如何设置pod的文件或目录访问权限？

Question

我成功地创建了shinyinfo-jenkins-pod.yaml和shinyinfo-jenkins-svc.yaml，我可以看到pod正在运行。在pod yaml文件中，我挂载了两个卷。但是在pod运行后如何改变pod的目录访问权限呢？

我使用的命令如下：

[master@master1 ~]$ sudo kubectl exec -it shinyinfo-jenkins -- /bin/bash
jenkins@shinyinfo-jenkins:/$
jenkins@shinyinfo-jenkins:/$
jenkins@shinyinfo-jenkins:/$ chmod 777 /var/jenkins_home
chmod: changing permissions of '/var/jenkins_home': Operation not permitted
jenkins@shinyinfo-jenkins:/$ sudo chmod 777 /var/jenkins_home
bash: sudo: command not found
jenkins@shinyinfo-jenkins:/$ su
su: must be run from a terminal

从上面可以看出，我无法更改挂载目录访问权限。

shinyinfo-jenkins-pod.yaml文件：

apiVersion: v1
kind: Pod
metadata:
 name: shinyinfo-jenkins
 labels:
   app: shinyinfo-jenkins
spec:
 containers:
   - name: shinyinfo-jenkins
     image: shinyinfo_jenkins
     imagePullPolicy: Never
     ports:
       - containerPort: 8080
         containerPort: 50000
     volumeMounts:
     - mountPath: /devops/password
       name: jenkins-password
     - mountPath: /var/jenkins_home
       name: jenkins-home
 volumes:
   - name: jenkins-password
     hostPath:
       path: /jenkins/password
   - name: jenkins-home
     hostPath:
       path: /jenkins

Answer 1

在基础主机上创建的文件或目录只能由根用户写入。您需要在特权容器r中以根用户身份运行进程，或者修改主机上的文件权限，以便能够写入hostPath卷。(ref：https://kubernetes.io/docs/concepts/storage/volumes/#hostpath)。

要启用特权模式：

spec:
 containers:
   securityContext:
     privileged: true # Processes in privileged containers are essentially equivalent to root on the host.