fsGroup unsettable in juju k8s

[Tom Barber]

As discussed here: https://discourse.charmhub.io/t/pvc-write-permissions/3950

It appears that we can't set the fsGroup at the correct level to allow write permissions for non-root containers on kubernetes deployments with slightly more restrictive PVC implementations.

        spec = {
            "version": 3,
            "kubernetesResources":{
                "pod":{
                    "securityContext":{
                        "fsGroup": 1001,
                        "runAsUser": 1001,
                        "runAsGroup":1001,
                    }
                }
            },
            "containers": [
                {
                    "name": self.app.name,
                    "imageDetails": image_details,
                    "imagePullPolicy": "Always",
                    "ports": ports,
                },
            ],
        }

Settings like this securityContext should end up in the pods but do not get set and so we can't write to the PVC's using non-root containers.

[Pen Gale (pengale)]

Confirming and dropping into the 3.0.0 milestone, as part of the work we're doing to support more k8s substrates this cycle.

[Ian Booth (wallyworld)]

As per discussion here

https://discourse.charmhub.io/t/pvc-write-permissions/3950/17

I have tried to reproduce with a hacked up mariadb-k8s charm and things appear to be as expected.
Is there a charm that can be shared to reproduce the issue?

[Tom Barber (spicule)]

https://gitlab.com/spiculedata/juju/solr-k8s-charm/-/blob/master/src/charm.py#L73-90

Charms here, as pointed out in the forum post, re-tested it, outside of commenting out some dodgy test code, nothing has changed, but same error persists.

Could be me, but I can't see anything obvious.

juju model version 2.8.7

[Ian Booth (wallyworld)]

As per https://discourse.charmhub.io/t/pvc-write-permissions/3950/22 the issue was with the pod spec being sent in not quite being structured correctly.