michal/mcpctl
1
0
Fork 0
Code Issues Pull Requests 7 Actions Packages Projects Releases Wiki Activity

fix(k8s): set fsGroup on pods with volumes

Browse Source 
A freshly provisioned PVC mounts root:root, so any image that drops privileges
cannot write to it. docs-mcp-server runs as uid 1000 and died on first start
with SQLITE_CANTOPEN; its own Dockerfile says to chown the volume 1000:1000.

Pods with volumes now carry securityContext.fsGroup, defaulting to 1000 and
overridable per volume. fsGroupChangePolicy is OnRootMismatch so Kubernetes
does not walk and re-chown the whole volume on every start.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BMXdb2qZbPSh8Q7XpTyjB
This commit is contained in:
Michal
2026-08-10 12:31:31 +01:00
parent bb4b0b910f
commit b07287baf2
7 changed files with 57 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/mcpd/tests/k8s-manifest.test.ts
View File

@@ -177,6 +177,24 @@ describe('volumes', () => {
const pod = generatePodSpec(baseSpec, 'mcpctl-servers');
expect(pod.spec.volumes).toBeUndefined();
expect(pod.spec.containers[0]!.volumeMounts).toBeUndefined();
expect(pod.spec.securityContext).toBeUndefined();
});
it('sets fsGroup so a non-root image can write to a fresh claim', () => {
// A PVC mounts root:root. Without fsGroup, any image that drops privileges
// (docs-mcp-server runs as uid 1000) fails on first write.
const pod = generatePodSpec(volumeSpec, 'mcpctl-servers');
expect(pod.spec.securityContext?.fsGroup).toBe(1000);
// "Always" re-chowns the entire volume on every start.
expect(pod.spec.securityContext?.fsGroupChangePolicy).toBe('OnRootMismatch');
});
it('honours an explicit fsGroup', () => {
const pod = generatePodSpec(
{ ...baseSpec, volumes: [{ claimName: 'c', mountPath: '/d', sizeGb: 1, fsGroup: 65534 }] },
'ns',
);
expect(pod.spec.securityContext?.fsGroup).toBe(65534);
});
it('carries volumes into a deployment pod template', () => {