volume: Change owner of symlinks too

[mauriciovasquezbernal]

What type of PR is this?
/kind cleanup

What this PR does / why we need it:
This commit uses Lchown instead of Chown to change the owner of symlinks too.
It doesn't change any behaviour. However, it could avoid some confusions as the
symlinks are updated to the correct owner too.

Please consider the following Pod with a configMap:

apiVersion: v1
kind: ConfigMap
metadata:
  name: myconfigmap
  namespace: default
data:
  content: '"This is a ConfigMap"'
---
apiVersion: v1
kind: Pod
metadata:
  name: mypod
spec:
  securityContext:
    fsGroup: 2000
  containers:
  - name: container1
    image: busybox
    command: ["sh"]
    args: ["-c", "sleep infinity"]
    volumeMounts:
    - name: config-volume
      mountPath: /etc/configmap/content
  volumes:
  - name: config-volume
    configMap:
      name: myconfigmap
      defaultMode: 0400

The current behaviour shows that the group owner is 0 for the symlink point to the real content file:

$ kubectl exec -it mypod -- /bin/sh -c 'ls -la /etc/configmap/content/content'
lrwxrwxrwx    1 0     0            14 Sep 18 15:15 /etc/configmap/content/content -> ..data/content

The behaviour after this PR shows as group owner 2000 as specified in fsGroup:

kubectl exec -it mypod -- /bin/sh -c 'ls -la /etc/configmap/content/content'
lrwxrwxrwx    1 0     2000            14 Sep 18 15:15 /etc/configmap/content/content -> ..data/content

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Welcome @mauriciovasquezbernal!

It looks like this is your first PR to kubernetes/kubernetes 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/kubernetes has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @mauriciovasquezbernal. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mauriciovasquezbernal]

/sig storage
/release-note-none

[k8s-ci-robot]

@mauriciovasquezbernal: The label(s) sig/ cannot be applied, because the repository doesn't have them

In response to this:

/sig storage
/release-note-none

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[gnufied]

/assign @sjenning @gnufied

[gnufied]

/ok-to-test

[jingxu97]

/lgtm

[jingxu97]

could you add unit test? Thanks!

cc @msau42

[mauriciovasquezbernal]

@jingxu97 I added the unit test.

[mauriciovasquezbernal]

/retest

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[mauriciovasquezbernal]

@gnufied @sjenning any chance you can give it a look?

[gnufied]

It looks good to me as well. But it would be nice to have a confirmation from @sjenning because he originally made the change that prevented permissions of symlinks from being changed. But at that time - we were calling plain chown which evaluates the symlink and now you are using lchown.

[joelsmith]

Nice that you were able to get rid of an extra stat syscall by using -1 for the UID!

/lgtm

[sjenning]

/approve

[gnufied]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: gnufied, mauriciovasquezbernal, sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/volume/OWNERS [gnufied]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fejta-bot]

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

[fejta-bot]

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

[fejta-bot]

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.

[fejta-bot]

/retest
This bot automatically retries jobs that failed/flaked on approved PRs (send feedback to fejta).

Review the full test history for this PR.

Silence the bot with an /lgtm cancel or /hold comment for consistent failures.