apiVersion: v1
kind: Pod
metadata:
  name: nfs-busybox
spec:
  securityContext:
    runAsUser: 10000
    runAsGroup: 20000
    fsGroup: 20000
  volumes:
  - name: mnt-busybox
    persistentVolumeClaim:
      claimName: pvc-nfs-kube-vol
  containers:
  - name: sec-ctx-demo
    image: busybox
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: mnt-busybox
      mountPath: /data/demo
      subPath: kube_vol
    securityContext:
      allowPrivilegeEscalation: false