From 9f7d8754e36069f5ce44cef4a67b2b54ac3b968b Mon Sep 17 00:00:00 2001 From: Lisa Pettyjohn Date: Thu, 3 Feb 2022 10:31:16 -0500 Subject: [PATCH] OSDOCS-2455:fsGroup --- .../storage-persistent-storage-fsGroup.adoc | 33 +++++++++++++++++++ storage/understanding-persistent-storage.adoc | 2 ++ 2 files changed, 35 insertions(+) create mode 100644 modules/storage-persistent-storage-fsGroup.adoc diff --git a/modules/storage-persistent-storage-fsGroup.adoc b/modules/storage-persistent-storage-fsGroup.adoc new file mode 100644 index 0000000000..141b310eab --- /dev/null +++ b/modules/storage-persistent-storage-fsGroup.adoc @@ -0,0 +1,33 @@ +// Module included in the following assemblies: +// +// * storage/understanding-persistent-storage.adoc + +[id="using_fsGroup_{context}"] += Using fsGroup to reduce pod timeouts + +If a storage volume contains many files (~1,000,000 or greater), you may experience pod timeouts. + +This can occur because, by default, {product-title} recursively changes ownership and permissions for the contents of each volume to match the `fsGroup` specified in a pod's `securityContext` when that volume is mounted. For large volumes, checking and changing ownership and permissions can be time consuming, slowing pod startup. You can use the `fsGroupChangePolicy` field inside a `securityContext` to control the way that {product-title} checks and manages ownership and permissions for a volume. + +`fsGroupChangePolicy` defines behavior for changing ownership and permission of the volume before being exposed inside a pod. This field only applies to volume types that support `fsGroup`-controlled ownership and permissions. This field has two possible values: + +* `OnRootMismatch`: Only change permissions and ownership if permission and ownership of root directory does not match with expected permissions of the volume. This can help shorten the time it takes to change ownership and permission of a volume to reduce pod timeouts. + +* `Always`: Always change permission and ownership of the volume when a volume is mounted. + +.`fsGroupChangePolicy` example +[source,yaml] +---- +securityContext: + runAsUser: 1000 + runAsGroup: 3000 + fsGroup: 2000 + fsGroupChangePolicy: "OnRootMismatch" <1> + ... +---- +<1> `OnRootMismatch` specifies skipping recursive permission change, thus helping to avoid pod timeout problems. + +[NOTE] +==== +The fsGroupChangePolicyfield has no effect on ephemeral volume types, such as secret, configMap, and emptydir. +==== diff --git a/storage/understanding-persistent-storage.adoc b/storage/understanding-persistent-storage.adoc index 88d80a339c..ab69c4ac65 100644 --- a/storage/understanding-persistent-storage.adoc +++ b/storage/understanding-persistent-storage.adoc @@ -28,3 +28,5 @@ include::modules/storage-persistent-storage-block-volume.adoc[leveloffset=+1] include::modules/storage-persistent-storage-block-volume-examples.adoc[leveloffset=+2] endif::openshift-enterprise,openshift-webscale,openshift-origin[] + +include::modules/storage-persistent-storage-fsGroup.adoc[leveloffset=+1]