[FR]: implement fsUser option for securityContext

[xhejtman]

Hello,

currently, it seems not to be possible to project secrets or configmaps to files with strict permissions to containers.

Some applications such as sshd require strict permissions on some files like ~/.ssh/authorized_keys, mainly, it requires that this file is owned by the user. For the sshd there is an option to bypass this restriction StrictModes. However, there are different like psql that is able to use ~/.pgpass only with the correct permissions. Operators like cloudnative-pg create a secret that could be projected to ~/.pgpass, but owner cannot be set thus psql refuses to use it.

I think it would be great, if fsUser option could be implemented or some other option that could be used to specify the owner of projected secrets/configmaps.

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[neolit123]

/sig auth

[colearendt]

Totally agree. This is super important in order to handle such permission-sensitive services. Especially in a "minimum access" context where the container is not running as root or (worse?) the filesystem is read only. That is where this issue shows up the most.

Workarounds with init containers are awkward and delay container startup time too.

[colearendt]

Related to #82263 and #81089

[stlaz]

/close
in favour of #81089

[k8s-ci-robot]

@stlaz: Closing this issue.

In response to this:

/close
in favour of #81089

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.