Why Does the Owner Group of the File Mounted to the Service Container Change After Configuring fsgroup?

Symptom

When a sidecar is injected into the service pod and fsgroup is set to 1337, the owner group of the file mounted to the service container is changed to 1337.

Analysis

A Kubernetes version bug:

https://github.com/kubernetes/kubernetes/issues/57923

https://github.com/istio/istio/pull/27367

In versions earlier than 1.8.6-r2, fsgroup is automatically set to 1337 during sidecar injection. This setting will change the owner group of the file mounted to the service container to 1337.

Solution

This problem is resolved in Kubernetes v1.19 and later versions. For meshes of v1.8.6-r2 and later, if the cluster version is 1.19 or later, ASM automatically sets EnableLegacyFSGroupInjection to false. This configuration prevents fsgroup from being set to 1337 during sidecar injection, and then the owner group of the file mounted to the service container will not be changed to 1337. If adaptation is performed in the early stage of the business, the adaptation needs to be corrected.