 4096 Feb 9 13:37 data
</code></pre>

<p>The persistent Volumes are created with an YAML file with the pattern:</p>

<pre><code>apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv01
  annotations:
    pv.beta.kubernetes.io/gid: "1003"
spec:
  capacity:
    storage: 200Mi
  accessModes:
  - ReadWriteOnce
  - ReadWriteMany
  persistentVolumeReclaimPolicy: Recycle
  nfs:
    path: /home/user/pv/pv01
    server: 192.168.99.104
</code></pre>

<p>The Pod is created with this YAML file:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: get-started
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: get-started
    spec:
      containers:
      - name: get-started
        image: docker.io/cebberg/get-started:custom5
        ports:
        - containerPort: 2525
        env:
        - name: GET_HOSTS_FROM
          value: dns
        - name: REDIS_PASSWORD
          valueFrom:
            secretKeyRef:
              name: redis
              key: database-password
        volumeMounts:
        - name: log-storage
          mountPath: "/data/"
        imagePullPolicy: Always
        securityContext:
          privileged: false
      volumes:
      - name: log-storage
        persistentVolumeClaim:
          claimName: get-started
      restartPolicy: Always
      dnsPolicy: ClusterFirst
</code></pre>

<p>And the PVC with YAML file:</p>

<pre><code>apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: get-started
spec:
  accessModes:
  - ReadWriteMany
  resources:
    requests:
      storage: 100Mi
</code></pre>

<p>I tried different configuration for the owner/group of the folders. If I use my normal user (which is the same on all systems) as owner and group, I can mount manually and read and write in the folder. But I don't want to use my normal user, but use another user (and especially not a privileged user).</p>

<p><strong>What permissions do I have to set, so that the user I create in my Pod can write to the NFS volume?</strong></p>

<p>I found the solution to my problem:
By accident I found log entries, that appear everytime I try to access the NFS volumes from my pods. They say, that SELinux has blocked the access to the folder because of different security context.</p>

<p>To resolve the issue, I simply had to turn on the corresponding SELinux boolean <code>virt_use_nfs</code> with the command</p>

<pre><code>setsebool virt_use_nfs on
</code></pre>

<p>This has to be done on all nodes to make it work correctly.</p>

<p>EDIT:
I remembered, that I now use <code>sec=sys</code> as mount option in <code>/etc/exports</code>. This provides access controll based on UID and GID of the user creating a file (which seems to be the default). If you use <code>sec=none</code> you also have to turn on the SELinux boolean <code>nfsd_anon_write</code>, so that the user <code>nfsnobody</code> has the permission to create files.</p>
