<p>ok I am banging my head now agaainst he wall for serveral days...</p>

<p>my usecase:
I am on my own bare metal cloud, I am running ubuntu machines and setup kubernetes on 4 machines one master 3 workers. I created a private registry and cert-manager etc etc. </p>

<p>also nfs shares are on the worker nodes</p>

<p>i have a piece of software that <strong>has to run as root inside a pod</strong> now i want this root user to store data on a presistent volume on a nfs share.</p>

<p>root_squash is biting me in the but... </p>

<p>I have created volumes and claims and all works ok if i am not root inside the pod. when root the files on the nfs shares are squashed to nobody:nogroup and the root user inside the pod can no longer use them...</p>

<p>what to do?</p>

<p>1) export nfs share with the no_root_squash option but this seems like a very bad idea given security issues, not sure if this can be mitigated by firewall rules alone?</p>

<p>2) i trid all kinds of securityContext options for fsGroup and uid en gid mount options, all work ok as long as you are not root in de pod... but i am not sure if i understand this in full so</p>

<p>My pc yaml:</p>

<pre><code>apiVersion: v1
kind: PersistentVolume
metadata:
  name: s03-pv0004
  annotations:
    pv.beta.kubernetes.io/gid: "1023"
spec:
  capacity:
    storage: 10Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: slow
  mountOptions:
    - hard
    - nfsvers=4.1
  nfs:
    path: /data/k8s/pv0004
    server: 212.114.120.61
</code></pre>

<p>As you van see i created a dedicated  nfsuser with uid 1023 and use this to make the pods store data as this user... works fine as long as i am not rooot inside the pods...</p>

<p>The pods i am running are MarkLogic pods in a stateful set like so:</p>

<pre><code>apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: marklogic
  namespace: default
spec:
  selector:
    matchLabels:
      app: marklogic
  serviceName: "ml-service"
  replicas: 3
  template:
    metadata:
      labels:
        app: marklogic
    spec:
      securityContext:
        fsGroup: 1023
... more
</code></pre>

<p>runAsUser: 1023 works but again not if i want to be root inside the pod...</p>

<p>My question: Can it be done, run a pod as root and still use nfs as persistent volume with a secure nfs share(that is not using no_root_squash) ??? </p>

<p>or do i need to drop the idea of nfs and move to an alternative like glusterfs?</p>

<p><strong>I will try to answer in very simple steps:</strong></p>
<p><strong>1. You can even make root_squash to work for k8s :</strong></p>
<pre><code>- run your containers as non root user: 1023 in your case

- chown -R 1023:1023 &lt;nfs dir&gt;
</code></pre>
<p><strong>2. You can make no_root_squash to work for k8s:</strong></p>
<pre><code>- run your containers as root user: 0 

- chown -R root:root &lt;nfs dir&gt;
</code></pre>
