UPSTREAM: 43375: Set permission for volume subPaths
@@ -127,7 +127,28 @@ func makeMounts(pod *api.Pod, podDir string, container *api.Container, hostName,
return nil, err
}
if mount.SubPath != "" {
+ fileinfo, err := os.Lstat(hostPath)
+ if err != nil {
+ return nil, err
+ }
+ perm := fileinfo.Mode()
+
hostPath = filepath.Join(hostPath, mount.SubPath)
+
+ // Create the sub path now because if it's auto-created later when referenced, it may have an
+ // incorrect ownership and mode. For example, the sub path directory must have at least g+rwx
+ // when the pod specifies an fsGroup, and if the directory is not created here, Docker will
+ // later auto-create it with the incorrect mode 0750
+ if err := os.MkdirAll(hostPath, perm); err != nil {
+ glog.Errorf("failed to mkdir:%s", hostPath)
+ return nil, err
+ }
+
+ // chmod the sub path because umask may have prevented us from making the sub path with the same
+ // permissions as the mounter path
+ if err := os.Chmod(hostPath, perm); err != nil {
+ return nil, err
+ }
}
// Docker Volume Mounts fail on Windows if it is not of the form C:/
