azure_file volumes should allow setting of dir_mode and file_mode

[lam-rubikloud]

Is this a request for help? (If yes, you should use our troubleshooting guide and community support channels, see http://kubernetes.io/docs/troubleshooting/.): no

What keywords did you search in Kubernetes issues before filing this one? (If you have found any duplicates, you should instead reply there.): azurefile azure_file 0777

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one): FEATURE REQUEST

Kubernetes version (use kubectl version):
Client Version: version.Info{Major:"1", Minor:"4", GitVersion:"v1.4.5", GitCommit:"5a0a696437ad35c133c0c8493f7e9d22b0f9b81b", GitTreeState:"clean", BuildDate:"2016-10-29T01:38:40Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"4", GitVersion:"v1.4.5", GitCommit:"5a0a696437ad35c133c0c8493f7e9d22b0f9b81b", GitTreeState:"clean", BuildDate:"2016-10-29T01:32:42Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}

Environment:

• Cloud provider or hardware configuration: Microsoft Azure Container Service
• OS (e.g. from /etc/os-release): Ubuntu 16.04 LTS
• Kernel (e.g. uname -a): Linux 4.4.0-28-generic Some documentation tweaks #47-Ubuntu SMP Fri Jun 24 10:09:13 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

What happened:
I attempted to set up an Azure File Volume using the built-in volume type azureFile. Everything works, except that the files and directories defaults to permission 0777, always.

When I tried to manually mount within the container, I could customise dir_mode and file_mode, meaning that this change should be possible. Reading the source code confirms it - dir_mode=0777 and file_mode=0777 seem hardcoded.

What you expected to happen:
Being able to supply dir_mode and file_mode to the mount. e.g.

- name: myvolume
  azureFile:
    secretName: supersecret
    shareName: myshare
    readOnly: false
    dirMode: 0400
    fileMode: 0400

How to reproduce it (as minimally and precisely as possible):
N/A. This is a feature request.

Anything else do we need to know:
N/A

[justinwyer]

This is a big requirement, using an azure file volume for postgresql for instance fails due to permissions as initdb tries to change the permissions to be less restrictive but is unable to.

[lam-rubikloud]

Evaluating compatibility between a certain setup of a volume mount and an arbitrary piece of software would be the responsibility of the integrator, wouldn't it?

It seems a big requirement for K8s itself to have to ensure PostgreSQL can do what it wants. An integrator who tries to use Azure File Storage for PostgreSQL should know better to mount with the correct permission.

[justinwyer]

The point is that you cannot mount with permissions, they're hard coded to 0777.

[lam-rubikloud]

Ah. Yeah. Sorry for misunderstanding the comment above. Let's say it is an "important" requirement :)

[0xmichalis]

/sig azure

[andyzhangx]

/assign andyzhangx

[andyzhangx]

@justinwyer
I have a #54674 for this, use mount options in storage class, below is an example:

---
kind: StorageClass
apiVersion: storage.k8s.io/v1
metadata:
  name: azurefile
provisioner: kubernetes.io/azure-file
mountOptions:
  - dir_mode=0377
  - file_mode=0350
parameters:
  skuName: Standard_LRS
  location: westus2

[adysart78]

@andyzhangx Has this change made it into any release yet? I can't seem to find it... Or was the issue resolved in some other way? I'm facing the issue you originally reported, i.e. using a pod volume to an azureFile, and it always mounting with file_mode and dir_mode of 0755... and I need it to be 0777. Is there a workaround? TIA.

[andyzhangx]

@adysart78 azure file mountOptions feature is available from v1.8.5, here is the example : https://github.com/andyzhangx/demo/blob/master/linux/azurefile/azurefile-mountoptions.md

[adysart78]

Thanks @andyzhangx -- I was still having trouble until I added the storageClassName: "" to the claim... then realized I was hitting issue #44370... which I can avoid by setting storageClassName: "default" to both the pv and pvc, and now everything works. Thanks again!