<p>In kubernetes you can set volumes permissions at pod ,pv or pvc levels.
You can define pv | pvc as read only but still can write to the mount point if <strong>readOnly</strong> attribute is set to <strong>false</strong> which is pretty confusing.
I have read a lot of articles about this but still can't fully understand the purpose.</p>
<p>What I inderstand:</p>
<ul>
<li>Permissions at pv level are for requesting available ressouces from the host file system with at least the same permissions defined in pv.</li>
<li>Permissions at pvc level are for requesting pv with at least the same permissions defined in pvc.</li>
<li>Permissions at pod level are for setting permissions to the mount point.</li>
</ul>
<p>Please correct me if I'm wrong</p>

Amine Bouzid
<p>The <code>PV</code>'s (and <code>PVC</code>'s) access modes are used only for binding <code>PVC</code> (<code>PV</code>).</p>
<p>As you can see in this <a href="https://github.com/kubernetes/kubernetes/issues/60903#issuecomment-377086770" rel="nofollow noreferrer">github discussion</a>:</p>
<blockquote>
<p>AccessModes as defined today, only describe node attach (not pod mount) semantics, and doesn't enforce anything.</p>
</blockquote>
<p>Additionally you can find useful information in the <a href="https://docs.openshift.com/dedicated/4/storage/understanding-persistent-storage.html#pv-access-modes_understanding-persistent-storage" rel="nofollow noreferrer">PV AccessModes documentation</a>:</p>
<blockquote>
<p>A volume’s AccessModes are descriptors of the volume’s capabilities. They are not enforced constraints. The storage provider is responsible for runtime errors resulting from invalid use of the resource.
For example, NFS offers ReadWriteOnce access mode. You must mark the claims as read-only if you want to use the volume’s ROX capability.</p>
</blockquote>
<p>To enforce <code>readOnly</code> mode you can use:</p>
<p><code>Pod.spec.volumes.persistentVolumeClaim.readOnly</code> - controls if volume is in readonly mode.</p>
<p>I think this <a href="https://stackoverflow.com/a/52208276/14801225">answer</a> may be of great help to you.</p>
