<p>Is there any way to set per-volume permissions/ownership in Kubernetes declaratively?</p>

<p>Usecase:</p>

<ul>
<li>a pod is composed of two containers, running as two distinct users/groups, both of them non-root, and are unable to <code>sudo</code></li>
<li>the containers mount a volume each, and need to create files in these volumes (e.g. both of them want to write logs)</li>
</ul>

<p>We know that we can use <code>fsGroup</code>, however that is a pod-level declaration. So even if we pick fsGroup equal to user in first container, then we are going to have permission issues in the other one. (ref: <a href="https://stackoverflow.com/questions/43544370/kubernetes-how-to-set-volumemount-user-group-and-file-permissions">Kubernetes: how to set VolumeMount user group and file permissions</a>)</p>

<p>One solution is to <strong>use init-container to change permissions of mounted directories</strong>.</p>

<p>The init-container would need to mount both volumes (from both containers), and do the needed <code>chown</code>/<code>chmod</code> operations.</p>

<p>Drawbacks:</p>

<ul>
<li>extra container that needs to be aware of other containers' specific (ie. uid/gid)</li>
<li>init container needs to run as root to perform <code>chown</code></li>
</ul>
