<p>From my understanding (based on this guide <a href="https://snyk.io/blog/10-kubernetes-security-context-settings-you-should-understand/" rel="nofollow noreferrer">https://snyk.io/blog/10-kubernetes-security-context-settings-you-should-understand/</a>), if I have the following security context specified for some kubernetes pod</p>
<pre><code>securityContext:
  # Enforce to be run as non-root user
  runAsNonRoot: true
  # Random values should be fine
  runAsUser: 1001
  runAsGroup: 1001
  # Automatically convert mounts to user group
  fsGroup: 1001
  # For whatever reasons this is not working
  fsGroupChangePolicy: &quot;Always&quot;
</code></pre>
<p>I expect this pod to be run as user 1001 with the group 1001. This is working as expected, because running <code>id</code> in the container results in: <code>uid=1001 gid=1001 groups=1001</code>.</p>
<p>The file system of all mounts should automatically be accessible by user group 1001, because we specified <code>fsGroup</code> and <code>fsGroupChangePolicy</code>. I guess that this also works because when running <code>ls -l</code> in one of the mounted folders, I can see that the access rights for the files look like this: <code>-rw-r--r-- 1 50004 50004</code>. Ownership is still with the uid and gid it was initialised with but I can see that the file is now readable for others.</p>
<p>The question now is how can I add write permission for my <code>fsGroup</code> those seem to still be missing?</p>

mike
<p>You need to add an additional <code>init_container</code> in your pod/deployment/{supported_kinds} with the commands to give/change the permissions on the volume mounted on the pod to the userID which container is using while running.</p>
<pre class="lang-yaml prettyprint-override"><code> initContainers:
  - name: volumepermissions
    image: busybox ## any image having linux utilities mkdir,echo,chown will work.
    imagePullPolicy: IfNotPresent
    env:
      - name: &quot;VOLUME_DATA_DIR&quot;
        value: mountpath_for_the_volume
    command:
      - sh
      - -c
      - |
        mkdir -p $VOLUME_DATA_DIR
        chown -R 1001:1001 $VOLUME_DATA_DIR 

        echo 'Volume permissions OK ✓'
    volumeMounts:
      - name: data
        mountPath: mountpath_for_the_volume
</code></pre>
<p><s>This is necessary when a container in a pod is running as a user other than root and needs write permissions on a mounted volume.</s></p>
<p>if this is a helm template this init container can be created as a template and used in all the pods/deployments/{supported kinds} to change the volume permissions.</p>
<p>Update: As mentioned by @The Fool, it should be working as per the current setup if you are using Kubernetes v1.23 or greater. After v1.23 <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#configure-volume-permission-and-ownership-change-policy-for-pods" rel="nofollow noreferrer">securityContext.fsGroup and securityContext.fsGroupChangePolicy</a> features went into GA/stable.</p>
