<p>Does the usage of filesystem access control lists is a good practice for cloud-native application design? Does native K8s storage types support it?</p>

<p>I would like to assign file permissions based on Linux file system groups. I want only specific users to have RWX access and others to be limited to Read. Does commonly used storage types support it or some don’t.</p>

Kodar
<p>Yes, permissions for specific users (<code>UID</code>) and groups (<code>GID</code>) can be set for volumes mounted in containers using three ways:</p>

<ol>
<li><p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/" rel="nofollow noreferrer">Security Context</a> - using security context, we can specify</p>

<ul>
<li><p>User ID (<code>UID</code>) for <code>runAsUser</code></p></li>
<li><p>Group ID (<code>GID</code>) for <code>runAsGroup</code> and <code>fsGroup</code></p></li>
</ul>

<pre><code>...
kind: Pod
...
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  ...
  containers:
  ...
</code></pre></li>
<li><p>Use <code>chown</code> and/or <code>chmod</code> in <a href="https://kubernetes.io/docs/concepts/workloads/pods/init-containers/" rel="nofollow noreferrer">Init containers</a></p>

<pre><code>...
kind: Pod
...
spec:
  initContainers:
  - name: set-data-dir-permission
    image: my_image
    command:
    - chown
    - -R
    - myuser:mygroup
    - /my_directory
    volumeMounts:
    - name: data
      mountPath: /my_directory
  containers:
  ...
</code></pre></li>
<li>Using the <code>readOnly</code>, <code>mode</code> and <code>accessModes</code> fields for <a href="https://kubernetes.io/docs/concepts/storage/volumes/" rel="nofollow noreferrer">persistent volumes.</a></li>
</ol>

<p>Kubernetes also supports assigning <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#assign-selinux-labels-to-a-container" rel="nofollow noreferrer">SELinux labels to a Container</a> using the <code>seLinuxOptions</code> field in the <code>securityContext</code> section of the Pod manifest. The <code>seLinuxOptions</code> field is an <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.15/#selinuxoptions-v1-core" rel="nofollow noreferrer"><code>SELinuxOptions</code></a> object.</p>
