Skip to content

Commit 6f3354e

Browse files
authored
Update concepts-storage.md
1 parent 5373cee commit 6f3354e

File tree

1 file changed

+8
-9
lines changed

1 file changed

+8
-9
lines changed

AKS-Arc/concepts-storage.md

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -111,24 +111,23 @@ volumeMounts:
111111
- mountPath: "c:\k"
112112
name: k-dir
113113
```
114+
114115
## Secure pod access to mounted volumes
115116

116-
For your applications to run correctly, pods should run as a defined user or group and not as *root*. The 'securityContext' for a pod or container lets you define settings such as *fsGroup* to assume the appropriate permissions on the mounted volumes.
117-
*fsGroup* is a field within the 'securityContext' of a Kubernetes Pod specification. It defines a supplemental group ID that Kubernetes assigns to all processes in the Pod and recursively to the files in mounted volumes. This ensures that the Pod has the correct group-level access to shared storage volumes.
117+
For your applications to run correctly, pods should run as a defined user or group and not as *root*. The `securityContext` for a pod or container lets you define settings such as *fsGroup* to assume the appropriate permissions on the mounted volumes.
118118

119-
When a volume is mounted, Kubernetes changes the ownership of the volume's contents to match the *fsGroup* value. This is particularly useful when containers run as non-root users and need write access to shared volumes.
119+
**fsGroup** is a field within the `securityContext` of a Kubernetes pod specification. It defines a supplemental group ID that Kubernetes assigns to all processes in the pod, and recursively to the files in mounted volumes. This ensures that the pod has the correct group-level access to shared storage volumes.
120120

121-
Example YAML snippet:
122-
```yaml
121+
When a volume is mounted, Kubernetes changes the ownership of the volume's contents to match the **fsGroup** value. This is particularly useful when containers run as non-root users and need write access to shared volumes.
122+
123+
The following example YAML shows the **fsgroup** value:
123124

125+
```yaml
124126
securityContext:
125127
  fsGroup: 2000
126-
127128
```
128-
In this example:
129-
All files in mounted volumes are accessible by GID 2000.
130-
131129

130+
In this example, all files in mounted volumes are accessible by GID 2000.
132131

133132
## Next steps
134133

0 commit comments

Comments
 (0)